@blu3_team (@blu3_team) header
@blu3_team (@blu3_team) profile picture

@blu3_team

@blu3_team

Defender, enthusiast, finder of bad things. Opinions are my own and not those of my employer.

 Washington, DC
Joined June 2017
  • Tweets213
  • Following274
  • Followers1.5K
96Media
Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)Photo by @blu3_team (@blu3_team)
Another method of C2 detection using Splunk with rare domain and PC counts. blu3-team.blogspot.com/2019/…
Image from @blu3_team (@blu3_team)
2
10
IOCs are backward looking indicators. They have their place but don't bet the farm on them. Behavioral TTPs age out much more slowly.
224
#Threathunting Startup and Run key events by leveraging userinit.exe and explorer.exe start times. blu3-team.blogspot.com/2020/…
Image from @blu3_team (@blu3_team)
1
gatherNetworkInfo.vbs as a #LolBin too blu3-team.blogspot.com/2020/… @Hexacorn #Threathunting
2
2
Detect long running processes with neconn using Splunk blu3-team.blogspot.com/2020/… #threathunting #carbonblack #splunk #blueteam
1
2
12
Are you sending EDR events to your SEIM?
20%Process
0%Netconn
40%Both
40%What's an EDR?
15 votes • Final results
2
3
A splunk detection method of the mixed case PoWERsheLL by itself Probably this is out there already somewhere but I got tired of looking for it. blu3-team.blogspot.com/2020/… #threathunting @cyb3rops @anyrun_app
Florian Roth ⚡️ (@cyb3rops) profile pictureFlorian Roth ⚡️
@cyb3rops6 Feb 2020
New version of Emotet surfaced, check Sigma rules, relax and enjoy xitter.gq/anyrun_app/status/1225… Rule github.com/Neo23x0/sigma/blo…
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
1
2
Powershell -encodedcommand decoding with Splunk Decrypt App AKA: How to get rid of the pesky periods in the base64_decode blu3-team.blogspot.com/2019/… #Threathunting
2
5
1
36
Nice, turns out Scr files generally have a manageable list of parents. blu3-team.blogspot.com/2019/… #threathunting
Timele12138 (@Timele9527) profile pictureTimele12138@Timele952723 Oct 2019
#APT #TransparentTribe md5:39ae6f1fd36c08e8199a9725906a9f0a filename: Social_Calendar.xls C2:hxxp://isroddp.com/rEmt1t_pE7o_pe0Ry/hipto.php pdb:C:\Users\Carlos\source\repos\drivertoolkit\Release\drivertoolkit.pdb
Image from Timele12138 (@Timele9527)
Image from Timele12138 (@Timele9527)
4
Detecting #Adwind using clustered child processes of java.exe Kudos to @anyrun_app for making #threathunting easier! blu3-team.blogspot.com/2019/… app.any.run/tasks/455f13a6-c…
2
7
Using Splunk to detect wmiprvse.exe as parent in close proximity to Winword.exe startup #ursnif #threathunting blu3-team.blogspot.com/2019/… app.any.run/tasks/e2cc76c0-0…
1
21
1
39
Using pfSense to selectively allow traffic during dynamic malware analysis. Had fun setting this up so I thought I would share the process. blu3-team.blogspot.com/2019/…
1
5
13
#Trickbot installation Command line looking for "findstr" and "lnk" might be a good early indicator. app.any.run/tasks/42653bc4-9…
Image from @blu3_team (@blu3_team)
3
Some methods for profiling scheduled tasks. #threathunting blu3-team.blogspot.com/2019/…
5
@blu3_team retweeted
Expel (@ExpelSecurity) profile picture
Expel@ExpelSecurity9 Jul 2019
PB&J. Wine and cheese. Some pairs just go together but others don't. Which is why today on the blog we're talking all about how to find anomalous pairs during threat hunting. Take 6 min to read our tips on how to find these in your environment: bit.ly/2LdnTnU
Image from Expel (@ExpelSecurity)
1
1
5
A couple of sigs for some file extension shenanigans. Nothing new, but you might want to check to see if you have them. blu3-team.blogspot.com/2019/… #threathunting @cyb3rops
Image from @blu3_team (@blu3_team)
1
6
10
Seeing some adware trying to overwrite the zone.identifier. Command lines containing cmd echo zone.identifier should find it. #threathunting
Image from @blu3_team (@blu3_team)
1
8.t #Malware 78965.doc 10348b56b0e3466f9f9fa62bda081c98 QCRat C2: login\.vietnamairlines1\.com
Image from @blu3_team (@blu3_team)
Image from @blu3_team (@blu3_team)
9
20
Google's search leaves users in the dark: DuckDuckGo CEO finance.yahoo.com/news/googl… via @YahooFinance
#Malware Danh sách BQP dự họp TTg.doc List of participants of the meeting a48431970d150d977562c892c6c124cb OSE.EXE 86a0557fc47d79ad1cc056f229dab944 unio.exe legit LBTServ.dll 5767a17038ca8003ee3e806c5c64b2da k1.ini C2: goog1eupdate\.com
Image from @blu3_team (@blu3_team)
Image from @blu3_team (@blu3_team)
1
6
18
Load more