Security Engineer focused on (Malware Analysis|DFIR|CTI). ☣
Always on a learning curve. Linux enthusiast
| twitter.com/DGSecNet | |
| Malware Analysis | Malware Analysis |
| DFIR | DFIR |
| Threat Hunting | Threat Hunting |
MITRE has some big plans for this year:
https://medium.com/mitre-attack/2023-attack-roadmap-452fab541673
#ThreatIntel #ThreatHunting #MITRE #TTP
RT @assume_breach
Here's an easy example of the OneNote malware craze.
I just published Home Grown Read Team: Let’s Make Some OneNote Phishing Attachments https://link.medium.com/leWiGFpzexb
RT @DissectMalware
Let me introduce you to #pyOneNote v0.0.1; a pure python library to parse #one file format:
https://github.com/DissectMalware/pyOneNote
Covers 20 out of 38 FileNode types
E.g.: .one in 835239c095e966bf6037f5755b0c4ed333a163f5cc19ba0bc50ea3c96e0f1628
While tracking some prevalent commodity malware threat actors, Talos observed the popularization of malicious LNK files as their initial access method to download and execute payloads. A closer look at the LNK files illustrates how their metadata could be used to identify and track new campaigns.
Looks like more #malvertising related to the #IcedId campaign. Safe to block any domain hosted at 31.41.244.55
qweiaoer[.]online
israelifrenchbulldogs[.]com/teamviewer/
Awesome blog series by @svch0st on Event Log Tampering.
It seems #Gamaredon #APT has operated a phishing campaign to target Security Services of Ukraine (http://ssh.gov.ua)
email subject:
Щодо зіпсуття військово-облікових документів СБУ
(Regarding the corruption of SBU military accounting documents)
1265_09.12.2022.7z
1ffb409a8d8e395d969193e93b66419e
Щодо зіпсуття військово-облікових документів та їх втрату з небрежності співробітниками СБУ.lnk
f72c9718260c96c77d1e0be91b30fcbf
https://dwn-files[.]shop/12.12_sb/rehearsal.rtf
HackerNews
Taylor Parizo
SANS Internet Storm Center - SANS.edu - Go Sentinels!
Philippe Lagadec
Virus Bulletin
Jérôme Segura
Eric Capuano
Jazi