Kostas

5.8K posts

Kostas

Kostas

@Kostastsale

Running 🌐 https://t.co/UQFpAAKoBl | https://t.co/r3JIuCfOKn | https://t.co/THlTmUeoaa | https://t.co/m7NkZEOxkG | 🇬🇷🇨🇦

Katılım Şubat 2017
380 Takip Edilen19.6K Takipçiler
Kostas
Kostas@Kostastsale·
We are launching our threat intelligence feeds and we’re making them free for the first year for our enterprise customers with access to our threat hunting labs! Indicators across Windows,Linux and macOS intrusions🥳 Low noise, high fidelity, plug-and-play point 👇
Threat Hunting Labs@ThruntingLabs

Launching today: Threat Hunting Labs private threat intelligence feed THL enterprise customers now get access to a dedicated intel feed built around high-fidelity IOCs curated by our team, structured in STIX 2.1 and delivered over TAXII 2.1. It integrates directly with your SIEM or security tooling. Signed webhooks if you want push delivery. No noise layers on top. Included free for enterprise customers in year one. If you're already a THL customer, reach out and we'll get you set up. If you're not, this is a good time to ask what that looks like. 👉 intel.threathuntinglabs.com

English
0
23
151
29.2K
Kostas retweetledi
Threat Hunting Labs
Threat Hunting Labs@ThruntingLabs·
Other platforms just drop you into the investigation and call that training. Just giving people access to the data is not enough… Threat Hunting Labs is built differently! We show you what triggered the investigation, let you work through it using either a timeline view or a decision tree view, and guide you throughout with Athena and helpful in-platform notices. Each case also includes learning modules with short questions at the end of each section so you actually understand what happened. Start with a free walkthrough case to experience the platform: threathuntinglabs.com
English
1
4
24
1.8K
mRr3b00t
mRr3b00t@UK_Daniel_Card·
CRINGE
SANS Institute@SANSInstitute

Anthropic released Mythos on Tuesday. By Sunday, 60+ security leaders had written the briefing the community needed. "The window between discovery and weaponization has collapsed into hours." — @RobTLee, SANS Institute 181 working Firefox exploits. The previous best model managed 2. Read the blog → go.sans.org/Bw3mxJ Read the briefing → labs.cloudsecurityalliance.org/mythos-ciso/ Join us Thu 4/16 at 12PM ET → go.sans.org/DM0LjN #Cybersecurity #AIRisk

English
20
6
142
23.2K
Kostas retweetledi
Threat Hunting Labs
Threat Hunting Labs@ThruntingLabs·
Threat Hunting Labs now supports enterprise and team subscriptions. Here's what a team gets: → Access for your full team across all tracks (threat hunting, incident response, malware analysis, detection engineering) → Manager dashboard to monitor individual and team-wide progress → Performance tracking mapped to MITRE ATT&CK techniques and intrusion phases, so you know exactly where your team has gaps before it matters in a real incident → Shared credit pool across the team with a full history of who used what → Early access to our indicator feeds, sourced directly from our latest incident response engagements, high-confidence malicious infrastructure and activity (bundled in for a limited time) Your analysts aren't watching videos or reading slides. They're working the same logs a responder would have had during a live incident. Book a 30-min demo and we'll walk you through it: cal.com/kostas-hcq78e/…
English
0
2
15
1.2K
David Naylor
David Naylor@_David_Naylor·
Took #1st place on @Kostastsale's ThreatHuntingLabs leaderboard. Fun platform for practicing investigations
David Naylor tweet media
English
1
3
5
992
Kostas
Kostas@Kostastsale·
@_David_Naylor You shoot right to the top. Well done David, impressive 👏👏
English
0
0
0
248
Kostas
Kostas@Kostastsale·
@fr0gger_ This looks awesome!! 🤩 Will try this now!
English
1
0
2
410
Kostas retweetledi
Thomas Roccia 🤘
Thomas Roccia 🤘@fr0gger_·
🤓 I recently came across a nice post published on Feedly by Ondra Rojčík, who talks about the process of profiling threat actors using 5W1H and the Diamond Model. I loved it. I wanted to incorporate it into my pipeline. So I created an Agent Skill but not to generate another lengthy report that I will never read. It actually creates a nice visual in no time using Claude custom visuals. Check out what you can do with it. 👇
English
3
7
40
11.6K
MalwareHunterTeam
MalwareHunterTeam@malwrhunterteam·
🤷‍♂️
Kostas@Kostastsale

We’ve also come across this macOS intrusion shared by @malwrhunterteam & @L0Psec where the attacker came prepared with a purpose-built collector 👀 • Execution: initial bash script • Download: payload from 193.233.128.50 → hidden temp file • Staging: ~/Library/Caches/com.apple.coreservices/com.apple.periodic → quarantine removed • C2: beacon to 95.163.152.79:8133/api/t (unique run ID) Discovery: • Hardware, OS, memory, IP, locale, keyboard • Running processes Collection: • Safari (cookies, autofill, history) • Chrome cookies • Apple Notes • SSH known_hosts • Keychain-related temp files • Env dumps (FileGrabber/EnvFiles) Second stage (~4.5 min): • ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate • Dropped + quarantine stripped Fake macOS prompt via osascript used for credential harvesting (see SS)👇 We have the complete intuition collected and we'll be sharing it through the @ThruntingLabs sometime soon.

ART
1
0
2
2.8K
Kostas
Kostas@Kostastsale·
@IAMERICAbooted Of course there isn't. My point is more around why people avoid internal AI in the first place. Even when tools are approved, there’s still that perception that everything is visible, logged, or tied back to them.
English
1
0
0
229
EZ
EZ@IAMERICAbooted·
While this is true, there is no such thing as privacy on a manged network, even with your shadow IT 😋
Kostas@Kostastsale

It’s not just about “better tools.” Even when companies provide approved AI tools, employees still prefer using their own. Not because they don’t understand risk but because they value privacy. People don’t want their internal chats, questions, or thought process monitored or tied back to them. Even harmless prompts feel personal. That’s the part most orgs are missing.

English
1
0
5
1.6K
Kostas
Kostas@Kostastsale·
We’ve also come across this macOS intrusion shared by @malwrhunterteam & @L0Psec where the attacker came prepared with a purpose-built collector 👀 • Execution: initial bash script • Download: payload from 193.233.128.50 → hidden temp file • Staging: ~/Library/Caches/com.apple.coreservices/com.apple.periodic → quarantine removed • C2: beacon to 95.163.152.79:8133/api/t (unique run ID) Discovery: • Hardware, OS, memory, IP, locale, keyboard • Running processes Collection: • Safari (cookies, autofill, history) • Chrome cookies • Apple Notes • SSH known_hosts • Keychain-related temp files • Env dumps (FileGrabber/EnvFiles) Second stage (~4.5 min): • ~/Library/Caches/com.apple.softwareupdate/SoftwareUpdate • Dropped + quarantine stripped Fake macOS prompt via osascript used for credential harvesting (see SS)👇 We have the complete intuition collected and we'll be sharing it through the @ThruntingLabs sometime soon.
Kostas tweet mediaKostas tweet mediaKostas tweet media
L0Psec@L0Psec

Another interesting one shared by @malwrhunterteam. Initial bash script sets up the comms with C2 (193.233.128\.50 - RU), does other stuff(readable), and grabs the next stage (intel or arm go binary). e9524affd1366c5cd33527d87f7ef273706cfee1269fa43cd88d22e53bdd58e4 1 VT hit 🧵

English
0
19
74
11.4K
Kostas
Kostas@Kostastsale·
@raftomas Absolutely and on top of that companies are using the data that you provide to their version of AI messaging to train and then get rid of you down the road. Why would ppl ever do that?
English
0
0
1
57
Kostas
Kostas@Kostastsale·
It’s not just about “better tools.” Even when companies provide approved AI tools, employees still prefer using their own. Not because they don’t understand risk but because they value privacy. People don’t want their internal chats, questions, or thought process monitored or tied back to them. Even harmless prompts feel personal. That’s the part most orgs are missing.
SANS Institute@SANSInstitute

Your employees are already using AI without your approval. They’re feeding it sensitive data. They don’t understand the risk. They’re doing it because you haven’t given them better tools. @joswr1ght at RSAC: “We have an ongoing issue where workers don’t have the tools they need, and now they’re saying, ‘I can get AI to help me without approval,’ without understanding what kind of data they’re sending into systems or what the risk is.” @edskoudis hinted shadow AI may appear in next year’s Top 5 Most Dangerous. 📣 You heard it here first. go.sans.org/nTAdXo @OneRSAC | #RSAC #Cybersecurity

English
1
1
16
4.4K
Kostas retweetledi
Threat Hunting Labs
Threat Hunting Labs@ThruntingLabs·
🚨New lab is out! It's a flash hunt, and we want to see how fast the community can work through it. You get real endpoint logs, real detections, and questions across all four tracks: Threat Hunting, Incident Response, Detection Engineering, and Malware Analysis. Finish the hunt, then explore the Learning Module to learn the techniques behind the intrusion. Check it out👇 🔗threathuntinglabs.com
Threat Hunting Labs tweet media
English
0
1
9
710
Kostas
Kostas@Kostastsale·
@ippsec Mythos feels basically like a big marketing scam. Anthropic keeps doing this. There’s no way it’s actually better in the way they’re making it sound. Throwing all that compute at it and burning thousands of dollars just to dig up some low-level bug is kind of ridiculous.
English
0
0
3
826
ippsec
ippsec@ippsec·
There is a lot of mythos hype and while I do think it will be better, I don’t think it will be orders of magnitude better or even proportional to its cost better. At the end of the day, marketing is going to market. Everything I have read has been more exploits, not discovery. I think that word plays a big part but maybe I’m overthinking it. I know of a lot of times opus (or a combo of models), can find an exploit, be confident it is valid, but fail at building an exploit due to a failed primitive (ex: kaslr in kernel bugs). Without that proof, it goes on the back burner decimating tokens until it hits the lottery. There’s so many vulnerabilities being found right now, it’s hard to prioritize when its severity is an assumption. It’s probably been 6 months since the last major update, I’m guessing mythos knows more primitives. So when it’s launched it will look at notes left behind and get lots of credit when it worked off notes opus left behind and did a fraction of the work. About the “it’s so dangerous” comments. I think that is primarily it not listening to the operator, doing things it shouldn’t to accomplish its goal. At that point it makes sense to do a closed beta, expand testers and try to make it obedient. While that happens, cash in on publicity of doing the right thing and saying it’s too smart to go public. While true, it could be a little deceptive but as I said. Marketing is going to market.
English
10
31
316
17.4K
Kostas
Kostas@Kostastsale·
@m19o__ There’s room for everyone, show us what you got 🙂
English
1
0
1
51
Kostas
Kostas@Kostastsale·
If you’re looking to hire a strong infosec analyst, keep an eye on our leaderboard. These are practitioners working through real intrusion data, not just theory and silly games. They’re ready to hit the ground running. 👉 threathuntinglabs.com/leaderboard
Kostas tweet media
Threat Hunting Labs@ThruntingLabs

The Threat Hunting Labs leaderboard is heating up. Shoutout to the top performers putting in serious work across the tracks: 1. DCAMINADA — 400 pts 2. MARIS_KLH — 356 pts 3. KOIFSEC — 315 pts 4. CHICKEN0248 — 279 pts 5. HUSS3_WL — 224 pts 6. NIK___ — 214 pts 7. SEAN_4 — 207 pts 8. SANCLOGIC — 184 pts 9. CAMOXD — 74 pts 10. LETITGO_900 — 50 pts These are practitioners working through real intrusion data, not CTF puzzles. The gap between first and fifth is tighter than it looks. Still plenty of labs to go. If you want to compete or just learn based on real intrusions and real logs, head on to threathuntinglabs.com

English
2
3
49
5.7K
Threat Hunting Labs
Threat Hunting Labs@ThruntingLabs·
The next few labs we’re about to release are too powerful. The investigations became so immersive they escaped the offline lab environment and started behaving like real investigations. We tried to contain them with a question-and-answer harness. Didn’t work. They keep spilling into the real world. At one point, one of them identified an issue in our malware analysis lab, grabbed credentials, broke out of REMnux, and continued the investigation in our search console. Out of an abundance of caution, we should probably withhold this release. But we won’t. They’re coming out soon.
English
1
1
13
842

Keşfet

@UK_Daniel_Card @_David_Naylor @fr0gger_ @ClementDelangue @malwrhunterteam @IAMERICAbooted @L0Psec @ThruntingLabs