Tweet

https://twitter.com/JohnLaTwC/status/769548547515486209

https://twitter.com/JohnLaTwC/status/734379194994417665

https://twitter.com/JohnLaTwC/status/711576224108138496

https://twitter.com/JohnLaTwC/status/1421817994204749828

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @JohnLaTwC

John Lambert

@JohnLaTwC

8 Sep

@GitHub

#HuntingTipOfTheDay
If you're in a SOC or IR role and don't use @GitHub because "you're not a developer", read on! It can be powerful when paired with #VirusTotal.

Came across this interesting command. What is it doing? 🤔

It certainly seems to be mucking with the event log, given the security parameter, it seems clear it's interested in the Windows security event log.
The most obvious explanation is that it is deleting records--the ones that correspond to the EventRecordIDs listed.

How can we find out more about this tool? The tool name (comrelg.exe) is faked🤥 and the hash didn't lead anywhere and I didn't have a copy of the sample. (set aside pivoting on imphash etc for now🧠)

Read 8 tweets

John Lambert

@JohnLaTwC

22 Aug

Some of my #infosec infographics in one thread
👇👇👇

https://twitter.com/JohnLaTwC/status/682351102688284672

Adversaries need credentials more than malware. Avoid the sins of Windows credential administration
📎

https://twitter.com/JohnLaTwC/status/682351102688284672

https://twitter.com/JohnLaTwC/status/682351553240403968

Attackers seek to turn illegitimate access into legitimate access. Find them after they submerge.
📎

https://twitter.com/JohnLaTwC/status/682351553240403968

Read 10 tweets

John Lambert

@JohnLaTwC

27 Jul

#HuntingTipOfTheDay
Battle test your rules. Here is an incomplete detection rule for saving a specific registry key. How many ways can you come up with to bypass it? (reply!)

(?i)(reg)[\.(exe)]*\s+save\s+hklm\\HARDWARE

Here's how you play🕹️:
👇👇👇

1⃣ Go to regex101.com and paste the regex in.
2⃣ Develop test strings. A highlighted match means blueteam wins. Keep trying.
3⃣ Once you have a string with no match, verify the test string successfully dumps the regkey.
4⃣ 🍻

This simulates an attack to dump the SAM database, but uses the HARDWARE keep to prevent you from flooding your SOC with benign alerts 😀
📎ired.team/offensive-secu…

Read 4 tweets

John Lambert

@JohnLaTwC

11 Oct 20

https://twitter.com/moo_hax/status/1314429486335549440

Some very interesting XLLs in the wild (#blueteam take note!). Will link to some research in this thread. This one loads a payload from an embedded resource and displays a decoy message.
📎virustotal.com/gui/file/1994a…
🎁🎇joesandbox.com/analysis/21041…

https://twitter.com/moo_hax/status/1314429486335549440

This XLL decodes a Base64 string using CryptStringToBinary and uses the Nt APIs to jump to it.
📎virustotal.com/gui/file/5644a…

https://twitter.com/moo_hax/status/1314429486335549440

Some links for research:
👋🌍github.com/edparcell/Hell…
🔙🚪labs.f-secure.com/archive/add-in…
📄gist.github.com/ryhanson/22722…
📎

https://twitter.com/moo_hax/status/1314429486335549440

🎁github.com/moohax/xllpoc
cc/ @buffaloverflow @moo_hax @ryHanson @FSecureLabs

Read 13 tweets

John Lambert

@JohnLaTwC

14 Sep 20

Want to see the most beautiful equation in math? I’ll show you. It starts with the Roots of Unity.

Read 14 tweets

John Lambert

@JohnLaTwC

29 Jul 20

https://twitter.com/_saadk/status/1288529007714107392

"The best way to show that a stick is crooked is not to argue about it or to spend time denouncing it, but to lay a straight stick alongside it"
― D.L. Moody

https://twitter.com/_saadk/status/1288529007714107392

"There is no love, there are only proofs of love"
― Pierre Reverdy

"When the student is ready, the teacher will appear"
― various

Read 7 tweets

Share this page!

John Lambert

Try unrolling a thread yourself!

More from @JohnLaTwC

John Lambert

John Lambert

John Lambert

John Lambert

John Lambert

John Lambert

Did Thread Reader help you today?

Like this author's thread?