Finding CVEs that technically "don't exist" yet. 🕵️‍♂️

Ghost CVEs are live. A "Ghost CVE" is a vulnerability identifier that’s already popped up in the wild—think GitHub commits or security advisories—but is still listed as RESERVED or NOT_FOUND in official registries like NVD or MITRE.

It catches the threats that are already out there, even if the paperwork says they aren't. 📝💨

Admittedly, there are a lot more sources to add—this was just a quick weekend POV—but I plan on extending it soon.

Check out the latest ghost report here: https://github.com/RogoLabs/GhostCVEs/blob/main/reports/ghost_report.md

#InfoSec #ThreatIntel #OpenSource #GhostCVEs

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆

We use this tool internally to help track multiple threat actors with high confidence, improving attribution in many cases.

The tool has been released in the Proofpoint Emerging Threats public #GitHub for other defenders to leverage.

Learn more about it here: https://www.proofpoint.com/us/blog/threat-insight/proofpoint-releases-innovative-detections-threat-hunting-pdf-object-hashing

#PDF #threatdetection #cyberthreat

You all know is true. 😅

#DigitalForensics #MoblieForensics #DFIR

I was pleased to find out that my presentation, Free Triage Tools to Bolster Your IR Toolkit, https://www.magnetforensics.com/resources/free-triage-tools-to-bolster-your-ir-toolkit/ was among the top attended sessions of the 2023 Magnet Virtual Summit. If you missed it, you can view it on-demand with link above. Then check out all the highlights at
https://www.magnetforensics.com/blog/highlights-from-magnet-virtual-summit-2023/

Note: As of the newest version (4.0) CSIRT-Collect is now CyberPipe.
https://github.com/dwmetz/CyberPipe

#DFIR #PowerShell #Triage #CyberPipe

Quick blog post on #PowerShell forensic artifact: ConsoleHost_History.txt

Check it out: https://ecapuano.substack.com/p/powershell-artifact-consolehost_historytxt?sd=pf

#DFIR #ThreatHunting

Folks like @nnungest have been asking for an archive of my daily Linux DFIR command line challenges. And frankly I'm worried that I'm accidentally going to repeat myself if I don't have a reference handy. So I finally got started on creating an archive! The first (very) rough draft is at https://deer-run.com/users/hal/linux-daily.html

Aside from the obvious formatting deficiencies, I also haven't yet written the code to auto-update the archive. But at least it contains everything up to today's question. I'll keep plugging away at this as time allows, but I didn't want to wait for the "perfect" solution before posting something useful.