Profile picture
, 5 tweets, 7 min read
My Authors
Read all threads
Wait is over .. Read final part 2 which is focused on aws log data ingestion , #hunting and investigation of Capital one breach TTPs in #AzureSentinel techcommunity.microsoft.com/t5/Azure-Senti…
T1078: Privileged role attached to Instance.
#AzureSentinel #MITRE #AWS #threathunting
github.com/Azure/Azure-Se…
T1078 : Suspicious credential token access of valid IAM Roles
#AzureSentinel #MITRE #AWS #threathunting
github.com/Azure/Azure-Se…
T1530 : Suspicious Data Access to S3 Bucket from Unknown IP address.
#AzureSentinel #MITRE #AWS #threathunting github.com/Azure/Azure-Se…
T1020 : S3 Bucket outbound Data transfer anomaly
#AzureSentinel #MITRE #AWS #threathunting
github.com/Azure/Azure-Se…
Missing some Tweet in this thread? You can try to force a refresh.

Enjoying this thread?

Keep Current with Ashwin Patil

Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#hunting #AzureSentinel #MITRE #AWS #threathunting

Related threads

Profile picture
K. Louise Neufeld
@ninaandtito
CAPITAL ONE BREACH:
Former Seattle Tech Worker Indicted on Federal Charges for Wire Fraud and Computer Data Theft
Indictment Cites more than 30 Victims of Data Intrusion and Theft

justice.gov/usao-wdwa/pr/f…
“indicted today by a federal grand jury on two counts related to her unauthorized intrusion into stored data of more than 30 different companies”
“PAIGE A. THOMPSON a/k/a erratic, 33, will be arraigned on the indictment in U.S. District Court in Seattle on September 5, 2019. THOMPSON remains in custody.”
Read 3 tweets
Profile picture
Karol Cummins
@karolcummins
💦Deluge💦

Reminder:

RU docs reveal desire to sow racial discord & violence in the US
US intel agencies warned of likely RU meddling in the 2020elex.

Enter JDs vs Trump teeing off an excg of weaponized talking points deliberately designed to distract & divide.

Here we are!
💦Deluge2💦

Disclosed: US nuclear weapons are being stored in Belgium, Germany, Italy😱, the NL & Turkey😱

Given the immense unexplained wealth accumulated by Epstein, authorities order forensic acct’g exploring the money trails via a criminal tax fraud and/or 💰💦 inv’n
💦Deluge2💦

Epstein’s former bookkeeper, in a deposition, said she arranged for underage girls to be sent to his parties, and others were sent to modeling assignments with wealthy clients where they would only be paid if they agreed to have sex.

Trump/Epstein vid revealed.
Read 86 tweets
Profile picture
Eli White
@Eli_White
1/ Yesterday I gave a talk at F8 about what we’ve been working on for React Native, and some of what to expect in the future. You should watch the video, but I also want to share some of the details here.
developers.facebook.com/videos/2019/mo… 👇
2/ There are a ton of products from Facebook using React Native, here is a spattering: Ads Manager, Oculus Companion, Marketplace, Dating, Jobs, Profile, Settings, Blood Donations, Crisis Response, and many more.
3/ We spent 2017-18 focused on helping the biggest product built with React Native, Marketplace. In the short amount of time Marketplace has been around it has grown to be used by 1 in 3 people in the US!
Read 21 tweets
Profile picture
Nick Carr
@ItsReallyNick
Someone's trying to backdoor "hexcalc.exe" from GitHub and not doing a great job. Here's a quick exploration of the VT tester's 6 files, the corresponding PDB anomalies, PS1 & Cobalt Strike shellcode, and Yara #hunting rules.

Thread 1/n
The first file tested by the VT account is hexcalc.exe
0433aeff0ed2cdf5776856f2c37be975
PDB: D:\codes\WinHexCalc\Release\hexcalc.pdb

This led me to search for the original (shady) project from Github: github.com/azlan/WinHexCa…
and this indeed contains this initial hexcalc.exe

2/n
They attempt to backdoor the file 4 different times with PS1 shellcode, uploading all to VT:
ae73fe66415edbfd5669ab567793536b
d7c7c9ef1c1725f497ef5feaa654fc2e
7feaa6255459dcba370252e8905a9a4a
ddc442bd5e5d157011ae79c48ee2189a
PDB: F:\Devel\WinHexCalc-master\Release\hexcalc.pdb
3/n
Read 9 tweets
Profile picture
marcos
@eptaccio
principais (na minha opinião) serviços da #Aws e sua utilidade

a thread
Elastic Cloud Compute #EC2: maquinas virtuais, você pode usar subir aquele linux (ou windows) para montar um servidor

o serviço é altamente configurável e escalável, acaba servido de base para outros serviços da plataforma, é cobrado por hora/uso

o famoso servidor na nuvem #aws
Elastic Container Service #ECS: é um orquestrador de contêineres #docker, utiliza o #EC2 como base, aqui você monta as definições das suas aplicações/containers, conseguindo escalar, diminuir, atualziar de um jeito bem fácil

e ainda compartilhando recursos de hardware #aws
Read 8 tweets
Profile picture
❌45,468 SEALED ⚖️🗝️
@Avery1776
Microsoft must think we do not know that they are #Skolkovo Partners #RussiaRussiaRussia 😂
#Skolkovo #Microsoft Knee Deep in #RussiaRussiaRussia (real collusion) @BenKTallmadge @BasedBasterd @HousatonicITS @909946zill @CarrollQuigley1
Exhibit 1
bbc.com/news/technolog…
Exhibit 2 MOU better Skolkovo and Microsoft
news.microsoft.com/2010/11/01/sko…
Read 7 tweets

Trending hashtags

#conspiracies #MSDyn365CE #KMS #SamePlayers #wikileaks #Resistance #kidnapping #ThinkMIRROR #devops #Gameday #LetMeSeeYourWarFace #FutureProvesPast #D5 #BillBarr #devcommunity #CustomerService #PowerApps #SnowdonOp #HowDoYouHideAMessageInClearSight #Qpost777 #nothingtoseehere #TipOfIceberg #unhackthevote #Espionage #breadcrumbs
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!