Director of Threat Research & Intelligence @InQuest: All views expressed are from my own brain. “Sharing is caring”
57696c6c794d6163
Joined September 2016
- Tweets173
- Following385
- Followers1.5K
- Likes2.2K
This is super exciting both personally and professionally. 🦄
📣 We are honored to welcome Chief Intelligence Officer, Darren Spruell ➡️ hubs.ly/Q01DGyHX0
As a long-time collaborator in intelligence-sharing 🧠 communities, Darren has led efforts to maintain data-sharing 🤝relationships in critical industries.
#intelligence #FDR
I'm happy to be at @Inquest where we have created a platform that helps us give back to the #infosec community.
Read about it here: finance.yahoo.com/news/inque…
old CVE RTF's being tested until FUD :P
d345e17488a479abb60218a5b1a2421d
ed75c138cc00ad580e7ec301cdd554cb
d5c338418fee73a8d1b65005af099a3f
15c4e32056ab6b449dd3a846123cf61f
3281625f4d0ee802c01dae3f8f782916
f77eceea67b95e3a2c682df1ec3fe702
@InQuest @James_inthe_box #maldoc #OSINT
One more #Zloader C2 pair real quick
labs.inquest.net/dfi/sha256/…
63f153e8368995e972d5ad3de6a9f3b1a77bd3fea93017a791ee93975a3ce13a
https[:]//palchik.]club/wp-data.php
https[:]//psychotherapyresources.]org/wp-data.php
@InQuest @abuse_ch @James_inthe_box @executemalware
#Zloader hunting with @InQuest DFI Stack
labs.inquest.net/dfi/sha256/…
C2:
https://regerfederer.]club/wp-data.php
https://sharkweek2019.]best/wp-data.php
@James_inthe_box @abuse_ch @executemalware
There is a lot of nastiness going on and multiple campaigns ... we are putting out bits and pieces through out various analysis during the day and collaborating on all threats with friends in the community. Feel free to dm and stuff ;)
**Dridex Flash Alert**
1/61 Detection on this XLSM Doc containing 4.0 Macrosheets pushing Dridex.
#dridex #malware #ThreatIntelligence
inquest.net/flash-alerts/IQ-…
Thanks for everyone supporting @ydklijnsma during his round one battle. In the midst of those in need right now I ask we continue to show strong community support for our comrade.
Last week we got bad news, the cancer is back. It is now in my lungs and deemed incurable.
It’s time to fight round 2, we are joining a clinical trial. Because of this we reopened the @gofundme to seek financial support in this fight once again: gofundme.com/f/YonathanCommu…
Thank you, everyone, for supporting Yonathan so far! The new campaign image is from his last day in the hospital from the initial surgery! There is a message from him under "Updates" for everyone #cancer #cybersecurity #malware gofundme.com/f/YonathanCommu…
On behalf of @ydklijnsma, we started a GoFundMe campaign as expenses from treatment and recovery can be significant. Help aid in a less stressful road to recovery and provide an avenue to impact a wonderful man's life. #cancer #cybersecurity #malware gofundme.com/f/YonathanCommu…
Excited to represent @InQuest at the @SANSInstitute Threat Hunting & Incident Response Summit Oct 1st in New Orleans. #infosec #cybersecurity #threathunting #ThreatHuntingSummit
If you have a moment check out part 2 of our blog series on #YARA during the long weekend!
Our new blog is out!
In our second post in the ongoing series "YARA For Everyone", @Anti_Expl0it shows everyone that rules will be rules by providing some context on proper #YARA rule curation.
inquest.net/blog/2019/08/30/…
3
This is a fantastic free resource for everyone involved in the IT security domain. It makes me proud to be part of the team at @InQuest that cares enough to share back with the community. inquest.net/blog/2019/08/14/… #threathunting #YARA #iocs #Malware #DFI #DFIR
Added @push_pnx @Fraunhofer_FKIE's auto generated #YARA rules from @Malpedia (malpedia.caad.fkie.fraunhofe…)
which contains a zip file of all automatically generated, code-based rules github.com/InQuest/awesome-y…
Ran into a lot of folks from various backgrounds asking questions about #YARA . One of the most common questions was “How do I get started quickly?”. Taking that approach and testing the steps on my parents was step one in this article. (Thanks Pops 😃)
Our new blog is out!
In our first post in the ongoing series "YARA For Everyone", @Anti_Expl0it shows everyone that Sharing is Caring by providing an alternative method for getting started with #YARA
InQuest Blog: inquest.net/YARA-For-Everyon…
6
Heading to NY to present at @SummerC0n Saturday!!! I appreciate the opportunity and look forward to seeing some folks face to face🤘
1
3
This was a great time! Thanks for letting me present! Great atmosphere, conversations, and presentations. 🤓
Thanks to everyone involved in making the 1st Austin Hacker Hoedown come to fruition. Especially our speakers: @b1ack0wl @Anti_Expl0it @hdmoore @dissectmalware @MuscianoAdam @sooshie @seryylis and our sponsors: @Apple @Atredis @ExodusIntel @InQuest @LaceworkInc @praetorianlabs
3
We are always open for collaboration, feel free to reach out if we can be of assistance. 🤓 dm/email
InQuest Insider - May
InQuest constantly monitors command and control (C2) communications for signs of anomalous activity. Keeping abreast of the latest C2 nodes through threat intelligence is key for detecting this activity.
Subscribe Here: inquest.net/newsletter
2
Hope to see some of you folks out in Austin next week :)
The Austin Hacker Hoedown on 6/5 is filling up quickly. Special thanks to @Apple for stepping in as an additional sponsor. Early registered speakers include @Anti_Expl0it, @b1ack0wl, @dissectmalware, @hdmoore, @MuscianoAdam, and @sooshie. Register at: eventbrite.com/e/austin-hack…
1
Verifying myself: I am willymac on Keybase.io. FjF2GcVvA7e4FPtFArntVbkMJ3PX_Cg3-4H7 / keybase.io/willymac/sigs/FjF…