Threat Hunting

219 posts

Threat Hunting

Threat Hunting

@Mahdi_htm

Open to negotiate for threat hunting and threat analysis remote services

انضم Mayıs 2018
414 يتبع1.3K المتابعون
تغريدة مثبتة
Threat Hunting
Threat Hunting@Mahdi_htm·
🎯 New report: Battle of the Shadows: APT Wars in C2 Takeovers & Payload Verification Uncover how elite APTs: 🔹 Defend their C2 infrastructure 🔹 Verify payloads to avoid takeovers 🔹 Engage in tactical "shadow wars" link.medium.com/ZV6ibDXjdPb #threatintelligence
English
0
14
89
6.2K
Threat Hunting
Threat Hunting@Mahdi_htm·
How do you know this is Chinese? Just because of aliexpress?
English
0
0
2
291
Threat Hunting
Threat Hunting@Mahdi_htm·
It seems like the Fortinet team is under heavy pressure as they’ve released a list of attacker IPs. However, I advise against blindly blocking these IPs. They might belong to CDNs or could have already been reassigned to legitimate services. Always verify before taking action.
Threat Hunting tweet media
English
1
3
11
1.4K
Threat Hunting
Threat Hunting@Mahdi_htm·
🚨 After seeing the Snake driver sniff inbound traffic from a mail server using an incredible technique, now we encounter something new: a Linux kernel module that hijacks inbound network traffic to compromised systems. Innovation in attack vectors is relentless.
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
0
0
6
1.2K
Threat Hunting
Threat Hunting@Mahdi_htm·
Does anyone know which threat actor is attributed to stealing IIS machine keys for persistence (executing commands on a web server remotely through IIS insecure serialization)? #threatintel
English
0
0
3
210
Threat Hunting
Threat Hunting@Mahdi_htm·
APT29 and APT28 separately targeted diplomatic entities within a year using decoy and phishing tactics, including a car sale lure. Each group employed distinct methods, such as hosting payloads on public services like webhook. #threatintelligence Thanks Unit42
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
0
0
5
448
Rosyna Keller
Rosyna Keller@rosyna·
@Mahdi_htm I had sworn Compiled HTML Help files were deprecated due to security issues before. Am I misremembering?!
English
1
0
0
154
Threat Hunting
Threat Hunting@Mahdi_htm·
CHM files are being used for Initial Access (Phish-to-Persist), particularly by DPRK-attributed threat actors and more recently in cybercrime operations. #threatintelligence #threathunting
Threat Hunting tweet media
English
2
7
37
5.1K
Threat Hunting
Threat Hunting@Mahdi_htm·
F5 The Perfect Place to Hide China Threat Group Abuses F5 Load for Persistence. The investigation confirmed that the threat actor maintained a presence in the organizations on-premise network for about three years. The overall goal to the target network for espionage. SygniaTeam
Threat Hunting tweet media
English
0
9
26
4.1K
Threat Hunting
Threat Hunting@Mahdi_htm·
Enterprise Threat Hunting to catch and follow Lazarus recent campaign with passive DNS. Validin provides extensive passive DNS records, which map domains to their associated IP addresses over time. This allows analysts to see where a domain has been hosted and track any changes.
Threat Hunting tweet mediaThreat Hunting tweet media
English
0
5
20
2.2K
Threat Hunting
Threat Hunting@Mahdi_htm·
1) Great talk in Positive hack days about OPSEC mistakes, challenges and techniques for my dear partnerships from positive technologies. I have talked about various Threat Intelligence tips and tricks and OPSEC mistakes like NOBUS WebShell, Operations Security (OPSEC),
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
0
1
25
5.1K
Threat Hunting أُعيد تغريده
Florian Roth ⚡️
Florian Roth ⚡️@cyb3rops·
You can either hunt for it or check and apply our Sigma rules If you're unsure whether a detection idea is already covered by an existing rule, you can use the sigmasearchengine.com, which was developed by my team member @ph_t__ We've also integrated the API of that service into the Sigma VSCode extension
Florian Roth ⚡️ tweet mediaFlorian Roth ⚡️ tweet media
Threat Hunting@Mahdi_htm

Initial Access with Compiled HTML File (CHM) have been used by different TAs including APT37 and APT41. For hunting/detecting them you should check hh.exe spawning mshta.exe or any other related LOBINs in Event ID 1 of Sysmon or 4688 See the execution flow in the following pics

English
1
48
184
32.8K
Threat Hunting
Threat Hunting@Mahdi_htm·
Initial Access with Compiled HTML File (CHM) have been used by different TAs including APT37 and APT41. For hunting/detecting them you should check hh.exe spawning mshta.exe or any other related LOBINs in Event ID 1 of Sysmon or 4688 See the execution flow in the following pics
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
2
8
45
34.9K
Threat Hunting
Threat Hunting@Mahdi_htm·
APT28 has been targeting Iranian Embassy in Albania with the Browser In The Browser (BITB) phishing technique. Kudos to @_CERT_UA for first discovering this.
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
0
8
57
20K
Threat Hunting
Threat Hunting@Mahdi_htm·
3/3 Do you want to see what attackers did with powershell in your environment? Enable script block logging (EID = 4104 in Microsoft-Windows-PowerShell/Operational) and look for keywords like add-type, net.webclient and CreateThread/CreateRemoteThread and also Sysmon (EID = 3)
English
0
1
7
738
Threat Hunting
Threat Hunting@Mahdi_htm·
2/3 Do not forget about PS script block logging and look for suspicious connections to cloud providers like OneDrive. To enable PS script block logging: HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging $Name = "EnableScriptBlockLogging" Value:1
English
1
0
5
844
Threat Hunting
Threat Hunting@Mahdi_htm·
1/3 #APT37 recent sample with OneDrive C2 communications and PowerShell script block with internal create thread #threathunting
Threat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet mediaThreat Hunting tweet media
English
1
16
59
7.5K

اكتشف

@cyb3rops @rosyna @ph_t__ @_CERT_UA @elonmusk @BarackObama @taylorswift13 @cristiano