owl @0wlSec

Blue Team. Security Engineer. GCFA. @rincon_security. United States Joined August 2018

Tweets

229
Followers

190
Following

830
Likes

8K

The DFIR Report @TheDFIRReport

4 years ago

If you're interested in helping with analysis and reporting please fill out this form and we'll get back with you. Thank you!! ➡️forms.office.com/r/WBCxqQcD2a The form will close on 11/22. 3/X

3 15 60 0 19

View Details

U.S. Coast Guard Southeast @USCGSoutheast

4 years ago

#SearchAndRescue @USCG crews are searching for 36-year-old Vitali Kremez, last seen wearing a black wetsuit and scuba tank while diving near #HollywoodBeach, Florida. Anyone with information is asked to call Sector Miami at (305) 535-4472.

19 129 255 0 17

View Details

Blue Team Thomas @TheEis4Extra

4 years ago

Here’s my quick an dirty lab workout for Detection Engineers. I do this work out 2 to 3 times a week for about 2 hours. #CyberSecurity #infosec #BlackTechTwitter

28 192 771 0 549

View Details

Nicole Carpenter @sweetpotatoes

4 years ago

Bayonetta’s original voice actor, Hellena Taylor, says she was offered $4K to voice the character in Bayonetta 3, which she turned down. She’s now asking fans to boycott the new game, which is scheduled for release later this month.

Hellena Taylor @hellenataylor

4 years ago

Friends, Worldlings, Bayonutters. Hear ye! #PlatinumGames #Nintendo #Bayonetta #Bayonetta3 #Bayonutters #Boycott #NintendoEurope #NintendoAmerica #NintendoJapan

5K 37K 172K 0 5K

307 3K 15K 0 601

View Details

Greg Linares (Laughing Mantis) @Laughing_Mantis

4 years ago

🔊 Since I have no exchange servers to protect, I converted the IOCs & scripts involved in #ProxyNotShell aka CVE-2022-41040 and CVE-2022-41082 into some boss battle EDM via ASCII to MIDI transcoding. Please enjoy & stay safe out there. Logo by the legend @GossiTheDog

4 27 104 0 7

View Details

Lesley Carhart @hacks4pancakes

4 years ago

No single magic black box alone would really have stopped it, either. A slew of tactical problems indicate a strategic problem.

5 13 188 0 3

View Details

TizzyEnt @TizzyEnt

4 years ago

The Patreon Problem Vol 2: It's worse than we thought.

219 2K 6K 0 535

View Details

Florian Roth ⚡️ @cyb3rops

4 years ago

TIL whenever you see an SSL certificate error and the browser doesn't let you continue - even on your own risk, you can just type 'thisisunsafe' to bypass the protection cybercafe.dev/thisisunsafe-b…

30 311 1K 0 329

View Details

Eric Capuano - Bsky: @eric.zip @eric_capuano

4 years ago

Alright OpenSOC fam — even though we’re not running the full contest this year, a couple of us @Recon_InfoSec are putting together a small DFIR challenge to keep your skills sharp 😎 stay tuned for more info, launching tomorrow. 🚀 #defcon #dc30

3 22 81 0 8

View Details

ghostlulz @ghostlulz1337

4 years ago

Cool blog on abusing callback functions to execute shellcode. There are so many windows APIs that can be leveraged to execute your shellcode. Really cool stuff! ropgadget.com/posts/abusing_… #redteam #infosec

3 192 618 0 202

View Details

Virus Bulletin @virusbtn

4 years ago

The DFIR Report describes an intrusion where IcedID was used as initial access vector, followed by discovery activity, Cobalt Strike, and in under 4 hours Quantum ransomware was remote executed with WMI & PsExec to other servers in the environment. thedfirreport.com/2022/04/25/qua…

0 16 31 0 9

View Details

owl @0wlSec

4 years ago

@GergelyOrosz Denying local admins is often the cheapest and easiest short-term solution for a company to reduce security risk, but that doesn’t mean it’s right when concerning developers. Environments should be architected so that a compromised developer workstation isn’t catastrophic.

0 0 1 0 0

View Details

owl @0wlSec

4 years ago

@GergelyOrosz I see both perspectives here. Local admin rights can pose a risk to the network at large. Local admins in many environments can read cached domain admin credentials and disable security controls. We need to find ways to promote agility and innovation while maintaining security.

1 0 1 0 0

View Details

Joe Desimone @dez_

5 years ago

We did a deep dive on the #WhisperGate #BleedingBear malware samples. New details on process hollowing technique used by the stage3 injector and method to terminate Windows Defender elastic.github.io/security-resea…

2 53 131 0 23

View Details

owl @0wlSec

5 years ago

@threathuntergrl Filco!

0 0 1 0 0

View Details

Omri Segev Moyal @GelosSnake

5 years ago

I thought the Messiah would come faster than this. Microsoft to disable macro by default in Excel 4.0

7 113 339 0 14

View Details

owl @0wlSec

5 years ago

@arekfurt I think this will work, tested against the limited number of samples I have using Set-ProcessMitigation

0 0 1 0 0

View Details

Brian in Pittsburgh @arekfurt

5 years ago

Is there any reason to think that having the ASR rule to block (or prompt on) creation of Office child processes deployed *wouldn't* break the Office 0day? In other words: If you have the ASR rule deployed in block mode, are you safe? docs.microsoft.com/en-us/microsof…