Jai @0x0rbit

Interests: CTI + Threat Hunting + DFIR Interwebs Joined January 2017

Tweets

64
Followers

49
Following

988
Likes

279

Red Canary, a Zscaler company @redcanary

4 years ago

The 2022 Threat Detection Report is out! Join us in counting down the most prevalent threats we encountered in our customers' environments last year. We'll reveal a new threat every hour in this thread (Or just download the report & see them all now) redcanary.com/resources/guid…

4 88 220 0 48

Download Video

🇺🇦Mike Saunders @hardwaterhacker

4 years ago

Today I learned CrowdStrike's ML AV component looks at total entropy in an executable and will block it if the entropy level is above some threshold. Successful bypass by adding English words in character arrays to decrease overall entropy.

19 145 742 0 82

Kostas @Kostastsale

4 years ago

I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅 If you're in #infosec and you feel a little down this week, this video is for you💙

160 1K 3K 0 273

Download Video

adam_cyber @Adam_Cyber

4 years ago

@CrowdStrike Intel team weighs in with analysis of the malicious bootloader from #whispergate crowdstrike.com/blog/technical…

0 17 33 0 4

Neil Fox @0xf0x_

4 years ago

I've submitted my last articles to @varonis before I start my new role that cover using Ghidra and @volatility. If you're new to IR & #malware then check out my blogs on using malware analysis tools such as @x64dbg, pestudio, process hacker & #YARA rules. varonis.com/blog/author/ne…

2 13 54 0 7

Andrew Pease @andythevariable

4 years ago

Really proud of the work the team has done on how to extract CS beacons from memory, send into the Elastic Stack, rip the configuration out, and send THAT to Elastic as well. The 2-part research includes a tutorial and a tool to automate it. Happy hunting! elastic.github.io/security-resea…

0 78 228 0 40

Security Onion @securityonion

4 years ago

Looking for a fun #Infosec project for the weekend?😀 Want to practice your #ThreatHunting 🔍and #IncidentResponse skills? Install #SecurityOnion 🧅 in a VM: docs.securityonion.net/en/2.3/first-t… Then follow along with this week's quick #malware analysis blog posts: blog.securityonion.net/search/label/q…

Security Onion @securityonion

4 years ago

0 30 80 0 10

Download Image

2 34 107 0 39

Kamil Bojarski 🌻 counterintelligence.pl @Lawsecnet

4 years ago

Kudos to @Mandiant for providing solid content with no marketing strings attached. Almost 50 pages of usable, technical advice. Nice one! mandiant.com/resources/prot…

0 38 152 0 44

Jon DiMaggio @Jon__DiMaggio

4 years ago

After two years of hard work, I am proud to announce that I have been working with @nostarch on my book titled “The Art of Cyberwarfare -An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime” Pre-order today! nostarch.com/art-cyberwarfa…

10 78 355 0 65

Vector 35 @vector35

4 years ago

Turns out, lots of folks still don't know about Binary Ninja cloud! It's been almost two years since we launched a free, totally browser-based decompiler and there's still a lot of folks who aren't aware of it! Please help us spread the word: cloud.binary.ninja

3 66 146 0 18

Download Image

rootsecdev @rootsecdev

4 years ago

After the Conti leak this is really how I feel about the current state of affairs

4 27 192 0 4

Download Image

kimber ✨ @kimb3r__

4 years ago

sobbing

11 109 460 0 8

Download Image

Vitali Kremez @VK_Intel

4 years ago

2021-07-20:🔥👿#CobaltStrike Beacon x64 DLL Loader | #Signed "MS Corporation Sofware Ltd" from Comodo 1⃣Loader Connectivity Call API Check: DnsQuery_A -> a2[.]hrmagazine[.]uk 2⃣Injects Beacon DLL via usual Process Injection ➡️ C:\\Windows\\splwow64.exe 🤔 h/t @malwrhunterteam

1 51 112 0 11

Download Image

OpenSecurityTraining2 @OpenSecTraining

4 years ago

We're currently at 790 registered users. Help spread the word about #OpenSecurityTraining2 and we can probably reach our first 1000 users this re-opening weekend!

2 62 141 0 9

Andrew Oliveau @AndrewOliveau

4 years ago

Want thousands of malicious Office document samples and their classification? @InQuest got you covered 🔥 Bunch of juicy stuff here… 👀 github.com/InQuest/micros…

2 26 89 0 15

Tommy M (TheAnalyst) @ffforward

4 years ago

Latest #KaseyaVSA #REvil update from @HuntressLabs "[...] the threat actor used an authentication bypass in the web interface of Kaseya VSA to gain an authenticated session, upload the original payload, and then execute commands via SQL injection." reddit.com/r/msp/comments…

11 199 460 0 64

Download Image

SANS Institute @SANSInstitute

5 years ago

At the upcoming #NewtoCyberSummit, @hacks4pancakes will speak on Landing a Job: Resumes and the Application Process! View Agenda and Register for Free: sans.org/u/1alf

0 15 36 0 4

Download Image

CrowdStrike @CrowdStrike

5 years ago

Blog: @CrowdStrike's Threat Intelligence team analyzes the malware used in the Sunburst attack to inject a backdoor without arousing suspicion. bit.ly/3qfAsj5 #sunburst #threatintelligence

5 95 172 0 15

Download Image

CrowdStrike @CrowdStrike

5 years ago

Registration is now OPEN! Join @CrowdStrike's first-ever capture the flag event and test your skills tracking nation-state, eCrime and Hacktivist adversaries. The top 50 high scorers will win cool CrowdStrike swag! bit.ly/3p61Cbm #ctf #cybersecurity

1 95 172 0 19

Download Image

Tony Lambert @ForensicITGuy

5 years ago

For all of you folks running VT retro hunts today, try just searching in the bar for `crowdsourced_yara_rule:APT_Backdoor_SUNBURST_1` The yara hits have already been indexed, save your retro hunts. BTW you can do this with anything from @cyb3rops 's signature base repo.