#DFIR Analyst | Ex Red Teamer | CTF player with @tipi_hack | #OSCP | #GXPN | #GCFA | #LethalForensicator
Joined November 2012
- Tweets1.6K
- Following722
- Followers391
- Likes1.3K
Mr B0b retweeted
⚠️ Use Microsoft Teams? Watch out for TeamsPhisher!
While it is not usually possible to send files to MS Teams users outside your org, by security researchers found a bypass by manipulating Teams web requests 🔥
github.com/Octoberfest7/Team…
Examples of MS Teams phish lures ⬇️ 1/3
Mr B0b retweeted
I'm happy to introduce AC&CD!
You are detecting the wrong C2 beaconing traffic(and I was, too, long ago), so I've fixed it and put it in a Jupyter Notebook! Wanna detect Cobalt Strike, Sliver, Mythic, and all known C2 frameworks' beaconing?
#ThreatHunting
github.com/Cyb3r-Monk/ACCD
Mr B0b retweeted
Microsoft has been published a #TokenTheft playbook which includes investigation checklist, hunting queries, response/recovery task list but also accompanying decision tree. A must read for every #AzureAD, #Entra, #SecOps admin and architect.
learn.microsoft.com/en-us/se…
Mr B0b retweeted
🚨 Over 250,000 Fortinet firewalls publicly accessible on the Internet.
They just dropped a patch for a major Remote Code Execution vulnerability.
...and then announced the vuln may have been used in attacks already.
Lets dive in 👇
Mr B0b retweeted
At @falconforceteam we love automation. We apply this to a lot of our processes, including Detection Engineering. We will be sharing our internal tooling for validation, deployments etc as open source software.
Enjoy our first blog, written by @gijs_h
medium.com/falconforce/deplo…
Nice blog post from @g3rzi (@CyberArk)
👉Breaking Docker Named Pipes SYSTEMatically: Docker Desktop Privilege Escalation – Part 1 cyberark.com/resources/threa…
Mr B0b retweeted
MIT Introduction to Deep Learning - 2023 Starting soon!
MIT Intro to DL is one of the most concise AI courses on the web that cover basic deep learning techniques, architectures, and applications.
2023 lectures are starting in just one day, Jan 9th!
introtodeeplearning.com
Mr B0b retweeted
Free cloud training workshops 🚨
AWS CIRT announces the release of five publicly available workshops | AWS Security Blog aws.amazon.com/blogs/securit…
Mr B0b retweeted
I'm proud to announce that we've just open sourced a four day Rust course I've been working on! Read it here: google.github.io/comprehensi…
#rust #rustlang #android
Mr B0b retweeted
Demonstrating CVE-2022-37958 RCE Vuln. Reachable via any Windows application protocol that authenticates. Yes, that means RDP, SMB and many more. Please patch this one, it's serious!
securityintelligence.com/pos…
Mr B0b retweeted
THREAT HUNTING PLAYBOOK
LEARN HOW TO EMBRACE A PROACTIVE SECURITY POSTURE
github.com/blackorbird/APT_R…
Are you also preparing a way out on #Mastodon (just in case @elonmusk messes up) ?
He is a quick and dirty #mastodonmigration way to generate a csv file of your Twitter followings handles to be imported on Mastodon all at once. 🧵
1/6
7. Download the `twitter_to_mastodon.sh` gist.github.com/Mr-B0b/93faf… bash script and replace `<curl_bash_command>` with the modified curl bash command line
8. Run the bash script (you'll need the @TomNomNom amazing github.com/tomnomnom/gron tool to parse json files)
5/6
Mr B0b retweeted
A lot has been said about removing hooks and kernel callbacks to stop an EDR from detecting malicious activity.
What if we could terminate the process completely?
Well ...we can.
Check this out:
spikysabra.gitbook.io/kernel…
Mr B0b retweeted
Here we go, we are finally releasing all the materials of our workshop at @defcon and our talk at @BSidesLV on “CI/CD : The new Eldorado” 🔥🔥🔥
With this content, you will go through… 🧵
github.com/wavestone-cdt/DEF…
Mr B0b retweeted
Chromium's application mode can be used to easily build realistic phishing desktop applications. Enjoy.
mrd0x.com/phishing-with-chro…
