ForensicGeek @GeekForensic

DFIR Joined September 2016

Tweets

151
Followers

68
Following

647
Likes

253

El Enemigo Anónimo @EnemigoAnonimo_

4 years ago

¿Te imaginas un hospital que no puede recibir ambulancias ni dar medicamentos a sus recién operados porque está sufriendo un ciberataque? No te lo imagines, es real y ha pasado en España #TrabajaEnCiberseguridad #IMFxDeloitte youtu.be/ick1vssO0TU

1 8 18 0 1

Bank Security @Bank_Security

4 years ago

U.S. Government seizes Bitcoin worth a record $3.6B connected to the 2016 Bitfinex hack blog.chainalysis.com/reports/bitfin…

0 6 6 0 2

Download Image

Florian Roth ⚡️ @cyb3rops

4 years ago

Experience taught me that you only discover the true strength of your team and their tools in a real incident - sadly, there is no better teacher Only in their first domain-wide incident most orgs get …

11 96 490 0 64

Download Image

Deloitte España @Deloitte_ES

4 years ago

Diario de un Incident Responder es una serie de artículos en los que el equipo de DFIR, Digital Forensics & Incident Response, de Deloitte explica cómo atiende incidentes de ciberseguridad. Conoce cómo solventaron un ataque de Ransomware: deloi.tt/3g31lUj

0 5 6 0 1

Download Image

Vitali Kremez @VK_Intel

4 years ago

2021-08-05: 🆕🔥Introducing #BlackMatter #Ransomware x64 Linux Variant | esxcli variant | usual BlackMatter struct ➡️ “bot_id” | “bot_company” 1⃣Custom C Methods: /// esxi_utils files_proc file_encrypter setup_impl web_reporter /// 2⃣Encryption Mode | dark/white/min-size

MalwareHunterTeam @malwrhunterteam

4 years ago

3 37 96 0 6

Download Image

3 37 94 0 8

Download Image

John Lambert @JohnLaTwC

4 years ago

#HuntingTipOfTheDay If you know net.exe, you may know it calls net1.exe. Why?🤔net1.exe had Y2K fixes🗓️. It is still included for compatibility. Hunt for parent processes of net1 other than net. You may catch something 😀 📎hejox.se/sitedocs/windo… 📎docs.microsoft.com/en-us/previous…

3 80 223 0 45

Download Image

ForensicGeek @GeekForensic

4 years ago

#tokyo2020 #DFIR 💪💪💪

1 1 2 0 0

Download Image

ForensicGeek @GeekForensic

4 years ago

0 0 2 0 0

Download Image

ForensicGeek @GeekForensic

4 years ago

Go Go Go!!! Defenders!!!

0 0 2 0 0

Download Image

Red Canary, a Zscaler company @redcanary

5 years ago

Seeing some interesting #Gootkit activity of late, with new tradecraft deviating slightly from historical observations. This thread includes descriptions of behavioral analytics that might offer security teams opportunities for detection. #RCintel

1 5 11 0 0

Download Image

Ring3API 🇺🇦 @ntlmrelay

5 years ago

🔥#CVE-2020-1472 Netlogon Elevation of Privilege Vulnerability (All in One) ➡️[BLOG]:secura.com/blog/zero-logon ➡️[PoCs]: ➡️[LOGS]: ➡️[DETECT]: #threathunting #blueteam #SOC #Vulnerability #Microsoft #Windows

Andrii Bezverkhyi @andriinb

5 years ago

1 25 41 0 4

Download Image

7 86 143 0 21

Download Image

Carlos García ciyi @ciyinet

5 years ago

Also, look for 2 password changes (event 4742) of the DC computer account in a short period of time. This password is only changed automatically every 30 days by default, so 2 changes in a short period of time is suspicious. Anyway, patch now :) [3/3]

0 3 3 0 0

Download Image

Mathias Fuchs @mathias_fuchs

5 years ago

Aurora is now Open Source. See the repo at github.com/cyb3rfox/Auror… I also recorded a walkthrough to get you started with the tool youtu.be/2j2XYcqQIm0. Precompiled downloads for mac, lx, and win are under the releases section on github.

8 63 130 0 26

Eric Zimmerman @EricRZimmerman

5 years ago

SQLECmd is now available on ericzimmerman.github.io #DFIR

4 56 111 0 4

Christopher Glyer @cglyer

6 years ago

BREAKING: APT41 initiated a multi-month global campaign at over 75 @FireEye customers attempting to exploit Internet facing systems using recently released exploits for Citrix NetScaler/ADC, Cisco Routers & Zoho ManageEngine. fireeye.com/blog/threat-re…

6 140 238 0 12

Florian Roth ⚡️ @cyb3rops

6 years ago

#Citrix #Netscaler #Shitrix 🏹 Snort doc.emergingthreats.net/bin/view/Main/… Sigma github.com/Neo23x0/sigma/… YARA github.com/Neo23x0/signat… IOCs otx.alienvault.com/pulse/5e1c293e… Nmap NSE github.com/cyberstruggle/… MSF github.com/rapid7/metaspl… HoneyPot github.com/MalwareTech/Ci… SSH check

Florian Roth ⚡️ @cyb3rops

6 years ago

1 44 98 0 14

Download Image

4 432 798 0 102

Florian Roth ⚡️ @cyb3rops

6 years ago

Quick check via SSH for recently created template files on you #Citrix #Netscaler #ADC systems ssh -tt [netscaler-ip] 'find /netscaler/portal/templates /var/tmp/netscaler/portal/templates -mtime -5 -type f' based on report by @TrustedSec trustedsec.com/blog/netscaler…

1 44 98 0 14

Download Image

Florian Roth ⚡️ @cyb3rops

6 years ago

2/2 1. Many off the shelf RATs don’t have proxy capability. Surprising but true. 2. Content policies that disallow the download of executables block 2nd stages. E.g. Emotet: Doc > PS > Download of EXE => blocked Many serious incidents were stopped / obstructed by proxies.