[Threatview.io]⚡️Glad to see #cobaltstrike detections based on ioc’s detected by our scanner present in Suricata Signatures - “ET Threatview.io High Confidence Cobalt Strike C2”

🚀 More new detection rules updated for c2 & #phishing

#dfirreport

https://thedfirreport.com/2024/08/26/blacksuit-ransomware/

Woah @TheDFIRReport has an audio version of their latest report      

#security #dfirreport #audio

The DFIR Report folks released one of their private/paid reports related to the recent WS_FTP vulnerability. A glimpse into a whole company being run like an easy difficulty Hack the Box machine.

https://thedfirreport.com/wp-content/uploads/2023/11/WS_FTP-Exploit-Activity-leads-to-Sliver.pdf

#dfirreport #hacking #redteam #pentesting

Here's a handy script to gather up hashes for all Rclone releases, along with the current results.

https://gist.github.com/rmceoin/efedac0f86884dea548dc757b4a885ef

The recent year in review by #DFIRReport has a ton of great intel and as I've seen many times before rclone is called out. It is frequently used for exfil.

So, along with other tools, rclone has been on my hit list to chase down the hashes and see what our defenses think of them and if used internally.

It turns out Rclone is on GitHub and appears to host the last several years of releases there. With a little GitHub and Bash magic out pops all the recent hashes. I stayed focused just on the Windows hashes.

No doubt a TA would pivot to another method, but the hope would be it'd delay them and help set off more alarms as they bump around.

#ThreatIntel

Last spam toot and then I need to get into the projects, the new #dfirreport is out!

https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/