😈 [ hackinarticles, Hacking Articles ]
Memory Hunting
Credit https://t.co/OHtDiELsy5
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #bugbountytips #forensics #dfir
🔗 https://github.com/christophetd/mindmaps/blob/master/pdf/memory-hunting.pdf
🐥 [ tweet ]
Memory Hunting
Credit https://t.co/OHtDiELsy5
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #bugbountytips #forensics #dfir
🔗 https://github.com/christophetd/mindmaps/blob/master/pdf/memory-hunting.pdf
🐥 [ tweet ]
👍1
😈 [ hackinarticles, Hacking Articles ]
Incident Response Cheat Sheet
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #dfir #incidentresponse
🐥 [ tweet ]
Incident Response Cheat Sheet
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #dfir #incidentresponse
🐥 [ tweet ]
😈 [ bmcder02, Blake ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
Recently I got asked to do an overview on ETW. I tried to cover everything useful for #DFIR, including multiple ways to capture ETW, useful providers and finding existing trace sessions.
#cybersecurity
https://t.co/3IWn9w6JuQ
🔗 http://bmcder.com/blog/a-begginers-all-inclusive-guide-to-etw
🐥 [ tweet ]
😈 [ DirectoryRanger, DirectoryRanger ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction #DFIR
https://t.co/8BZPvX83Ij
🔗 https://jeffreyappel.nl/detect-and-block-credential-dumps-with-defender-for-endpoint-attack-surface-reduction/
🐥 [ tweet ]
😈 [ ntlmrelay, Ring3API ]
📌Dismember tool by @liam_galvin - scan memory for secrets and more.
⚙️https://t.co/3anDqypiVb
#redteam #BlueTeam #threathunting #DFIR
🔗 https://github.com/liamg/dismember
🐥 [ tweet ]
📌Dismember tool by @liam_galvin - scan memory for secrets and more.
⚙️https://t.co/3anDqypiVb
#redteam #BlueTeam #threathunting #DFIR
🔗 https://github.com/liamg/dismember
🐥 [ tweet ]
😈 [ cfalta, Christoph Falta ]
I wrote something to compare the content of two volume shadow copies. Let's hope that's useful 😅 #dfir #PowerShell
https://t.co/ip15QPFaTq
🔗 https://github.com/cfalta/vsctool
🐥 [ tweet ]
I wrote something to compare the content of two volume shadow copies. Let's hope that's useful 😅 #dfir #PowerShell
https://t.co/ip15QPFaTq
🔗 https://github.com/cfalta/vsctool
🐥 [ tweet ]
😈 [ ntlmrelay, Ring3API ]
📌How Does Windows Execute Shortcuts (.LNK)? - by @LabsSentinel
➡️https://t.co/azJmSz7A5T
#BlueTeam #ThreatHunting #DFIR
🔗 https://www.sentinelone.com/labs/who-needs-macros-threat-actors-pivot-to-abusing-explorer-and-other-lolbins-via-windows-shortcuts/
🐥 [ tweet ]
📌How Does Windows Execute Shortcuts (.LNK)? - by @LabsSentinel
➡️https://t.co/azJmSz7A5T
#BlueTeam #ThreatHunting #DFIR
🔗 https://www.sentinelone.com/labs/who-needs-macros-threat-actors-pivot-to-abusing-explorer-and-other-lolbins-via-windows-shortcuts/
🐥 [ tweet ]
😈 [ an0n_r0, an0n ]
not a new one, but might be useful: Detecting Lateral Movement (and other) techniques through Event Logs by @jpcert_en
https://t.co/xIyta9ZESK
#DFIR
🔗 https://jpcertcc.github.io/ToolAnalysisResultSheet/
🐥 [ tweet ]
not a new one, but might be useful: Detecting Lateral Movement (and other) techniques through Event Logs by @jpcert_en
https://t.co/xIyta9ZESK
#DFIR
🔗 https://jpcertcc.github.io/ToolAnalysisResultSheet/
🐥 [ tweet ]
😈 [ k1nd0ne, k1nd0ne ]
I am happy to release a new malware analysis tool.
VISION-Process.
A fast and cross platform Procmon visualization application written in Rust & TS.
https://t.co/M3GBy3Udb7
An demo with QBOT :
https://t.co/MruSaVYG2H
Happy Hunting !
@pr0xylife #DFIR
🔗 https://github.com/forensicxlab/VISION-ProcMon
🔗 https://www.forensicxlab.com/posts/vision-procmon/
🐥 [ tweet ]
I am happy to release a new malware analysis tool.
VISION-Process.
A fast and cross platform Procmon visualization application written in Rust & TS.
https://t.co/M3GBy3Udb7
An demo with QBOT :
https://t.co/MruSaVYG2H
Happy Hunting !
@pr0xylife #DFIR
🔗 https://github.com/forensicxlab/VISION-ProcMon
🔗 https://www.forensicxlab.com/posts/vision-procmon/
🐥 [ tweet ]
😈 [ Renzon @r3nzsec ]
I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir
🔗 https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/
🐥 [ tweet ]
I recently co-authored a @Unit42_Intel blog about a unique IR case in which a threat actor’s custom EDR bypass (using #BYOVD) exposed their toolkit, methods, and even identity. Check out how we unmasked them through an opsec slip-up! #dfir
🔗 https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/
🐥 [ tweet ]
👍4😁2