ImPureMotion (@ImPureMotion) header
ImPureMotion (@ImPureMotion) profile picture

ImPureMotion

@ImPureMotion

The Cyberz

Joined February 2015
  • Tweets110
  • Following621
  • Followers195
Replying to @Kostastsale
Awesome stuff - good recent use case from (thedfirreport.com/2023/08/28…) where xcopy was used to rename rundll32 to entails.exe tweaking the regex a bit if you have cmdline parsed out: (xcopy|copy|copy-item|cp)\s+c:\\windows\\(system32|syswow64)\\[a-zA-Z0-9_\-]{1,}\.exe\s\w:\\.*\\?
Image from ImPureMotion (@ImPureMotion)
1
1
3
218
Replying to @securitydoggo
Would be me exiting after no VT
1
1
Replying to @ItsReallyNick @securitydoggo @James_inthe_box @lotus_ruan @PureReactions @_jsoo_ @bartblaze @blu3_team
Another one: 講座登入檢視意見回饋操作說明.doc Lecture Login View Feedback Feedback Instructions .doc
Image from ImPureMotion (@ImPureMotion)
Image from ImPureMotion (@ImPureMotion)
1
3
Replying to @securitydoggo
@securitydoggo
Image from ImPureMotion (@ImPureMotion)
2
Syria - New Russia provocations.doc (e4ef63f74d55930157bc425bf3bd856f) Large POST with url encoded system info
Image from ImPureMotion (@ImPureMotion)
1
8
22
Replying to @securitydoggo @James_inthe_box
@securitydoggo @James_inthe_box
1
Replying to @ImPureMotion @securitydoggo
Realized i posted the wrong photo :/
Image from ImPureMotion (@ImPureMotion)
1
Replying to @bartblaze @securitydoggo @James_inthe_box @VK_Intel @ItsReallyNick
@bartblaze @securitydoggo @James_inthe_box @VK_Intel @ItsReallyNick
2
Replying to @securitydoggo
Submitted from LV
Image from ImPureMotion (@ImPureMotion)
2
2
Replying to @securitydoggo @xdxdxdxdoa
Not sure yet, could be a good start
Image from ImPureMotion (@ImPureMotion)
1
1
Load more