@cfp_time FYI your website seems down at the moment
• Security research and open source at Datadog
🇨🇭🇫🇷
| Website | https://christophetd.fr |
| GitHub | https://github.com/christophetd |
| 🪦 |
Christophe 
- 1.2K Followers
- 147 Following
- 304 Posts
• Cloud and container security
• Security research and open source at Datadog
🇨🇭🇫🇷
• Security research and open source at Datadog
🇨🇭🇫🇷
@moritz thank you, this was a useful read! I'm watching your repo closely 👀
@jerry Looks like it's back now!
@talsk Just seeing this now. You're a legend
@jerry Oh no! I hope you're wrong about this
@wietze This is so cool! Love ArgFuscator, would be cool to allow for an OS filter to generate commands working for Linux/Windows/Mac
WietzeBy making minor changes to command-line arguments, it is possible to bypass EDR/AV detections.
My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees.
Here’s what I found and why it matters 👉 https://wietze.github.io/blog/bypassing-detections-with-command-line-obfuscation
Bypassing Detections with Command-Line Obfuscation
Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that documents obfuscation opportunities and generates obfuscated command lines.
New research: We've been monitoring a threat actor publishing dozens of trojanized GitHub repositories targeting threat actors, leaking hundreds of thousands of credentials along the way
https://securitylabs.datadoghq.com/articles/mut-1244-targeting-offensive-actors/
Getting a taste of your own medicine: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials | Datadog Security Labs
This post describes an in-depth investigation by Datadog security researchers into a threat actor dubbed MUT-1244, which targets other malicious actors as well as security practitioners and academics.
Rory McCuneSome interesting research by my colleague @christophetd on default service accounts in GCP. Looks at how default rights can be in place and some of the risks to GKE environments.
https://securitylabs.datadoghq.com/articles/google-cloud-default-service-accounts/
New blog post: A SaaS provider's guide to securely integrating with customers' AWS accounts
https://securitylabs.datadoghq.com/articles/securely-integrating-with-customers-aws-accounts/
