@_Qazeer
qazeer.io/
Joined November 2020
  • Tweets16
  • Following143
  • Followers224
Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: github.com/wavestone-cdt/EDR… 1/2
6
88
224
Qazeer retweeted
Renzon
@r3nzsec4 Nov 2024
I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir unit42.paloaltonetworks.com/…

TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit

A threat actor attempted to use an AV/EDR bypass tool in an extortion attempt. Instead, the tool provided Unit 42 insight into the threat actor.

unit42.paloaltonetworks.com
6
58
1
216
30,337
What a glorious day for Incident Responders around the world! Premium audit events in Microsoft 365 are now available to non-premium users. 🚨Action for you: - Check your mailbox audit settings, details in the blog: techcommunity.microsoft.com/…
3
33
95
9,517
How to disable some parts of EDR’s telemetry on Windows 10? Just ask nicely! See riskinsight-wavestone.com/en… for more info about an interesting logic bug we found on Win10 that affects all EDRs 😉

A universal EDR bypass built in Windows 10 - RiskInsight

A security design failure in Windows 10 allows a malware to disable some telemetry used by EDR, thus to perform actions without raising alerts

riskinsight-wavestone.com
2
112
3
302
48,224
Forget vulnerable drivers - Admin is all you need Article 👉 elastic.co/security-labs/for… 👇 Demo - enable sound 🔊
13
139
11
369
96,605
🚩 @wavestoneFR CTF team #YoloSw4g ranks first of 80+ teams at #CyberEx23! 🚩 Thanks @INCIBE and @OEA_Cyber for the organization & challenges! 🚩 Congratz to @_Qazeer @th3m4ks and @meaz0u for the great team we've been for the last 8 hours, now we go to a well-deserved sleep!
3
6
2
26
2,909
#Podcast #Cybersécurité Épisode #387 consacré à l'outil de contournement des EDR, "EDR Sandblast", avec @th3m4ks et @_Qazeer nolimitsecu.fr/edrsandblast/
19
1
22
A promise is a promise: the slides from the #DEFCON30 DemoLabs @_Qazeer and I presented about EDRSandblast are uploaded on GitHub (github.com/wavestone-cdt/EDR…), along with the latest version of the tool! Check out the list of new features in the slides, documentation is on its way ;)
18
2
39
FarsightAD and the slides from the SANS DFIR Summit 2022 "Hunting for Active Directory persistence" talk can be found on GitHub as well: github.com/Qazeer/FarsightAD. Thank you to all the in-person and virtual attendees! 2/2

GitHub - Qazeer/FarsightAD: PowerShell script that aim to help uncovering (eventual) persistence...

PowerShell script that aim to help uncovering (eventual) persistence mechanisms deployed by a threat actor following an Active Directory domain compromise - Qazeer/FarsightAD

github.com
14
40
Actually good question, let's start with obviously wrong answers and see where they lead us. A thread 🧵
Steve Syfuhs@SteveSyfuhs26 Jul 2022
Pop quiz: the domain controller for your forest is completely utterly compromised. Attackers have gotten to SYSTEM on DC01$. How do you recover from this?
17%Nuke DC from orbit
48%Nuke forest from orbit
24%Rekey all the things
11%Other
1,609 votes • Final results
3
37
1
102
Hey, do you like tokens? Have you always wanted to "harvest" tokens for offensive purposes? If so check out my new post posts.specterops.io/koh-the-… where I show I can (finally) write a technical post without memes, and then check out the Koh toolset at github.com/GhostPack/Koh
14
253
5
541
I'm extremely proud to announce @wavestone_ speaking engagements at @BSidesLV @defcon & more, and it doesn't fit in a tweet (far from it, actually), so a 🧵:
3
11
2
30
You enjoyed the awesome EDRSandblast tool of @th3m4ks and @_Qazeer and want to know more about the vulnerability used in the MSI AfterBurner driver to play in the kernel mode ? Go check the vulnerability analysis done by hfiref0x swapcontext.blogspot.com/202…
2
1
7
Qazeer retweeted
mpgn@mpgn_x6431 Jan 2022
🇫🇷🎙️ Nouvel épisode du podcast @hacknspeak avec @th3m4ks & @_Qazeer pour parler de leur outil EDRSandBlast 🚀 Une interview un peu plus technique que d'habitude où l'on parle du fonctionnement d'un EDR et des mécanismes de contournement 🔥 Bonne écoute 🎶anchor.fm/hacknspeak

Hack'n Speak • A podcast on Spotify for Creators

Bienvenue sur le podcast francophone Hack'n Speak ! Notre but est de partager la voix de nos 'hacker' à travers leurs outils / recherches.

creators.spotify.com
23
45
Load more