Head of Investigations @InfoGuardAG https://xitter.cf/t.co/A5lnFAu7eX

Joined October 2012
Stephan Berger retweeted
New research: We audited SEPPmail's virtual appliance & found critical issues. Our post covers CVE-2026-2743 (RCE via syslog.conf) & CVE-2026-44128 (Perl injection) that let attackers read all mails or compromise the appliance. -> labs.infoguard.ch/posts/sepp…
1
17
28
3,702
Stephan Berger retweeted
Unveiling Ghost-Sender: a widespread and dangerous Microsoft Exchange Online default misconfiguration exposing thousands of targets (incl.F500) to arbitrary mail spoofing. Read on labs.infoguard.ch/posts/ghos… Assess yourself ghost-sender.com
1
8
1
17
1,380
Stephan Berger retweeted
🎯#BruCON0x012 Spring Training (22-24 April) is almost here! Want to learn exploit development, evasion techniques for red teams or anti-forensics, check out the program 👇 💡Register before the end of March. Late registration kicks in three weeks before the event, so don’t miss your chance to save your seat and your budget. 👉 Check out the full training lineup and grab your ticket brucon.org/training
2
5
996
Stephan Berger retweeted
Are you an Incident Responders and want to learn about Anti-Forensics (and Anti-Anti-Forensics😀) ? Check out this hands-on course course, giving you a real-world deep dive into attacker's tradecraft across Windows & Linux. Learn how adversaries hide, and how to detect, recover, and counter them using modern forensic techniques and artifacts. More information and registration ➡️brucon.org/training-details/…
6
16
1,680
Stephan Berger retweeted
Still searching for the perfect Valentine’s gift? 😉 Show your love (for cybersecurity!) with our #BruCON0x12 Spring Training program — featuring Blue💙, Purple💜, and Red 💖Team courses. To celebrate the season, we’re extending our early-bird registration until Valentine’s Day! 💘 Don’t miss out — check out the full program and sign up ➡️ brucon.org/training
3
2
4
1,263
Stephan Berger retweeted
🚀 Ready to up your #cybersecurity game? Join the #BruCON0x12 Spring Training (Apr 22–24) — a powerful mix of 5 Red, Blue or Purple team courses taught by top experts. 💡 Early bird pricing until Feb 12 — grab your seat! 🔗 brucon.org/training
1
3
7
1,034
Stephan Berger retweeted
I recently reviewed a PingCastle report from a customer and noticed the image below. The image indicates that "EVERYONE" has indirect control over most high-privilege groups. Do yourself a favour and run a PingCastle and/or BloodHound every now and then.
1
8
3
50
11,519
Stephan Berger retweeted
Great news to kick off your Monday! 🎉 The #BruCON0x12 Spring Training program (22–24 April) is now open for registration. Whether you’re into red, blue, or purple teaming, there’s a spot for you in one of our 5 hands-on courses. 🚀 Secure your seat and grab the early-bird pricing by registering before February 13th. 👉 All details and registration here: brucon.org/post/brucon-0x12-…
2
3
1,153
Stephan Berger retweeted
🎄 Happy Holidays from BruCON! 🎄 We’ve wrapped up the selection of courses for Spring Training 2026 (22-24 April) and are excited to share the program with you soon. Stay tuned for updates! #BruCON0x12
3
7
950
Stephan Berger retweeted
SpecterOps@SpecterOps30 Oct 2025
That feeling when your PowerShell syntax error almost deletes Global Admin. 🫠 @FKasler shares a cautionary tale on why you should always read the docs when you are about to issue a “DELETE” operation on any resource in your client’s infrastructure. ghst.ly/3X2bTZ4
12
1
34
5,232
Stephan Berger retweeted
#BSidesBerlin Speaker Showcase @malmoeb will dissect Mythic—a modern macOS attack framework—covering C2 comms, persistence, OPSEC tricks, and detection paths. Get your tickets here👉 bsides.berlin @SecurityBSides #RedTeam #macOS
3
9
1,557
Microsoft-Analyzer-Suite v1.5.0 is now available!🚀 We improved among other things the Device Code Flow Abuse detections and added support for the detection of suspicious 'UpdateInboxRules' operations (e.g. used by eM Client). Check out the changelog for more information and don't forget to follow LETHAL FORENSICS on X and LinkedIn. Happy M365 Threat Hunting! xitter.cf/LETHAL_DFIR linkedin.com/company/lethal-… @InvictusIR #M365 #Entra #BEC #CloudIncidentResponse #DFIR #Microsoft #Security github.com/LETHAL-FORENSICS/…
6
20
1,926
Stephan Berger retweeted
Could you all take a moment to check that UAL is enabled on your M365 tenant? The IR team will really appreciate it later!
2
4
22
2,044
Stephan Berger retweeted
I am reposting my old post as a reminder to regularly check which UserAgents are logging into your tenant. In more recent instances, we have noticed that TAs are using tools with the following as part of their toolkit: 'node-fetch/1.0 (+github.com/bitinn/node-fetch)' 'GuzzleHttp/7'
Analyzed a phishing case in M365: attacker bypassed MFA using axios HTTP client, leaving a telltale "axios/1.7.7" in sign-in logs. Lesson: regularly check sign-in logs for unusual user-agents to spot suspicious activity.
1
19
87
11,360
Stephan Berger retweeted
I just released Microsoft-Analyzer-Suite v1.3.0. UserAgent Blacklist added, ClientInfoString and Mailbox Synchronization detection of eM Client (Traitorware) added, and much more. Happy M365 Threat Hunting! @InvictusIR #M365 #Entra #BEC #DFIR github.com/evild3ad/Microsof…
25
72
5,211
Stephan Berger retweeted
Teaser: Microsoft-Analyzer-Suite v1.2.0 will detect the new Device Compliance bypass technique via Microsoft Intune Company Portal Check out: labs.jumpsec.com/tokensmith-… quzara.com/blog/bypass-intun…
5
53
2
224
33,774