Security Researcher @ Palo Alto Networks
ישראל
Joined February 2017
- Tweets23
- Following195
- Followers26
- Likes24
Just finished @codemachineinc 's Windows Rootkit Techniques course, hands down, the best training I've ever taken.
I recommend to anyone to attend at least one of T.roy's courses during his lifetime.
A Thousand (4) ways of COM Hijacking explained :)
221bluestreet.com/in-depth-a…
If you guys are into Windows Component Object Model (COM) ; or always wanted to understand it, I've made a nice primer for COM, very detail with many examples to cover the black magic that surrounds this tech :))
221bluestreet.com/knowledgeb…
221BlueStreet retweeted
I've just discovered this amazing document showing super clearly the relation between the opcode and the instruction 🤯
pnx.tf/files/x86_opcode_stru…
221BlueStreet retweeted
Active Directory "WriteOwner" DACL abuse, now in Python 🐍
github.com/SecureAuthCorp/im…
And icymi, "WriteDACL" abuse, also in Python now 🐍
github.com/SecureAuthCorp/im…
One DACL abuse is left implementing, "Logon script"
221BlueStreet retweeted
🚨 #Python for security investigations, research & threat hunting?
🪵 Collect 👔 Enrich 🔍Analyze & 📊Viz data!
💸 oh.. & for free! open source!
The amazing @ianhellen @MSSPete @ashwinpatil 'll show how to w/ MSTICpy 🔥@BlackHatEvents #BHUSA
Arsenal: blackhat.com/us-20/arsenal/s…
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Security\Trusted Documents
=======
You can also specify the trusted path as "C:\"
and add a value that trusts all sub-folder of the trusted directory:
...\Word\Security\TrustedLocations\Location01\AllowSubFolders
Super Excited :D:D
🚨 Organizing an Infosec Jupyterthon on 5/8 🚀 An open virtual community event for security researchers to share their favorite @ProjectJupyter #notebooks w/ the Infosec 🌎 Share & meet other Infosec Jovyans!
Site: infosecjupyterthon.com
Call for 📔: bit.ly/InfosecJupyterthonCFN
A lot of new #cloud techniques were added to #mitreattack matrix, along with additional new and updated techniques.
In the update you can even find my own recent contribution regarding the office persistence technique I recently published an article about
attack.mitre.org/techniques/…
221BlueStreet retweeted
We probably had a little too much fun making our new marketing video but we love the end result. Get the full picture of everything that the LimaCharlie Security Infrastructure as a Service can do.
Watch the video here: youtu.be/mxAxIn3E2Ew
#infosec #mssp #cybersecurity #edr
Meet OSSEM, another great project by @Cyb3rWard0g , the project's goal is to maintain and standardize a Common Information Model for different events data sets.
It also aims at having a data dictionaries for each data set source (Sysmon, WinEvt, EDR's)
github.com/Cyb3rWard0g/OSSEM
A rough overview of how EDR products works and couple of notes about EDR weaknesses that are common in multiple EDR vendors.
Nice read
christopher-vella.com/2019/0…
221BlueStreet retweeted
Sharing one of my obfuscation detection #YARA rules with the community
PowerShell Caret Obfuscation
> note the fixed 3byte atoms at the beginning & end of $s1 & $s2
> necessary to improve regex performance
Rule
github.com/Neo23x0/signature…
Retrohunt + Munin
docs.google.com/spreadsheets…
🚨New Research - T1137 Office Start-up Application🚨
New Microsoft Office persistence technique implementation!
#microsoftoffice #persistence #t1137 #blueteam #cybersecurity #mitre #cyber #officetemplates #GlobalDotName
bit.ly/2IYmYEb
📢New Stealthy Office Persistence Technique📢
Tomorrow night I'll be publishing a new article about a persistence technique in Microsoft's Office. An in-depth explanation of inner workings of Word and a new stealthy implementation! Excited!
#Persistence #T1137 #ThreatResearch