infolec @infolec2

Lead Information Security Analyst | CyberPunk is cool | Command line is better than GUI. #CyberSecurity Joined October 2018

Tweets

223
Followers

47
Following

269
Likes

504

HackGit @hack_git

2 years ago

Unix-like Artifacts Collector UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD... github.com/tclahr/uac #cybersecurity #infosec

0 40 146 20K 61

Download Video

inversecos @inversecos

4 years ago

1\ #DFIR Tip: Analyse crash dumps on a windows system!!!!!!!!! We caught a lot of interesting things a TA did and tried to hide on a recent engagement!! Locations: > C:\windows\MEMORY.dmp > C:\Windows\System32\Minidump\*.dmp Analyse using Volatility / Windbg / Paid Tool

6 100 394 0 106

Download Image

Joe Słowik 🌻 @jfslowik

5 years ago

The SOC PM standup/shift change:

0 6 30 0 0

Download Image

Piotr Białczak @bialczakp

5 years ago

Hfinger, my malware HTTP request fingerprinter, has been published today @x33fcon. It's still a prototype, but can already quite uniquely discern between different malware families. Thanks @CERT_Polska_en that it could be open-sourced :-) github.com/CERT-Polska/hf…

3 41 89 0 7

Ignis @ahakcil

5 years ago

This is a big TIL for me! If you put a space before your command, it is not saved to the history.🤯

26 276 1K 0 67

Download Image

Lumpy @LumpyTheCook

5 years ago

I still remember when people complained that the Vegas desert scene in Blade Runner 2049 was "unrealistically filtered to shit" and "trying too hard to be artsy and surreal". That was three years ago.

72 3K 15K 0 263

Download Image

DFIRSummit @DFIRSummit

5 years ago

Fred Nolte, Nikita Jain, Dante Razo, and Jacob Alongi of the Incident Response Team at Target are here to discuss Leveraging Beacon Detection Techniques to Identify Anomalous Logons. #ThreatHuntingSummit

0 4 19 0 1

Download Image

Paul Dokas @pauldokas

5 years ago

This is beautiful and terrifying.

Omar Jimenez @OmarJimenez

5 years ago

This is beautiful and terrifying.

739 22K 56K 0 3K

Download Video

1 2 4 0 0

tlansec @tlansec

5 years ago

If you're ever looking at some CobaltStrike - this is pretty great: github.com/Sentinel-One/C…

1 53 173 0 37

marc ochsenmeier @ochsenmeier

5 years ago

#pestudio 9.06 with many context menus to filter output (indicated with a "*" once applied). Hope it is useful! #Malware #DFIR

0 7 21 0 2

Download Image

marc ochsenmeier @ochsenmeier

5 years ago

Small typo are sometimes unique Indicators of #Malware family and candidates for successful #YARA rules

0 3 23 0 0

Download Image

queen basic ⊛ @onfvp

5 years ago

Looking for encoded PowerShell? This regex should detect all variants of "-EncodedCommand" with or without obfuscation!

16 144 512 0 95

Download Image

Wolpertwo 📯 @Wolpertwo

5 years ago

@SwiftOnSecurity w64.exe w32.exe m64.exe m32.exe m6.exe m.exe dsget.exe update.bat s.exe (when scanner) smbexec* wmiexec.exe ping -n * (baseline, simple trick) r.exe (rar) More examples github.com/mbevilacqua/ap…

2 10 91 0 21

marc ochsenmeier @ochsenmeier

5 years ago

Popular methods for process injection! #Malware #DFIR github.com/odzhan/injecti…

0 51 149 0 20

REMnux @REMnux

5 years ago

REMnux v7 release likely next week. Lots of new and exciting tools, including @FireEye capa. Thanks for this handy tool, @williballenthin, Moritz Raabe, and team!

12 230 503 0 34

Download Image

Jai Minton @CyberRaiju

5 years ago

When looking at running processes, a number of useful items to examine: - Name(s) - Path - Description - Signing - Version - Company - Comments - Language - Hash We can get info on all exe/dll running using PowerShell. gps -module -FileVersionInfo -ea 0 | sort -uniq | FL *name

2 33 99 0 17

Download Image

Jai Minton @CyberRaiju

6 years ago

I've been compiling a Windows #cheatsheet of common commands and areas of interest for #DFIR including common tool-sets (more information to come). This can be found below, any comments or feedback is always welcome. jpminty.github.io/cheatsheet/DFI…