Qazeer

Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: github.com/wavestone-cdt/… 1/2

I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir unit42.paloaltonetworks.com/edr-bypass-ext…

What a glorious day for Incident Responders around the world! Premium audit events in Microsoft 365 are now available to non-premium users. 🚨Action for you: - Check your mailbox audit settings, details in the blog: techcommunity.microsoft.com/t5/security-co…

@lkarlslund Among the things that can be checked by FarsightAD (github.com/Qazeer/Farsigh…) in a post forest / domain scenario :)

How to disable some parts of EDR’s telemetry on Windows 10? Just ask nicely! See riskinsight-wavestone.com/en/2023/10/a-u… for more info about an interesting logic bug we found on Win10 that affects all EDRs 😉

Forget vulnerable drivers - Admin is all you need Article 👉 elastic.co/security-labs/… 👇 Demo - enable sound 🔊

🚩 @wavestoneFR CTF team #YoloSw4g ranks first of 80+ teams at #CyberEx23! 🚩 Thanks @INCIBE and @OEA_Cyber for the organization & challenges! 🚩 Congratz to @_Qazeer @th3m4ks and @meaz0u for the great team we've been for the last 8 hours, now we go to a well-deserved sleep!

#Podcast #Cybersécurité Épisode #387 consacré à l'outil de contournement des EDR, "EDR Sandblast", avec @th3m4ks et @_Qazeer nolimitsecu.fr/edrsandblast/

A promise is a promise: the slides from the #DEFCON30 DemoLabs @_Qazeer and I presented about EDRSandblast are uploaded on GitHub (github.com/wavestone-cdt/…), along with the latest version of the tool! Check out the list of new features in the slides, documentation is on its way ;)

@Jipe_ Thank you for the shout-out @Jipe_!

.@_Qazeer has just released FarsightAD, an awesome tool to identity AD backdoor: github.com/Qazeer/Farsigh… #DFIR

FarsightAD and the slides from the SANS DFIR Summit 2022 "Hunting for Active Directory persistence" talk can be found on GitHub as well: github.com/Qazeer/Farsigh…. Thank you to all the in-person and virtual attendees! 2/2

Aaand it's a wrap! EDRSandblast v1.1 and the slides from the DefCon30 DemoLab "EDR detection mechanisms and bypass techniques with EDRSandblast" with @th3m4ks can now be found on GitHub: github.com/wavestone-cdt/… 1/2

Actually good question, let's start with obviously wrong answers and see where they lead us. A thread 🧵

Hey, do you like tokens? Have you always wanted to "harvest" tokens for offensive purposes? If so check out my new post posts.specterops.io/koh-the-token-… where I show I can (finally) write a technical post without memes, and then check out the Koh toolset at github.com/GhostPack/Koh

I'm extremely proud to announce @wavestone_ speaking engagements at @BSidesLV @defcon & more, and it doesn't fit in a tweet (far from it, actually), so a 🧵:

You enjoyed the awesome EDRSandblast tool of @th3m4ks and @_Qazeer and want to know more about the vulnerability used in the MSI AfterBurner driver to play in the kernel mode ? Go check the vulnerability analysis done by hfiref0x swapcontext.blogspot.com/2020/01/unwind…

🇫🇷🎙️ Nouvel épisode du podcast @hacknspeak avec @th3m4ks & @_Qazeer pour parler de leur outil EDRSandBlast 🚀 Une interview un peu plus technique que d'habitude où l'on parle du fonctionnement d'un EDR et des mécanismes de contournement 🔥 Bonne écoute 🎶anchor.fm/hacknspeak