Chaplin

69 posts

Chaplin

Chaplin

@ChaplinSec

Deutschland Katılım Mayıs 2021
136 Takip Edilen20 Takipçiler
Chaplin retweetledi
BSidesFrankfurt
BSidesFrankfurt@BSidesFRA·
Cracking Compromised Edge Devices Join Evgen Blohm and Marius Genheimer from SECUINFRA Falcon Team for a deep dive into forensic investigations of compromised edge devices from Cisco, Fortinet, Citrix, and Ivanti. Discover the exploits used, the motives of nation-state and cybercriminal attackers, and creative techniques for analyzing these complex appliances. Gain practical tips to investigate and secure your network equipment in this eye-opening session! bsidesfrankfurt.org
BSidesFrankfurt tweet media
English
0
3
3
630
Chaplin retweetledi
BSidesFrankfurt
BSidesFrankfurt@BSidesFRA·
BREAKING! Save the date! Workshops at BSidesFrankfurt on Thu, August 28, 2025. First come, first serve. Details soon - block your calendar Thu+Fri!
BSidesFrankfurt tweet media
English
0
4
9
621
Chaplin retweetledi
BSidesFrankfurt
BSidesFrankfurt@BSidesFRA·
Exciting News! The date and location for the next BSidesFrankfurt are officially set! Mark your calendars: Friday, August 29, 2025, at Campus Westend, Goethe University. Stay tuned for ticket sales and further updates. In the meantime, revisit past recordings and help spread the word! We’re also looking for sponsors - a great opportunity to support the cybersecurity community and gain valuable exposure. If you're interested, reach out to us! Recordings (updated monthly): @BSidesFrankfurt" target="_blank" rel="nofollow noopener">youtube.com/@BSidesFrankfu…
English
0
10
20
996
Chaplin retweetledi
SECUINFRA FALCON TEAM
SECUINFRA FALCON TEAM@SI_FalconTeam·
🚨Malware distributed via Steam Fancy a bit of after work gaming? Beware of infostealer malware distributed via the Steam store! Using @steamdb we managed to visually identify a very suspicious file in the game files. Luckily, we managed to retrieve a sample for analysis, which will follow in this thread.
SECUINFRA FALCON TEAM tweet media
SteamDB@SteamDB

A game called PirateFi released on Steam last week and it contained malware. Valve have removed the game two days ago. Users that played the game have received the following email:

English
1
24
90
19.2K
Chaplin retweetledi
BSidesFrankfurt
BSidesFrankfurt@BSidesFRA·
This year's #BSidesFrankfurt is bigger and better, now at University Campus Frankfurt. Join us for insightful tracks, international keynotes, and a special kids' track with hands-on hacking courses. Interested in inspiring young minds? We're seeking volunteer teachers!
BSidesFrankfurt tweet media
English
0
6
8
1.3K
Chaplin retweetledi
SECUINFRA FALCON TEAM
SECUINFRA FALCON TEAM@SI_FalconTeam·
Great catch @StopMalvertisin #APT29🎣! We created a #Yara hunting rule to look for similar SVGs and found this sample: test.svg MD5: 5d327af805d36036c79cca2a027c1168 First seen: 2023-06-10 Uses a b64 encoded payload called test[.]zip, contains a legit procexp64.exe. 1/2🧵
SECUINFRA FALCON TEAM tweet mediaSECUINFRA FALCON TEAM tweet mediaSECUINFRA FALCON TEAM tweet media
Kimberly@StopMalvertisin

Interesting #APT29 document uploaded to VT yesterday. Invitation - Santa Lucia Celebration.msg f29083f25d876bbc245a1f977169f8c2 The email itself is from June 23 2023 and contains an .SVG attachement which drops an .ISO image called "invitation.iso"

English
3
16
44
10.2K
Chaplin retweetledi
SECUINFRA FALCON TEAM
SECUINFRA FALCON TEAM@SI_FalconTeam·
Picking up where we left off yesterday: We created two #Yara rules for the #Magniber #Ransomware delivery method. You can find them in our GitHub Repository and on @abuse_ch Yaraify ⬇️ Have a nice weekend and happy hunting 🔍 github.com/SIFalcon/Detec… yaraify.abuse.ch/yarahub/rule/R…
SECUINFRA FALCON TEAM tweet mediaSECUINFRA FALCON TEAM tweet media
SECUINFRA FALCON TEAM@SI_FalconTeam

#Magniber #Ransomware is continuing to spread fake Windows Update installers (.msi), but since yesterday the threat actors are also distributing .iso archives instead of .zip files. You can find our brief analysis of the msi and the lnk file below ⬇️ 1/3🧵

English
0
4
10
2.4K
Chaplin retweetledi
Alessandro Di Carlo
Alessandro Di Carlo@samaritan_o·
Great research! Keep this path in mind if you're having trouble finding evidence of execution: "C:\Windows\appcompat\pca” New Windows 11 Pro (22H2) Evidence of Execution Artifact! aboutdfir.com/new-windows-11…
English
1
45
138
15.7K
Chaplin retweetledi
Nathan McNulty
Nathan McNulty@NathanMcNulty·
This is super cool! Idea 💡 Sign up for Defender for Endpoint trial: aka.ms/MDEtrial Azure credits: azure.microsoft.com/en-us/offers/m… Set up Streaming API to a Storage account: docs.microsoft.com/en-us/microsof… Generate data with Atomic Red Team and similar. For 30d, expect ~1GB/device.
Matt Zorich@reprise_99

Not sure if this got enough love when it was announced, but you should 100% sign up to the free Azure Data Explorer instance - aka.ms/kustofree. 100 GB of storage, load up whatever data you want (csv, json, txt) and go ham with it

English
1
13
39
0
Chaplin retweetledi
Malwrologist
Malwrologist@DissectMalware·
Puzzled why a yara rule did or didn't match? Let me introduce yaradbg.dev, a web-based #yara #debugger! With #YaraDbg, you can see the: 1⃣ evaluation steps 2⃣ matched strings 3⃣ relationship among the rules
GIF
English
7
224
488
0
Chaplin retweetledi
James
James@jamesspi·
If you're using @elastic agent with the @osquery manager integration, remember that you can run @yararules on demand, or schedule them, or both!
James tweet media
English
3
36
127
0
Chaplin retweetledi
SECUINFRA FALCON TEAM
SECUINFRA FALCON TEAM@SI_FalconTeam·
🚨Deep Dive into N-W0rm 🚨 (Article next week, stay tuned) 🚨Hashes: 3d8ff7f298f64d9150a11e61dcbfd87b 9ce8d6f136b95fab140bc8904666003a e04e4cb7e410b885babba54cd59d5ae9 83dc22a1493e609b8b16f732e909418f 08587e04a2196aa97a0f939812229d2d #ThreatIntel #Malware #DFIR #nW0rm
English
1
3
4
0

Keşfet

@steamdb @vxunderground @InvictusIR @StopMalvertisin @Volexity @volatility @tlansec @attrc