#infosec #cybersecurity #SIEM #malware #incidentresponse #threathunting #phishing #YARArules I find #APTs, #malware, and #credharvesters 🐕 in a world of 🐟
Joined October 2016
- Tweets3.4K
- Following1.2K
- Followers9.8K
- Likes10.2K
Pinned Tweet
UDS 2019 Current Agenda.doc virustotal.com/#/file/04bd6c… Run here: app.any.run/tasks/1c6c76f8-a… 443 to photopoststories[.]com #malware #infosec #phishing @James_inthe_box @VK_Intel @MalwareParty @_jsoo_ @ItsReallyNick @Ledtech3
Security Doggo retweeted
Stories from the SOC: #Fortinet authentication bypass observed in the wild.
Read: cybersecurity.att.com/blogs/…
via @attcyber
While I never got the opportunity to meet him in person, I have so many fond memories of chatting with him in DMs and seeing his analysis on the random stuff I tag him in. Sad to lose a hero and such an amazing person in the field.
The SentinelOne team is deeply saddened by the sudden loss of our former teammate, & friend of so many, @VK_Intel. Vitali was a founding member of SentinelLabs & made numerous contributions to the security community. Our thoughts are with his family.
ALT Vitali Kremez
Security Doggo retweeted
My first blog with @MicrosoftDART!
This is a post incident report, talking about some of the TTPs we saw in a recent ransomware incident. This really emphasizes the importance of doing a post ransomware IR.
microsoft.com/security/blog/…
Any one got logs to share regarding CVE-2022-40684? Seeing some activity for the string in the advisory user="Local_Process_Access" - you all seeing these as system config file downloads via report runner? @Fortinet @FortiGuardLabs #CVE202240684 #exploit #cybersecurity #infosec
Incredible amount of pages on @issuu with a clickable box/link (usually for click here to access document) to 0365 #credharvesters #infosec urlscan.io/search/#page.doma…
1
Something weird happened on my @Malwarebytes - might have borked during an update but the exe became mbam.not and Defender borked out at the same time. Pretty scary when you're doing firewall changes on the home network 🥲
1
1
Security Doggo retweeted
1/ The screenshot below is from one of my #Azure Security / IR presentations.
Most people laugh at this slide because it seems almost too easy to detect a compromised account this way, right?
Guess what happens next. 👇
#CyberSecurity
Security Doggo retweeted
NEW: Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits
An unpatched Microsoft Exchange Server let both #ransomware actors in; Karma just stole data, while Conti encrypted...
1/15
Security Doggo retweeted
Tomorrow (Weds): @jhencinski, @The_Real_BenB, & @united's @SeanAMason discuss the 4 most important #infosec attack trends ...
📨 BEC targeting emails & application data
💸 #Ransomware
🚚 Supply chain targeting
🪙 #Cryptojacking
... in this webcast: brighttalk.com/webcast/18949… #MDR
Great job @virustotal for taking down that massive list of email addresses that was uploaded last night #infosec
2
Security Doggo retweeted
Process Hollowing Alert is now in #SIGMA.
Sysmon Event ID 25 with a type of “image is replaced”
github.com/SigmaHQ/sigma/blo…
Another day, another vulnerable external facing application, another #ransomware gang. #cyber #infosec #malware
Seeing what looks to be NIDS picking up backup traffic from servers to backup servers firing off strings for log4shell; also in the packet are a bunch of Microsoft threat names and detection logic - thinking it's like the signature files for Defender. Thoughts?
1
1
Security Doggo retweeted
We did a deep dive on the #WhisperGate #BleedingBear malware samples. New details on process hollowing technique used by the stage3 injector and method to terminate Windows Defender elastic.github.io/security-r…
Security Doggo retweeted
Our friends from @_CPResearch_ published on Zloader abusing CVE-2020-1599 in recent campaigns. Here you can learn how to leverage VirusTotal Intelligence to monitor malware abusing this vulnerability (by @fcojsantos) blog.virustotal.com/2022/01/…
