eric ([email protected]) @invoke_eric

Cybercrime Threat Intelligence | Posts are not my employer's github.com/invoke-eric cyberspace Joined January 2021

Tweets

49
Followers

223
Following

63
Likes

41

eric ([email protected]) @invoke_eric

3 years ago

Great collaboration between CrowdStrike Services and CrowdStrike Intelligence @realparisi

Tim Parisi @realparisi

3 years ago

Great collaboration between CrowdStrike Services and CrowdStrike Intelligence @realparisi

0 21 51 0 13

0 0 2 0 0

eric ([email protected]) @invoke_eric

3 years ago

A #jupyter notebook for triaging HTML files github.com/invoke-eric/ju… perhaps useful for anyone in #threatintelligence investigating phishing campaigns

0 0 0 0 0

eric ([email protected]) @invoke_eric

3 years ago

a day in the life of cyber threat intelligence analysts #cyberbakeoff

0 8 28 0 1

Download Image

eric ([email protected]) @invoke_eric

3 years ago

Interesting #LOTS (Living Off Trusted Sites) that seems perfect for threat actors bashupload.com: "Files are stored for 3 days and can be downloaded only once." - add that one to your threat hunting leads

0 0 1 0 0

eric ([email protected]) @invoke_eric

3 years ago

helgeklein.com/blog/active-se… IMO a good explanation of the #LOLBIN runonce.exe /AlternateShellStartup (lolbas-project.github.io/lolbas/Binarie…)

0 1 1 0 1

eric ([email protected]) @invoke_eric

3 years ago

gnomidea[.]xyz #cobaltstrike - FYI @Namecheap

1 1 2 0 0

eric ([email protected]) @invoke_eric

3 years ago

Hello #ThreatIntelligence community, here is a #jupyter notebook to triage infrastructure using the @virustotal API github.com/invoke-eric/ju…

2 26 113 0 41

eric ([email protected]) @invoke_eric

3 years ago

#python #pandas tip: you can pass a dict to the pandas .astype() method to easily retype a whole df at one go, e.g.: convert_dict = {'col1': float, 'col2': object} df = df.astype(convert_dict)

0 0 2 0 0

eric ([email protected]) @invoke_eric

3 years ago

quick #dailyyara: xml.res file referencing external content (not necessarily malicious) rule r{ strings: $ = /Relationship Id="[a-zA-Z0-9]{3,6}" Type="http[s]?:\/\/[^"]{4,200}" Target="http[s]?:\/\/[^"]{4,80}" TargetMode="External"/ condition: all of them }

0 2 7 0 1

eric ([email protected]) @invoke_eric

3 years ago

OneDrive URLs have cid values unique to each user cs.cornell.edu/~shmat/shmat_u…; this can be useful for #threathunting purposes, as some adversaries reuse the same cid across multiple campaigns.

0 1 3 0 1

eric ([email protected]) @invoke_eric

3 years ago

Not all @censysio HTTP header fields are indexed, so if you try to search for these field names, you will get an error. However, you can still search the values using services.http.response.headers.unknown.value. This usually works.

1 2 23 0 2

eric ([email protected]) @invoke_eric

3 years ago

Hello dear #ThreatIntelligence community, here are a couple basic #jupyter notebooks for triaging infrastructure using @censysio or @PassiveTotal APIs github.com/invoke-eric/ju… with the power of Pandas

0 50 167 0 43

eric ([email protected]) @invoke_eric

3 years ago

Here is a @PassiveTotal python CLI client (passivetotal.readthedocs.io/en/latest/gett…) jq one-liner for “just give me all the resolutions” pt-client pdns --query YOUR_DOMAIN_OR_IP_HERE | jq -r '.results[] | select(.recordType == "A") | {resolve} | join("")'

0 0 1 0 1

eric ([email protected]) @invoke_eric

3 years ago

#dailyyara tip I got from @larsborn - if your YARA rule is not for binaries (e.g. if it is for scripts), add a printability check under the condition, e.g.: and for all i in (1..100) : (uint8(i) != 0x0)

1 6 28 0 8

eric ([email protected]) @invoke_eric

3 years ago

thank you #Inter #skimmer operator for your convenient domain naming: interclub[.]website - shares WHOIS gordonlaver9@gmail[.]com with brilliantclub[.]website

0 0 2 0 0

eric ([email protected]) @invoke_eric

3 years ago

what is it like to work in #ThreatIntelligence you ask? cc @JershMagersh

0 0 1 0 0

Download Image

eric ([email protected]) @invoke_eric

3 years ago

if you are not using stedolan.github.io/jq/, you don't know what you are missing

0 0 1 0 0

Download Image

eric ([email protected]) @invoke_eric

4 years ago

crowdstrike.com/blog/prophet-s… Great collaboration between #crowdstrike intelligence and services

1 0 1 0 0

eric ([email protected]) @invoke_eric

4 years ago

Handy tip-of-the-day from #iterm2

0 0 0 0 0

Download Image

Mark Schloesser @repmovsb

4 years ago

I don't do this often but these are special times: we're looking for several people to join our team at CrowdStrike Intelligence, reach out if you enjoy a good challenge!