303: @ https://xitter.cf/t.co/I4aYuNOKKY Life long snowboarder and opportunist threat hunter | my views are my own
Joined July 2023
- Tweets70
- Following343
- Followers140
- Likes150
security_dumpster retweeted
Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications.
security_dumpster retweeted
Sophos MDR has observed 2 distinct social engineering campaigns using a technique referred to as ClickFix spiking during March. Both of these campaigns—one surging on 2 March & the other 12 March—attempted to deploy SecTopRAT malware. We are tracking this activity as STAC6380./1
security_dumpster retweeted
In November, Sophos MDR noted a rapid decline in detections for the Rockstar2FA phishing as a service platform. Its rise was documented in a report by Trustwave on November 26. /1
trustwave.com/en-us/resource…
Just put out this research on MiTM PaaS kits Rockstar/ FlowerStorm. While my name is on this, the primary researchers Josh Rawles (@ig3thack3d4u ) and Jordon Olness deserve the lions share of credit. They’re both brilliant to work with and hats off to them news.sophos.com/en-us/2024/1…
My (and my copresenter Colin Cowie) @MSFTBlueHat talk “Patterns in the Shadows: Scaling Threat Hunting and Intelligence for the Modern Adversary” is on YouTube, hope you enjoy! youtu.be/n7GVxDxwOUc?feature…
security_dumpster retweeted
My @MSFTBlueHat talk "Deprecating Azure AD Graph API is Easy and Other Lies We Tell Ourselves" is now on Youtube!
Link to recording & slide deck at aadinternals.com/talks/
security_dumpster retweeted
🔥 New from @philofishal , @syrion89 and @TomHegel:
🇰🇵 BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence
sentinelone.com/labs/bluenor…
security_dumpster retweeted
"China’s ‘mind-boggling’ space capabilities worry US, says Space Force chief
Beijing’s tech is more concerning than reports of Russian space nukes, said General B. Chance Saltzman."
1/
politico.eu/article/china-mi…
security_dumpster retweeted
Hey :)
We published a blog talking about ORB networks and a summarise of the purpose, use cases and more:
team-cymru.com/post/an-intro…
This blog is also a teaser for more blogs to come 👀
@teamcymru_S2
security_dumpster retweeted
This has been one of my favorites for a while, but now it's time to let it go.
Here's my preferred way of getting the KeePass db that we often hunt for:
downgrade the executable to version 2.53, use CVE-2023-24055 and wait for the busy admin to trigger the dump of the database.
The target can remain clean and you can simply check for the dump creation.
KeePass version 2.53 can still open kdbx created with the version 2.57 and if using a proper xml the user will likely notice nothing.
Update alerts can also be disabled within the xml.
gist.github.com/naksyn/6d566…
security_dumpster retweeted
Sophos detailed to me its 5-year cat-and-mouse game with Chinese hackers repeatedly exploiting its firewalls. The company resorted to installing spy "implants" on devices the hackers were testing on—tracing them to a university and contractor in Chengdu. wired.com/story/sophos-cheng…
security_dumpster retweeted
Recent trick related to .RDP files used by the SVR 🇷🇺 is worth threat hunting for.
Basically they’re doing what this @BHinfoSecurity blog demoed in 2022: blackhillsinfosec.com/rogue-…
Reports:
1. cert.gov.ua/article/6281076
2. aws.amazon.com/blogs/securit…
3. microsoft.com/en-us/security…
security_dumpster retweeted
OK, I promise to stop spamming about relays with NTLM/Kerberos 😅. But if you're a member of the Distributed COM or Performance Log group, these juicy CLSIDs let you trigger remotely machine authentication of any computer, including DCs, and relay DCOM -> HTTP, SMB… 👇
Great approach’s lined out👇, highly recommend the read
📢Topic: Threat Hunting Metrics
I've said this before, and I'll say it again because it pains me to see teams with talented individuals compelled to use this poor metric as a KPI.
🚨The Hunt count number per Hunter is a BAD metric!!🚨
As I previously wrote about it in a blog where I covered TH metrics:
"It promotes quantity over quality, with hunters potentially rushing through processes just to boost their numbers."
📢This is a dangerous metric, and if you are a manager, you should avoid the lazy approach of having metrics just to tick a box. Metrics should drive quality, not push hunters to rush for the sake of numbers📢
/end rant
Link to my blog regarding threat hunting metrics: kostas-ts.medium.com/threat-…
security_dumpster retweeted
🚨 ITW Zero-Day Vulnerability Discovery: #APT37 (#Scarcruft) 🚨
For Responsible Disclosure, we disclose relevant details at this time: Unmasking CVE-2024-38178 The Silent Threat of Windows Scripting Engine
🔗 medium.com/s2wblog/unmasking…
🔍 Key findings:
- The attack used a freeware advertising module to exploit the vulnerability, marking a shift from previous methods.
- The shellcode execution bore striking similarities to tactics from three years ago, underscoring the importance of studying an attacker’s Tactics, Techniques, and Procedures (#TTPs).
A few months ago, this issue was shared exclusively with companies in the Joint Analysis Council led by the NCSC, and yesterday, the security advisory was released to the public.
Stay informed and vigilant!
#APT37 #ThreatHunting #ITW #ZeroDay #TTPs #ThreatIntel #ResponsibleDisclosure
security_dumpster retweeted
My DEF CON 32 talk "Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panels" is up on YouTube!
youtube.com/watch?v=T5K4ABfz…
security_dumpster retweeted
📣SPEAKER ANNOUNCEMENT📣
We're excited to announce our next #BlueHat speakers: Mark Parsons (@securitydumpstr) and Colin Cowie from Sophos. They will be presenting a talk titled “Patterns in the Shadows: Scaling Threat Hunting and Intelligence for Modern Adversaries.”
Mark is a Threat Hunter for the Sophos Managed Detection and Response Team. He focuses on identifying and tracking nation-state related threats and has presented his findings at Black Hat USA and PivotCon 2024. Outside of work, he is a loving dog dad and avid backcountry snowboarder.
Colin is a Threat Intelligence Analyst for the Sophos Managed Detection and Response team. He focuses on detecting emerging threats, threat actor identification, and incident response. In past roles, he has worked in the financial sector performing penetration testing as well as in mobile forensics for law enforcement.
security_dumpster retweeted
The calendar for the Fall/Winter Virtual Research Workshop Series is out:
eccri.eu/eccri-virtual-resea…