Jean-Pierre GARNIER @codeyourweb

Adversary Hunter && Threat Researcher - ♥infosec, code and mojitos - Opinions are mine Paris Joined February 2014

Tweets

329
Followers

142
Following

175
Likes

277

Stephan Berger @malmoeb

7 months ago

New blog post: Tear Down The Castle - Part 2 dfir.ch/posts/tear_dow… I analyzed 250 PingCastle Reports, grouping the findings along the categories I used for my 10 AD Commandments series. The number of affected domains is stated within each finding, i.e., in how many domains we…

2 49 183 14K 167

Download Image

Yuval Gordon @YuG0rd

3 months ago

Many missed this on #BadSuccessor: it’s also a credential dumper. I wrote a simple PowerShell script that uses Rubeus to dump Kerberos keys and NTLM hashes for every principal-krbtgt, users, machines. no DCSync required, no code execution on DC.

9 154 499 38K 254

Download Video

Jean-Pierre GARNIER @codeyourweb

4 months ago

And here's a little project to monitor network traffic and logging directly over endpoints interfaces. First proof-of-concept with local pcap and HTTP API forwarder (fully tested on #SEKOIA plaftform). github.com/codeyourweb/lp… #soc #cybersecurity #networksecurity

0 0 0 377 0

Eric Morillot @EricMorillot

6 months ago

Quel génie a fait ça ??? 🤣🤣🤣 #Ukraine #Russie #USA

57 686 3K 137K 3K

Download Video

Akshay 🚀 @akshay_pachaar

8 months ago

Microsoft has released its own document parser for LLM use! . . Introducing MarkItDown, a 100% open-source, one-stop solution for effortlessly converting any file to Markdown—perfect for text analysis, indexing, and more! Here’s what makes it special: ↳ Converts PDF, Word,…

71 574 4K 401K 6K

Download Image

Eroktic @Eroktic

a year ago

Reviews are MOSTLY NEGATIVE - Gray Zone Warfare vid is up on yt #GZW #GrayZoneWarfare

1 2 3 879 0

Download Image

Jean-Pierre GARNIER @codeyourweb

2 years ago

welcometothejungle.com/fr/companies/c…

0 0 2 28 0

Katie Nickels @likethecoins

2 years ago

Kudos to @DragosInc for sharing details of a recent event. The adversary compromised a new employee's personal email address and impersonated them to get access. How would you protect against that?

Dragos, Inc. @DragosInc

2 years ago

Kudos to @DragosInc for sharing details of a recent event. The adversary compromised a new employee's personal email address and impersonated them to get access. How would you protect against that?

6 96 268 118K 42

5 8 77 13K 3

Florian Roth ⚡️ @cyb3rops

2 years ago

I remember a time when people here in Europe still had issues storing their corporate emails on US mail servers - nowadays you store the master keys to your company on their servers 🎵 … for the times they are a-changin'

Merill Fernando @merill

2 years ago

7 47 239 93K 74

Download Image

4 5 31 25K 8

Florian Roth ⚡️ @cyb3rops

2 years ago

Priorities

16 114 664 77K 40

Download Gif

Alexis Kauffmann @framaka

3 years ago

[Android] Une trentaine de "Privacy Friendly Apps" proposées par @SECUSOResearch qui : - are Open Source (GPLv3) and their source code can be viewed an Github by anybody - used minimal permissions - do not neither tracking mechanisms nor advertisement secuso.aifb.kit.edu/english/105.php

0 14 27 0 7

Download Image

Chetan Nayak (Brute Ratel C4 Author) @NinjaParanoid

3 years ago

Unable to extract credentials via DPAPI or Mimikatz? Don't worry. Microsoft got your back. Just use 'rundll32 keymgr.dll, KRShowKeyMgr' to extract all the stored passwords on the host, be it a target server, FTP or chrome's HTTP creds, microsoft has you covered. #redteam

48 818 3K 0 745

Download Image

Johann Aydinbas @jaydinbas

3 years ago

Possibly #Lazarus related #maldoc: "LMCO_Senior Systems Engineer_BR09.doc" virustotal.com/gui/file/8e2fb… CnCs: https://monitorr.jamdown[.]co[.]nz/assets/data/css/custom.php http://13.88.245[.]250/admin/install/custom.php http://mantis.binarysemantics[.]com/extra/map/map.php

2 20 54 0 7

⚛️ Marcin Siedlarz @siedlmar

3 years ago

GitHub - claroty/arya: Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA. github.com/claroty/arya

0 3 9 0 3

Mandiant (part of Google Cloud) @Mandiant

3 years ago

New: North Korea has taken a page out of China's cyber playbook to reorganize and consolidate its threat groups within the government - making them “extremely mobile now that they’ve consolidated.” Here's a first look at their new org structure 👇 mandiant.com/resources/mapp…

2 157 324 0 49

Download Image

Red Canary, a Zscaler company @redcanary

4 years ago

The 2022 Threat Detection Report is out! Join us in counting down the most prevalent threats we encountered in our customers' environments last year. We'll reveal a new threat every hour in this thread (Or just download the report & see them all now) redcanary.com/resources/guid…

4 88 220 0 48

Download Video

Jazi @h2jazi

4 years ago

#Lazarus #APT #maldoc: JD.docx 854903e0b284ef78322082de46dcd160 Remote template: https://pvacek[.]cz/wp-content/plugins/akismet/control/en/en.jpg

2 33 98 0 18

Download Image

Kaspersky @kaspersky

4 years ago

Our statement in regard to the warning of German Federal Office for Information Security (BSI) Unser Statement zur Warnung des Bundesministeriums für Sicherheit in der Informationstechnik (BSI)