Josh Lemon @joshlemon

Chief DIFR at @SoteriaSec_io | @SANSInstitute Principal Instructor & Author | Digital Forensics & Incident Response geek joshlemon.com.au Australia Joined September 2009

Tweets

3K
Followers

2K
Following

1K
Likes

3K

SoteriaSec @SoteriaSec_io

a month ago

It's time to update your detections if you haven't been looking for WebShells on your #SharePoint server. 🕵‍ Make sure you're detecting w3wp.exe > cmd.exe > PowerShell.exe Although really, cmd.exe being spawned by your SharePoint server really needs a thorough review.

1 1 1 103 0

Download Image

Microsoft Security Response Center @msftsecresponse

2 months ago

Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771. These vulnerabilities apply to on-premises SharePoint Servers only. Customers should apply these updates immediately to…

1 52 119 72K 31

ACE Responder @ACEResponder

2 months ago

How DCOM lateral movement works. #ThreatHunting #DFIR

0 72 336 15K 232

Download Video

ACE Responder @ACEResponder

3 months ago

Windows Logon Types #ThreatHunting #DFIR

4 89 422 30K 316

Download Image

Josh Lemon @joshlemon

5 months ago

Here's an update on the data breach of court documents from the NSW JusticeLink website. tl;dr - it was an individual that was able to download +9k documents over two months, it doesn't appear they were leaked anywhere publicly. theguardian.com/australia-news…

0 0 1 213 0

Josh Lemon @joshlemon

5 months ago

If you're running #Erlang systems with SSH it's time to start #ThreatHunting and assume breach. The #PoC for this exploit is simple to use and already in the wild.

SoteriaSec @SoteriaSec_io

5 months ago

If you're running #Erlang systems with SSH it's time to start #ThreatHunting and assume breach. The #PoC for this exploit is simple to use and already in the wild.