ForensicGeek @GeekForensic

DFIR Joined September 2016

Tweets

151
Followers

68
Following

644
Likes

252

ForensicGeek @GeekForensic

4 years ago

@quironsalud que ha ocurrido con los usuarios y passwords del portal del paciente?

0 0 0 0 0

View Details

El Enemigo Anónimo @EnemigoAnonimo_

5 years ago

¿Te imaginas un hospital que no puede recibir ambulancias ni dar medicamentos a sus recién operados porque está sufriendo un ciberataque? No te lo imagines, es real y ha pasado en España #TrabajaEnCiberseguridad #IMFxDeloitte youtu.be/ick1vssO0TU

1 8 17 0 1

View Details

Florian Roth ⚡️ @cyb3rops

5 years ago

Experience taught me that you only discover the true strength of your team and their tools in a real incident - sadly, there is no better teacher Only in their first domain-wide incident most orgs get …

11 91 477 0 64

View Details

Deloitte España @Deloitte_ES

5 years ago

Diario de un Incident Responder es una serie de artículos en los que el equipo de DFIR, Digital Forensics & Incident Response, de Deloitte explica cómo atiende incidentes de ciberseguridad. Conoce cómo solventaron un ataque de Ransomware: deloi.tt/3g31lUj

0 6 6 0 1

View Details

ForensicGeek @GeekForensic

5 years ago

@antoniosanzalc La revisión de logs de AV es algo que se debería de tomar como dogma a la hora de tirar para atrás en un IR. Suelen dar buenas pistas!

0 0 1 0 0

View Details

ForensicGeek @GeekForensic

5 years ago

@antoniosanzalc Cooorreeectooo, a eso me refería justamente, que las credenciales siguen activas. Nos pasó igual y la fuente fue la vuln parcheada pero las creds no... maravilloso

0 0 0 0 0

View Details

ForensicGeek @GeekForensic

5 years ago

@AltShiftPrtScn We have found a similar trace but instead of AnyDesk they deploy UltraVNC(.)bat

0 0 1 0 0

View Details

Vitali Kremez @VK_Intel

5 years ago

2021-08-05: 🆕🔥Introducing #BlackMatter #Ransomware x64 Linux Variant | esxcli variant | usual BlackMatter struct ➡️ “bot_id” | “bot_company” 1⃣Custom C Methods: /// esxi_utils files_proc file_encrypter setup_impl web_reporter /// 2⃣Encryption Mode | dark/white/min-size

MalwareHunterTeam @malwrhunterteam

5 years ago

Another Linux ransomware sample that is using esxcli: 6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502 File is simply named "Linux.Encryptor"... cc @VK_Intel @demonslay335

3 32 89 0 5

3 34 90 0 7

View Details

John Lambert @JohnLaTwC

5 years ago

#HuntingTipOfTheDay If you know net.exe, you may know it calls net1.exe. Why?🤔net1.exe had Y2K fixes🗓️. It is still included for compatibility. Hunt for parent processes of net1 other than net. You may catch something 😀 📎hejox.se/sitedocs/windo… 📎docs.microsoft.com/en-us/previous…

3 78 218 0 44

View Details

ForensicGeek @GeekForensic

5 years ago

@s3ik0tr0n Jajajaja, lleva conmigo desde entonces!!! Gusto leerte señor!!! Por Tokyo andamos a ver como se portan los malos...

1 0 1 0 0

View Details

ForensicGeek @GeekForensic

5 years ago

#tokyo2020 #DFIR 💪💪💪

1 1 2 0 0

View Details

ForensicGeek @GeekForensic

5 years ago

0 0 2 0 0

View Details

ForensicGeek @GeekForensic

5 years ago

Go Go Go!!! Defenders!!!

0 0 2 0 0

View Details

Red Canary, a Zscaler company @redcanary

6 years ago

Seeing some interesting #Gootkit activity of late, with new tradecraft deviating slightly from historical observations. This thread includes descriptions of behavioral analytics that might offer security teams opportunities for detection. #RCintel

1 5 10 0 0

View Details

ForensicGeek @GeekForensic

6 years ago

@antoniosanzalc Lo mejor es que vayan poniendo en todos sus correos una cabecera en la que indiquen que esa conversación puede y será auditada por terceros

0 0 1 0 0

View Details

Ring3API 🇺🇦 @ntlmrelay

6 years ago

🔥#CVE-2020-1472 Netlogon Elevation of Privilege Vulnerability (All in One) ➡️[BLOG]:secura.com/blog/zero-logon ➡️[PoCs]:x.com/_dirkjan/statu… ➡️[LOGS]:x.com/SBousseaden/st… ➡️[DETECT]:x.com/andriinb/statu… #threathunting #blueteam #SOC #Vulnerability #Microsoft #Windows

Andrii Bezverkhyi @andriinb

6 years ago

#sigma rule for CVE-2020-1472 Netlogon MS-NRPC is out, free community access tdm.socprime.com/tdm/info/FgNYL… Detection works using #Zeek / @corelight_inc network data #CVSS10 #CVE20201472 #blueteam #Vulnerability

1 24 39 0 4

7 84 140 0 21

View Details

Carlos García ciyi @ciyinet

6 years ago

Also, look for 2 password changes (event 4742) of the DC computer account in a short period of time. This password is only changed automatically every 30 days by default, so 2 changes in a short period of time is suspicious. Anyway, patch now :) [3/3]