Thierry_4N6S 🇺🇦 (@thierry_4n6s) 's Twitter Profile
Thierry_4N6S 🇺🇦

@thierry_4n6s

ID: 538258738

calendar_today27-03-2012 15:45:47

7,7K Tweet

170 Takipçi

241 Takip Edilen

Nathan McNulty (@nathanmcnulty) 's Twitter Profile Photo

Oh hell yeah, this is cool! DeviceNetworkEvents | where RemoteIPType == "Public" | where InitiatingProcessVersionInfoOriginalFileName in (( externaldata ( Name:string ) [ "lolbas-project.github.io/api/lolbas.csv" ] with (format=csv, ignoreFirstRecord=true) | distinct Name )) #MDE

ANY.RUN (@anyrun_app) 's Twitter Profile Photo

🚨 #SliverC2 is a command-and-control framework widely used by threat actors 👾 It performs post-#exploitation activities and supports multiple connection protocols like #WireGuard Learn more and collect #IOCs & samples 🔗 any.run/malware-trends…

🚨 #SliverC2 is a command-and-control framework widely used by threat actors
👾 It performs post-#exploitation activities and supports multiple connection protocols like #WireGuard

Learn more and collect #IOCs & samples
🔗 any.run/malware-trends…
Dr.Philippe Vynckier, CISSP - Influencer 🇺🇦 (@pvynckier) 's Twitter Profile Photo

Malicious apps on Google Play: how threat actors use the DNS protocol to covertly connect trojans to C&C servers news.drweb.com/show/?i=14935&…

Kathryn Hedley (@4enzikat0r) 's Twitter Profile Photo

My #parseusbs #DFIR tool got a small update this week to fix an issue on Linux - now tested on Windows cmd/powershell, WSL (the best!), & Ubuntu Parse USB connection artifacts from a Windows volume, including registry & event log data (or offline hives) github.com/khyrenz/parseu…

Rudy Ooms | MVP 🇳🇱 (@mister_mdm) 's Twitter Profile Photo

Local Administrator Protection is Here!!!! At #Ignite2024 , #Microsoft finally officially announced the Local Administrator Protection feature for #Windows11! This game-changing update replaces traditional admin accounts with just-in-time privileges, securing admin rights like

Local Administrator Protection is Here!!!!

At #Ignite2024 , #Microsoft finally officially announced the Local Administrator Protection feature for #Windows11! This game-changing update replaces traditional admin accounts with just-in-time privileges, securing admin rights like
Zscaler ThreatLabz (@threatlabz) 's Twitter Profile Photo

Check out our technical analysis of #RaspberryRobin's multilayered approach to thwarting analysis and evading detection. Read the full technical analysis here: zscaler.com/blogs/security…

Check out our technical analysis of #RaspberryRobin's multilayered approach to thwarting analysis and evading detection.

Read the full technical analysis here: zscaler.com/blogs/security…
Cryptolaemus (@cryptolaemus1) 's Twitter Profile Photo

#BruteRatel - #Latrodectus - .pdf > url > .js > .msi > .dll wscript.exe Document-v20-19-06.js msiexec.exe /V rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface (1/3)👇 IOC's github.com/pr0xylife/Latr…

#BruteRatel - #Latrodectus - .pdf > url > .js > .msi > .dll

wscript.exe Document-v20-19-06.js

msiexec.exe /V

rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface

(1/3)👇

IOC's
github.com/pr0xylife/Latr…
Ali Hadi | B!n@ry (@binaryz0ne) 's Twitter Profile Photo

Reading NTFS Dataruns #DFIR #Filesystems This video explains how to locate and read NTFS dataruns in order to find the file clusters. It also covers parsing fragmented files and how to read their dataruns too. youtube.com/watch?v=6WFUM5…

Reading NTFS Dataruns #DFIR #Filesystems 

This video explains how to locate and read NTFS dataruns in order to find the file clusters. It also covers parsing fragmented files and how to read their dataruns too.

youtube.com/watch?v=6WFUM5…
Who said what? (@g0njxa) 's Twitter Profile Photo

A Windows #Clickfix alternative seen in the wild on a mass-spreading malware campaign bypassing traditional Win+R shortcut restrictions User is asked to open the Windows Power User menu (Win+X), open a Powershell terminal and paste and running a malicious Clickfix-style command

A Windows #Clickfix alternative seen in the wild on a mass-spreading malware campaign bypassing traditional Win+R shortcut restrictions

User is asked to open the Windows Power User menu (Win+X), open a Powershell terminal and paste and running a malicious Clickfix-style command
Ayush Anand (@securityinbits) 's Twitter Profile Photo

ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️ New variant drops Lumma after Defender exclusion: - Prompts for elevation till user accept - Add defender exclusion on %temp% - Drops & runs Lumma Multiple Sigma rules fired 💥 Process Tree👇

ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️

New variant drops Lumma after Defender exclusion:

- Prompts for elevation till user accept
- Add defender exclusion on %temp%
- Drops & runs Lumma

Multiple Sigma rules fired 💥

Process Tree👇