@munch@infosec.exchange — Engineer. Cheez-It connoisseur. Fragment abuser. Forever in search of the perfect backpack.
33.6839° N, 117.7947° W
Joined October 2016
- Tweets582
- Following247
- Followers558
- Likes164
I have no idea why @Apple and @Google don't build a setting into iOS and Android so you can set your phone to reboot daily/weekly/monthly on a schedule. I'd reboot daily 🤷
forbes.com/sites/daveywinder…
Want to hunt the most dangerous game? I'll be teaching an advanced threat hunting course at @CrowdStrike #FalCon2023 this September. Come learn with us!
Great article from @CrowdStrike Services Team on how to identify data exfiltration on exploited MoveIt servers via log file forensics: reddit.com/r/crowdstrike/com…
Andrew Munchbach retweeted
RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in! 1/n 🧵
Once active, the HTTPS beacon structure and encryption key match those observed by CrowdStrike in a March 7, 2023 campaign attributed with high confidence to DPRK-nexus threat actor LABYRINTH CHOLLIMA... reddit.com/r/crowdstrike/com…
CrowdStrike tracking active intrusion campaign (possible supply chain incident) targeting 3CX customers: reddit.com/r/crowdstrike/com…
Andrew Munchbach retweeted
We published a cybersecurity advisory w/s @FBI & @HHSGov & w/ contributions from @CrowdStrike & @HealthISAC, that provides technical details and #IOCs on #Daixin actors using ransomware to target #HPH Sector. Reduce your risk &help us #StopRansomware:cisa.gov/uscert/ncas/alerts/…
Hunting for Microsoft Teams passwords in clear using Falcon: reddit.com/r/crowdstrike/com…
Using Falcon to detect System Preference drift in macOS: reddit.com/r/crowdstrike/com…
Andrew Munchbach retweeted
In November 2021, a vulnerability was discovered in a ubiquitous Linux model.
Learn how to hunt pwnkit using two different methods in our latest blog post. bit.ly/3Gf8fjL
Captain's Log, 01h 48m: still on hold with @AmericanExpress Travel for a simple flight change.
An👏attacker👏with👏permission👏to👏modify👏the👏logging👏configuration👏file👏
CVE-2021-44832 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can... cve.mitre.org/cgi-bin/cvenam…
I got to write a blog... and the link to it works this time!
Catch up on the latest @CrowdStike blog to learn more about baselining and hunting #Log4Shell with the CrowdStrike Falcon platform. ⬇️ - via @amunchbach
bit.ly/3Eje6Ut
To those changing their browser user-agent to a weaponozed Log4j string and then just going about your daily, web-browsing business: I hate you.
Opened this article thinking I was getting a Craig Ferguson hot take on DLL search order hijacking. Was disappointed.
"Sideloading is a cyber criminal’s best friend," according to Apple’s software chief theverge.com/2021/11/3/22761…
