#infosec #cybersecurity #SIEM #malware #incidentresponse #threathunting #phishing #YARArules I find #APTs, #malware, and #credharvesters 🐕 in a world of 🐟
Joined October 2016
- Tweets3.4K
- Following1.2K
- Followers9.8K
- Likes10.2K
Security Doggo retweeted
Stories from the SOC: #Fortinet authentication bypass observed in the wild.
Read: cybersecurity.att.com/blogs/…
via @attcyber
Security Doggo retweeted
My first blog with @MicrosoftDART!
This is a post incident report, talking about some of the TTPs we saw in a recent ransomware incident. This really emphasizes the importance of doing a post ransomware IR.
microsoft.com/security/blog/…
Security Doggo retweeted
1/ The screenshot below is from one of my #Azure Security / IR presentations.
Most people laugh at this slide because it seems almost too easy to detect a compromised account this way, right?
Guess what happens next. 👇
#CyberSecurity
Security Doggo retweeted
NEW: Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits
An unpatched Microsoft Exchange Server let both #ransomware actors in; Karma just stole data, while Conti encrypted...
1/15
Security Doggo retweeted
Tomorrow (Weds): @jhencinski, @The_Real_BenB, & @united's @SeanAMason discuss the 4 most important #infosec attack trends ...
📨 BEC targeting emails & application data
💸 #Ransomware
🚚 Supply chain targeting
🪙 #Cryptojacking
... in this webcast: brighttalk.com/webcast/18949… #MDR
Security Doggo retweeted
Process Hollowing Alert is now in #SIGMA.
Sysmon Event ID 25 with a type of “image is replaced”
github.com/SigmaHQ/sigma/blo…
Security Doggo retweeted
We did a deep dive on the #WhisperGate #BleedingBear malware samples. New details on process hollowing technique used by the stage3 injector and method to terminate Windows Defender elastic.github.io/security-r…
Security Doggo retweeted
Our friends from @_CPResearch_ published on Zloader abusing CVE-2020-1599 in recent campaigns. Here you can learn how to leverage VirusTotal Intelligence to monitor malware abusing this vulnerability (by @fcojsantos) blog.virustotal.com/2022/01/…
Security Doggo retweeted
@GreyNoise is currently seeing 2 unique IP's scanning the internet for the new Apache Log4j RCE vulnerability (No CVE assigned yet).
A tag to track this activity on greynoise.io will be made available shortly and linked as a reply when released.
Security Doggo retweeted
🔥🆕Introducing "Corporate Loader "Emotet": History of "X" Project Return for Ransomware" | "X.Dll" Project Under New Management
Why Return? ... for Ransomware Support
1⃣Emotet Ransomware Partnership from TrickBot➡️"BK"
2⃣Ransomware Market Monopolization
advintel.io/post/corporate-l…
Security Doggo retweeted
Cybercrime attacks on critical infrastructure steal headlines, but the top 5 industries targeted in the past year are consumer retail, financial services, manufacturing, government, and health care. More insights from the Microsoft Digital Defense Report: msft.it/6015XohIN
Security Doggo retweeted
New blog post: Comprehensive research into BulletProofLink, a large-scale phishing-as-a-service operation that enables many of the phishing campaigns that impact enterprises today msft.it/6019XkX0t
Security Doggo retweeted
BazarLoader to Conti Ransomware in 32 Hours
➡️Initial Access: BazarLoader
➡️Discovery: Nltest, Net, AD PS module, Get-DataInfo.ps1, Ping
➡️C2: #CobaltStrike & #BazarLoader
➡️Exfiltration: WinSCP
➡️Impact: Conti ransomware
thedfirreport.com/2021/09/13…
Security Doggo retweeted
Accelerate your #Yara game with tooling courtesy of @x04steve, and don't forget to check out this awesome research around identifying and tracking unique embedded OOXML content: fireeye.com/blog/threat-rese…
"Generate YARA rules for OOXML documents using ZIP local header metadata"
But digging through hex dumps, figuring out offsets, and hand-crafting YARA rules is tedious, so we've got a tool for you. Introducing apooxml, a python script to automatically generate YARA rules for embedded content in OOXML documents. github.com/mandiant/apooxml
Security Doggo retweeted
Between 2019 and 2020, Mandiant identified several incidents where Microsoft SharePoint vuln CVE-2019-0604 was used to deliver webshells, and then FOCUSFJORD to select gov and academic targets, but primarily Israeli entities.
fireeye.com/blog/threat-rese…
Security Doggo retweeted
[1/3] Check our latest research by @AbbyMCH -
Government agencies in Georgia 🇬🇪 are targeted by an ongoing phishing attack
intezer.com/blog/malware-ana…
For example - RTF with Merkava IDF tank, and actually drops a payload during execution.
Malicious attachment varies between
->>
Security Doggo retweeted
#APT group linked to the #winnti umbrella uses watering hole websites to deliver a backdoor written in Python named BIOPASS. It uses open source software to stream the screen content of its victims to the cloud. Targets are Chinese gambling companies trendmicro.com/en_us/researc…
Security Doggo retweeted
[1/2] We've detected a new phishing campaign targeting global companies in the energy, oil & gas industries.
intezer.com/blog/research/gl…
The campaign uses spoofed or typosquatted emails as part of a normal (B2B) correspondence.
Attached file is primarily an IMG, ISO or CAB.
->>
