Threat Hunting your network has never been so awesome! Creators of AC-Hunter. Contact us for a personal Q&A session.
Joined February 2018
- Tweets755
- Following297
- Followers4.1K
- Likes678
Thanks to everyone who stopped by the Active Countermeasures booth at Wild West Hackin' Fest! We loved chatting threat hunting with you, and we hope you’re rocking your new Threat Hunter shirt (and maybe still trying to land every ring in that water game).
Until next time!
There's a new sheriff hunting threats in town. 🤠 Catch the Active Countermeasures crew at Wild West Hackin' Fest in the vendor hall on Wednesday!
Active Countermeasures retweeted
Thanks to our sponsor, Active Counter Measures, for supporting the Threat Hunting Summit and helping defenders improve. Join ACM's lunch hour learning session: learning.antisyphontraining.…
Active Countermeasures retweeted
Friendly reminder: The Threat Hunting Summit is free, speakers are ready, and the agenda is packed. Join us June 17 for expert talks and practical insights. Register here: learning.antisyphontraining.…
Detection often relies on consistency. ZetaSwitch relies on the opposite. By pivoting between DNS and HTTP, this C2 creates a moving target for defenders. We simulated the traffic with @faanross to show how to hunt this hybrid threat.
Read more: activecountermeasures.com/ma…
Defenders watch one channel. Numinon C2 uses two. By splitting traffic between HTTP and DNS, it hides in plain sight. We simulated and analyzed the traffic with @faanross to see how it bypasses detection.
Read: activecountermeasures.com/ma…
Is your DNS traffic hiding active C2? Join @faanross to learn how attackers abuse TXT records to bypass common tunneling detections.
Reminder: Chat is in the BHIS Discord #live-chat for HACK IT credit.
Date: Feb 20
Time: 12:00 PM EST
Register: events.zoom.us/ev/Aqb16UU6sZ…
A predictable heartbeat is easy to find. Merlin C2 uses data jitter to make its pulse irregular and invisible. @faanross simulated and analyzed the traffic to show why it hides so effectively.
Read: activecountermeasures.com/ma…
IP blocks fail when an attacker has trillions of identities. IPv6 address aliasing turns one host into a ghost. We simulated and analyzed this traffic with @faanross to help you hunt the technique. activecountermeasures.com/ma…
The ocean is vast. Without a compass, you aren't sailing; you’re drifting.
Network security is the same. Even with the best ship, if you lack a map, you're lost at sea.
Turn MITRE ATT&CK from a bingo card into your roadmap.
New from @faanross: activecountermeasures.com/th…
An IcedID loader is often just an open door for ALPHV ransomware. @faanross simulated the attack and analyzed the traffic to pinpoint the pivot. Recognition is the key to defense.
Read here: activecountermeasures.com/ma…
The signal evolved, but the hunt remains. @faanross simulated and analyzed complex C2 beaconing to reveal the unusual ways traffic hides in plain sight. This insight is what turns the tide for defenders.
Read Part 2: activecountermeasures.com/ma…
The adversary hides in the encryption you provide. When DNS goes dark, defenders go blind. @faanross simulated and analyzed the traffic to find the signal.
activecountermeasures.com/ma…
Malware doesn't scream; it whispers in a rhythm. @faanross simulated and analyzed C2 traffic to decode these hidden heartbeats. Recognizing the pattern is how you find the breach.
Read here: activecountermeasures.com/ma…
A clock sync seems harmless until it becomes a backdoor. @faanross explores how Gomesa hides C2 in NTP traffic. We simulated and analyzed this traffic to reveal what defenders often miss.
activecountermeasures.com/ma…
An algorithm finds the hash, but it can't find the why. When attackers pivot, they aren't just changing code they're testing your intuition. Automation has a ceiling; human hunting doesn't. Learn why context is the key to the game: activecountermeasures.com/co…
What happens when DFIR tools are used for harm? Join Episode 6 of Command & Convo this Friday to see how threat actors misuse Velociraptor for C2.
As part of our hunt-it program, join the new chat location here: discord.com/invite/BHIS
Register here: events.zoom.us/ev/Ak_PCWcDND…
We simulated the traffic to see what your logs won't show. Microsoft Dev Tunnels allow RDP to blend into legitimate streams, bypassing standard blocks. See @faanross's analysis on how to detect this hidden activity:
activecountermeasures.com/ma…
What happens when legitimate DFIR tools are used for harm? Join Episode 6 of Command & Convo to see how threat actors misuse Velociraptor for C2 and how to hunt for these pivots.
Date: Jan 9 Time: 1:00 PM EST Register: events.zoom.us/ev/Ak_PCWcDND…
A simple tool in the wrong hands becomes a silent backdoor. We simulated XenoRAT to analyze its SOCKS5 reverse proxy techniques. For defenders, spotting these patterns is vital to stopping the threat. Read the analysis by @faanross: activecountermeasures.com/ma…