John @BitsOfBinary

#threatintel @PwC_UK. Reverse engineering, threat intelligence, YARA. Amateur jazz pianist. All tweets are my own. He/him. github.com/BitsOfBinary Joined October 2017

Tweets

606
Followers

2K
Following

397
Likes

2K

John @BitsOfBinary

11 months ago

Amazing work as always @nao_sec ! For folks hunting for this stuff, I've got some YARA rules + these IoCs published here from my @labscon_io talk on IIS malware: github.com/PwCUK-CTO/labs… In particular, the "Malware_IIS_reGeorg_Unique_Strings" rule will be of use for this stuff!

nao_sec @nao_sec

11 months ago

1 51 132 23K 52

Download Image

0 9 35 4K 6

linkcabin @LinkCabin

11 months ago

High signal phishing cluster IoCs released - github.com/ext-jack/threa…

1 3 19 2K 10

linkcabin @LinkCabin

12 months ago

I did some new research. Enjoy! Detecting a business email compromise (BEC) threat actor - threatintelligence.substack.com/p/detecting-a-…

0 1 1 281 0

John @BitsOfBinary

12 months ago

Following recent reporting by The Citizen Lab and AccessNow on #COLDWASTREL (which we track as White Dev 185), we've put out a blog detailing some further infrastructure of the threat actor, and historic connections to other threat actors: pwc.com/gx/en/issues/c…

0 13 43 4K 14

John @BitsOfBinary

12 months ago

Nice research from Check Point. I've blogged about the SessionsIIS backdoor last year, which they mention in their research: pwc.com/gx/en/issues/c… Timely research as well, as I'll also be mentioning these backdoors at @labscon_io next week.

Cyber_OSINT @Cyber_O51NT

12 months ago

0 26 61 6K 15

0 5 27 2K 2

John @BitsOfBinary

a year ago

I'm very excited to be speaking at @labscon_io about IIS malware! The whole agenda looks incredible, so I'm honoured to be able to present, and looking forward to seeing everyone who will be attending 😁

LABScon @labscon_io

a year ago

0 5 16 7K 1

2 3 27 2K 1

Download Image

Adam @malworms

a year ago

For anyone using Binary Ninja and wanting to use Mandiant's ShellcodeHashes IDA plugin-I ported a basic version of the IDA plugin to Binary Ninja: github.com/PwCUK-CTO/Bina… Known limitations - No GUI, no support for searching memory constants - but it works well for most use cases

0 10 25 2K 5

John @BitsOfBinary

a year ago

Useful stuff to learn here, whether you're new to or experienced with #YARA!

David Cannings @edeca

a year ago

Useful stuff to learn here, whether you're new to or experienced with #YARA!

0 4 10 2K 4

0 0 3 363 0

Thomas Roccia 🤘 @fr0gger_

2 years ago

Analyzing data leaks is a very interesting Intel challenge, especially when you’re dealing with a foreign language 🤓 The I-SOON leak, which contains mostly PNG files of screenshots of documents, is a good example 🔎 Last night, I created a Notebook to automatically process and…

22 211 784 164K 675

Download Image

John @BitsOfBinary

2 years ago

Invaluable advice right here. The more YARA rules I write, the more I prefer having shorter, less complex ones. That doesn't mean you can't have a complicated condition or set of strings, but imo it's a good idea to have one "idea" per rule, where possible

Steve YARA Synapse Miller @stvemillertime

2 years ago

1 2 16 2K 1

0 0 10 841 0

John @BitsOfBinary

2 years ago

Automating this stuff gives you more time to focus on the novel detection/hunting work 😌 Nice one @fr0gger_ ! 😁

Thomas Roccia 🤘 @fr0gger_

2 years ago

Automating this stuff gives you more time to focus on the novel detection/hunting work 😌 Nice one @fr0gger_ ! 😁

0 5 14 3K 3

Download Gif

1 0 8 1K 2

John @BitsOfBinary

2 years ago

I'm not convinced this isn't just @fr0gger_ typing responses very quickly 😛 This looks like a great resource for if you're starting with YARA! 💊

Thomas Roccia 🤘 @fr0gger_

2 years ago

I'm not convinced this isn't just @fr0gger_ typing responses very quickly 😛 This looks like a great resource for if you're starting with YARA! 💊

4 31 137 13K 53

Download Gif

1 0 2 484 0

John @BitsOfBinary

2 years ago

I've consolidated all my #100DaysofYARA posts from 2023 into one blog post. I've also included the rough breakdown of the posts in case you want to jump to specific sections. bitsofbinary.github.io/yara/2023/01/0… (hopefully all the old links should still work 🤞)

0 38 95 10K 63

Download Image

John @BitsOfBinary

2 years ago

I'm looking forward to seeing what people do for #100DaysofYARA! I'm not planning to do much for it this year - remember that it's good to take a break from infosec stuff at times 👍 But if you're new to YARA, or want to learn new stuff, it's a good chance to give it a go!

1 1 12 2K 1

Kris McConkey @smoothimpact

2 years ago

🚨 Job alert 🚨 A few open roles on the PwC #threatintel team for folks who love tracking APT actors, crime delivery botnets, building analysis tools and UI interfaces. Technical intel analyst (more in thread 👇): ninjajobs.org/job/66476970cb…

3 42 72 25K 21

John @BitsOfBinary

2 years ago

Bit off topic for me, but for my threat intel friends, you might enjoy this game! Lots of deductions needed to try and figure out who everyone is - one of my favourite puzzle games!

Lucas Pope @dukope

2 years ago

Bit off topic for me, but for my threat intel friends, you might enjoy this game! Lots of deductions needed to try and figure out who everyone is - one of my favourite puzzle games!