Pinned Tweet
This was a great blog to help to craft, showing the power behind our IR team and Threat Intelligence capabilities at Talos. Great work Team!
Cisco Talos Incident Response (Talos IR) recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Read the blog here: cs.co/6019SsMIh
PC retweeted
Investigating a SharePoint Compromise: IR Tales from the Field #DFIR
rapid7.com/blog/post/2024/10…
PC retweeted
Fun to work with @Google on their latest Security white paper!
My fave quote: “Folks throw money at a super expensive platform, but then don’t have a password manager for the team! It’s like spending money on ballistic windows but your door is wide open.”
services.google.com/fh/files…
PC retweeted
I remain as adamant as before that "humanless, full-auto #SOC" is not coming any time soon, BUT I sense that we are close to replicating the quality of shitty, low-cost MSSP/MDR with machines alone, no humans needed... So, shitty, low-cost MDRs beware, you business may be toast.
PC retweeted
🔍💻 PowerShell Pro Tip! 💻🔍
Ever wondered what app opens specific file extensions on your Windows machine? 🤔 Sure, it’s not new, but it’s super handy! 💪
Use this PowerShell magic to find file extensions and their associated apps (like finding out `.rdp` opens with `mstsc.exe`)! 🚀
```
$associations = @()
$registryPaths = @(
"HKLM:\Software\Classes",
"HKCU:\Software\Classes"
)
foreach ($path in $registryPaths) {
Get-ChildItem $path | ForEach-Object {
if ($_.PSChildName -like ".*") {
$extension = $_.PSChildName
$progId = (Get-ItemProperty -Path "$($_.PSPath)" -ErrorAction SilentlyContinue).'(Default)'
if ($progId) {
$commandPath = (Get-ItemProperty -Path "$path\$progId\shell\open\command" -ErrorAction SilentlyContinue).'(Default)'
$associations += [PSCustomObject]@{
Extension = $extension
ProgID = $progId
AssociatedApp = $commandPath
}
}
}
}
}
$associations | Out-GridView -Title "File Extensions and Associated Applications"
```
gist.github.com/MHaggis/a5b0…
Hit enter & watch as the magic unfolds! 🎩✨ Explore the full list in a GUI to see extensions + their apps!
Because sometimes… knowing is half the battle 🛡️💡
🖥️🐱💻
PC retweeted
Investigation Scenario 🔎
You’ve discovered a Windows 10 host placed in the wrong AD OU. As a result, WSUS did not pick it up for automatic updates for at least two years.
What do you look for to investigate whether it has been compromised?
#InvestigationPath #DFIR #SOC
PC retweeted
Entra ID monitoring - are you doing the basics?
Part 1 securediam.com/f/entra-id-mo…
Part 2 securediam.com/f/entra-id-mo…
Part 3 securediam.com/f/entra-id-mo…
PC retweeted
Invoke-SMBRemoting. utilizes the SMB protocol to establish a connection with the target machine, and sends commands (and receives outputs) using Named Pipes. by @L3o4j
github.com/Leo4j/Invoke-SMBR…
The problem I have with AI is that the implementations are attempting to replace critical thinking with a poor replacement. It's not going to work, it causes people to stop learning or trying to be able to critically think, write, etc. and without their crutch they are useless.
PC retweeted
New Sigma release r2024-11-10 is available for download
🌟 17 New Rules
🛡️ 35 Rule updates
🔬 4 Rule Fixes
This release includes rules covering
- Suspicious .RDP file creation by Outlook and other uncommon processes.
- IIS config tampering.
- PowerShell Web Access abuse.
- Antivirus cheat sheet updates
And more 🔥
Check the full change log and start exploring this, by downloading the latest release -> github.com/SigmaHQ/sigma/rel…
Also keep an eye for the next release soon, as I go through the rest of the PRs.
Thanks to the many contributors that helped shape this release, specifically
ahmedfarou22, bharat-arora-magnet, BlackB0lt, CheraghiMilad, dan21san, @defensivedepth, @deFr0ggy, djlukic, @frack113, fukusuket, ionsor, jaegeral, @imlordofthering, Koifman, Mahir-Ali-khan, @MalGamy12, @M_haggis , Milad Cheraghi, @cyb3rops , ruppde, @AltgeltMax , swachchhanda000, @Kostastsale , wieso-itzi, @X__Junior
PC retweeted
Nice #PowerShell script
Create-LDAPLogsGPO.ps1
github.com/itpro-tips/Active…
PC retweeted
SharpADWS is an Active Directory Recon and
Exploit tool for Red Teams via the ADWS protocol, Inspired by @FalconForceTeam
Without the LDAP protocol, it can easily bypass most traffic monitoring for LDAP
#BloodHound #redteam #Pentesting #CyberSecurity
github.com/wh0amitz/SharpADW…
PC retweeted
"Anton’s Alert Fatigue: The Study" bit.ly/3UJWBI1 is a result of some agonizing pondering of the "alert fatigue problem" over the years. Hopefully it is a fun read, because it was not a very fun write -)
PC retweeted
Splunk AD Threat hunting, by @Cyberagent101
amr-git-dot.github.io/forens…
PC retweeted
Using Offensive .NET to Enumerate and Exploit Active Directory Environments, by @_logangoins
logan-goins.com/2024-10-11-D…
PC retweeted
Windows Triaging with Powershell #DFIR
Part 1: Parsing Event Logs aditya-pratap9557.medium.com…
Part 2: Artifacts Collection aditya-pratap9557.medium.com…
PC retweeted
Microsoft-eventlog-mindmap
Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure, ...
github.com/mdecrevoisier/Mic…
PC retweeted
Finding Forensic Goodness In Obscure Windows Event Logs
nasbench.medium.com/finding-…


















