Pawb.Social Reports @transparency

3 posts1 participant0 posts today

Volexity :verified:In the course of its investigations, <a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@volexity</a> frequently encounters malware samples written in Golang. This reflects the increase in popularity of the Golang generally, and presents challenges to reverse engineering tools.   Today, <a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@volexity</a> is releasing GoResolver, open-source tooling to help reverse engineers understand obfuscated samples. <a href="https://infosec.exchange/@r00tbsd" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@r00tbsd</a> & Killian Raimbaud presented details at INCYBER Forum earlier today.   GoResolver uses control-flow graph similarity to identify library code in obfuscated code, leaving analysts with only malware functions to analyze. This saves time & speeds up investigations!   Check out the blog post on how GoResolver works and where to download it: <a href="https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/</a>   <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reversing</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malwareanalysis</a>

G0rb<a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> Webserver-Logs of Edge-Devices are really helpful sometimes.

0ddj0bb Is At CypherconHey <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#redteam</a> and <a href="https://infosec.exchange/tags/pentest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentest</a> ers, what security controlsnon endpoints and servers make your life miserable on an engagement? App allow listing? DEP? Powershell execution policies? Hostbased firewall?<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cyber</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a>

Alexandre DulaunoyThere is a new <a href="https://infosec.exchange/tags/Fediverse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fediverse</a> bot that facilitates web forensic analysis of websites.You can submit a domain for crawling by messaging <a href="https://social.circl.lu/@lookyloo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@lookyloo</a>, and it will respond with the analysis results.<a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> services is provided by <a href="https://social.circl.lu/@circl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@circl</a> 🔗 <a href="https://lookyloo.circl.lu" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lookyloo.circl.lu</a>Thanks to <a href="https://social.yoyodyne-it.eu/@rafi0t" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rafi0t</a> for the new bot.

r1cksecRecords an executable's network activity into a Full Packet Capture file (.pcap)🕵️‍♂️ <a href="https://github.com/H4NM/WhoYouCalling" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/H4NM/WhoYouCalling</a><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a>

DomainTools<a href="https://infosec.exchange/@hacks4pancakes" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hacks4pancakes</a> (<a href="https://infosec.exchange/@dragosinc" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dragosinc</a>) will join us on March 19 for our Foundations of DFIR panel! While that's a few weeks away, you can check out Lesley's blog post on The Shifting Landscape of OT Incident Response which illustrates the importance of specialized incident response and digital forensics in maintaining the security and integrity of OT systems. Find it here: <a href="https://www.dragos.com/blog/the-shifting-landscape-of-ot-incident-response/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.dragos.com/blog/the-shifting-landscape-of-ot-incident-response/</a>If you want to catch Lesley along with panelists <a href="https://infosec.exchange/@danonsecurity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@danonsecurity</a>, David Bianco, and Sarah Sabotka for unique insights on bolstering your DFIR foundations, save your spot here: <a href="https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-To-You" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_source=Mastodon&utm_medium=Social&utm_campaign=DFIR-To-You</a><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DigitalForensics</a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IncidentResponse</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a>

Vern McCandlishMe: How would you rate your incident response maturity?Them: This is the worn block of wood we knock on when discussing hypothetical situations.Me: Okay, so very mature.<a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/DFIRHumor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIRHumor</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/infosechumor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosechumor</a>

Mike ShewardMini Blue Team Diaries Story:At one time, I was responsible for security operations team at an app that had business travel booking capabilities. Flights, hotel etc. Because it was business travel, a lot of places had set up dedicated p-card's for travel booking expenses etc, rather than requiring employees or whoever to supply their own.We had a lot of customers who were higher education sector places, who at the time, used SSO from their University ID systems, but did not enforce MFA.What this led to, was a lot of phishing of those customer credentials - and then a lot of hopping into our system.One of our other features - was the ability for the end user to book 'guest travel', meaning an extra ticket or two for other people - not just themselves. That was an optional feature, but a lot of people enabled it.One fella discovered that if he got access to our system via phishing, and he found a target that had all the right things in place (p-card, guest booking), he could essentially book tickets and hotels wherever he wanted.Now, he wasn't always able to get away with it. Sometimes things would require an approver, sometimes, an employee would notice something and cancel it before the tickets were issued - so he shifted his MO to essentially book the tickets an hour and a bit before the flight left, so he could get people on planes ASAP.We of course advised all of our customers with SSO enabled to use MFA (and offered it ourselves). But, it was slow going at the time. So to help out we built a lot of detection capabilities. Abnormal IP's on logins would trigger alerts. Trips with guest booking enabled would trip other alerts etc - and we'd be able to shut it down. We (SecOps) got quite effective at picking these off in real time.Now, you're probably wondering - how did we know it was a fella, and how did we know his MO and why he did it the way he did?Well, the dude liked to travel himself, so his name would pop up in the attempted bookings more often than others.Then we found him online. He had a 'travel agency' business. So we called him up, and asked to book some travel. He explained how in order to get super cheap tickets, we'd need to go to the airport, and how sometimes (presumably because we'd mostly shut it down with our detections), his methods didn't work.Then we explained who we were. "Wow, yeah I've had a good run, time to move on to something else, good job to you," he said.So the lesson is - anyone can become a platform company that other people build businesses on.Read more stories like this at <a href="https://www.infosecdiaries.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.infosecdiaries.com/</a><a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blueteam</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a>

Volexity :verified:<a href="https://infosec.exchange/@volexity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@volexity</a> recently identified multiple Russian threat actors targeting users via <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#socialengineering</a> + <a href="https://infosec.exchange/tags/spearphishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spearphishing</a> campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: <a href="https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication/</a><a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/m365security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#m365security</a>

DomainToolsIn our upcoming presentation, our panel of experts will take us back to basics. We all know that "the threat landscape is changing rapidly," but have we paused to ensure our security practices are built on a solid foundation? If you're unsure, the answer is likely no. The good news is, we can change that.Join us as we delve into the PICERL Model (Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned) to review the essential foundations of Digital Forensics and Incident Response (DFIR). These fundamentals are crucial for effectively managing and mitigating cybersecurity incidents, yet they are often forgotten or overlooked.Our panel includes: 🔹<a href="https://infosec.exchange/@danonsecurity" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@danonsecurity</a>, CISO and Head of Investigations (DomainTools) 🔹<a href="https://infosec.exchange/@hacks4pancakes" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hacks4pancakes</a>, Technical Director of Incident Response (<a href="https://infosec.exchange/@dragosinc" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dragosinc</a>) 🔹<a href="https://infosec.exchange/@DavidJBianco" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@DavidJBianco</a>, Staff Security Strategist (@Splunk) 🔹Sarah Sabotka, Senior Threat Researcher (Proofpoint)📅 Date: March 19 🕒 Time: 10AM PT | 1PM ET 📍 Location: Online✅ Register here: <a href="https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_campaign=&utm_medium=social&utm_source=Mastodon&utm_content=DFIR-To-You" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.domaintools.com/webinar-getting-back-to-the-foundations-of-dfir/?utm_campaign=&utm_medium=social&utm_source=Mastodon&utm_content=DFIR-To-You</a>DomainTools will provide a document confirming your participation; however, CPE credit approval is not guaranteed. Credentialing organizations, such as ISACA or ISC2, may grant CPE credits for security educational courses if you provide proof of participation.<a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/PICERLModel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PICERLModel</a> <a href="https://infosec.exchange/tags/BackToBasics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BackToBasics</a> <a href="https://infosec.exchange/tags/CyberResilience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberResilience</a>

Tim (Wadhwa-)Brown :donor:Writing a forensics guide for routers and switches, big (corporate networks, service providers) and small (DSL, home wifi etc). What steps/tips would you recommend when performing DFIR? What would you like more ideas on? Where are the gaps?<a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blueteam</a>, <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a>, <a href="https://infosec.exchange/tags/networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#networking</a>, <a href="https://infosec.exchange/tags/routers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#routers</a>

Juliet Merida, Dum Tran Elf 🏳️‍⚧️Hey security folks! It's that time again... What's your definition of "incident" and why are the others wrong? What arguments have you had about your definition? <a href="https://merida.hair/tags/Cybersecurity" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://merida.hair/tags/InformationSecurity" rel="nofollow noopener noreferrer" target="_blank">#InformationSecurity</a> <a href="https://merida.hair/tags/DFIR" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a>

Jamie Levy 🦉We’re hiring a technical writer for my team here at <a href="https://infosec.exchange/@huntress" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@huntress</a> in case anyone is interested! Feel free to reach out with questions 😃<a href="https://infosec.exchange/tags/cti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cti</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://job-boards.greenhouse.io/huntress/jobs/6351695003" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://job-boards.greenhouse.io/huntress/jobs/6351695003</a>

Hal PomeranzLet me put this in <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> terms for you:Trump 45 was reconnaissance. Trump 47 is intrusion, persistence, and extraction.

Vern McCandlishI need to start a boutique <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> firm called "It Depends"

Tyler HudakI've had to analyze several MS Quick Assist compromises and found challenges during each one. Threat Hunting for malicious activity thru QA is not easy either. So I wrote a blog post on what to look for: <a href="https://inversion6.com/resources/blog/january-2025/microsoft-quick-assist-an-it-security-primer" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://inversion6.com/resources/blog/january-2025/microsoft-quick-assist-an-it-security-primer</a><a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/forensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#forensics</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/threathunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threathunting</a>

Chris Sanders 🔎 🧠Investigation Scenario 🔎A user workstation executed gpedit.msc for an unknown reason. What do you look for to investigate whether an incident occurred?<a href="https://infosec.exchange/tags/InvestigationPath" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InvestigationPath</a> <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOC</a>

Vern McCandlish<a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/DFIRMEMES" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIRMEMES</a> <a href="https://infosec.exchange/tags/INFOSECMEMES" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#INFOSECMEMES</a>

DEVCE CICWe are aware that there are some members of the digital evidence community who may be wary of, unwilling to, or unable to give evidence to the Parliamentary Inquiry into Computer Evidence (<a href="https://www.gov.uk/government/news/use-of-computer-evidence-in-court-to-be-interrogated" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.gov.uk/government/news/use-of-computer-evidence-in-court-to-be-interrogated</a> ). To ensure that their views & experiences can be properly represented, we are running a short survey ro capture essential information that we will submit to the Inquiry on behalf of respondents. All information will be anonymised and only used or reproduced with the consent of the contributors.The survey has been prepared by Angus Marshall with support from Prof. Sarah Morris and Simon Biles, for whose support we are very grateful.Please do complete the form at <a href="https://forms.gle/BwmDytnHT3z8pmCDA" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forms.gle/BwmDytnHT3z8pmCDA</a> . It should only take 10-20 minutes. Or if you prefer to email us: survey@devce.org<a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/DigitalForensics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DigitalForensics</a> <a href="https://infosec.exchange/tags/CJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CJS</a> <a href="https://infosec.exchange/tags/Law" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Law</a> <a href="https://infosec.exchange/tags/ComputerEvidence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ComputerEvidence</a> <a href="https://infosec.exchange/tags/Parliament" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Parliament</a> <a href="https://infosec.exchange/tags/Academia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Academia</a>

RDP Snitch2025-01-08 RDP <a href="https://infosec.exchange/tags/Honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Honeypot</a> IOCs - 350 scans Thread with top 3 features in each category and links to the full dataset <a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a>Top IPs: 68.183.88.109 - 200 185.42.12.81 - 16 185.170.144.198 - 16Top ASNs: AS14061 - 226 AS396982 - 24 AS59425 - 18Top Accounts: hello - 254 Administr - 24 Domain - 18Top ISPs: DigitalOcean, LLC - 226 Chang Way Technologies Co. Limited - 24 Google LLC - 24Top Clients: Unknown - 350Top Software: Unknown - 350Top Keyboards: Unknown - 350Top IP Classification: hosting - 248 Unknown - 64 proxy - 24Pastebin links with full 24-hr RDP Honeypot IOC Lists: <a href="https://pastebin.com/7emQHvAD" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://pastebin.com/7emQHvAD</a><a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSec</a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOC</a> <a href="https://infosec.exchange/tags/Blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Blueteam</a> <a href="https://infosec.exchange/tags/SecOps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecOps</a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a>

Recent searches

Search options

Administered by:

Server stats:

#dfir