1/ #Linux#Forensics: pssst... I will now reveal my favorite interview question for candidates who want to work in our IR team ;) "In the process list, I see a (running) binary, but the binary is no longer present on disc. How can I restore the original binary? (screenshot 👇)"
2/ Many candidates (and other analysts) I have spoken to did not know the (simple?) answer.
Under /proc/[pid]/exe, a 1:1 copy of the executed binary is stored! As you can see in the screenshot, the hash sums of both binaries match precisely.
3/ According to the proc(5) manpage:
"You can even type /proc/[pid]/exe to run another copy of the same executable that is being run by process [pid]."
4/ Under /proc/[pid]/, there is other interesting information, e.g., the directory "fd":
"This is a subdirectory containing one entry for each file that the process has open, named by its file descriptor, and which is a symbolic link to the actual file."
• • •
Missing some Tweet in this thread? You can try to
force a refresh
2/ The TA deployed the C2 agent "on opaque network appliances within the victim environment; think backdoors on SAN arrays, load balancers, and wireless access point controllers. These kinds of devices don’t support antivirus or endpoint detection and response tools (EDRs),
3/ subsequently leaving the underlying operating systems to vendors to manage."
The C2 agent on the compromised servers and systems uses DynDNS domains to communicate with the C2 server.
The use of an internal DNS server, which also logs the DNS queries over an extended
1/ #ThreatHunting: @SentinelOne blogged about a Chinese TA called Moshen Dragon that uses password filters to read plaintext passwords (when they are changed).
1/ #Azure#Hardening Tip #5: Legacy authentication to bypass MFA in Azure AD
"One of the most common methods used by attackers to gain access to Azure tenants is credential theft or password spraying with legacy authentication protocols. Legacy authentication protocols
2/ do not support MFA and (if enabled) can be used to gain access to hosted data and resources via Azure AD."
☝️Quote from the M-Trends 2022 Report.
A few weeks ago, I created a presentation titled "Attack target Azure", where these two points are also outlined as the most
3/ common methods (used by attackers) into Azure Tenants.
To better secure Azure Tenants, I recommend creating an evaluation of the applications that still use legacy authentication protocols. The use of these protocols should be prevented with Conditional Access Policies (CAP).
1/ When examing AutoRuns entries during an IR or CA - would you consider a Scheduled Task with the name COMSurrogate and with the following launch string as malicious (spoiler: it is 😉)?
2/ @Malwarebytes has found out that the Colibri malware on Windows 10 systems (and up) drops a file called Get-Variable.exe in the path %APPDATA%\Local\Microsoft\WindowsApps.
3/ "It so happens that Get-Variable is a valid PowerShell cmdlet which is used to retrieve the value of a variable in the current console. Additionally, WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell
1/ Finding web vulnerabilities at scale: As part of a security team in a previous role, my job was, among other things, to find vulnerabilities in web applications. The environment had hundreds of (externally accessible) web applications, many of which had not yet been pentested.
2/ The goal was to quickly find as many low-hanging fruits, including SQLi and command injections, to prevent at least a beachhead by an attacker into the internal network.
We had the advantage of breaking up all the internet traffic and routing all the requests through a proxy.
3/ All URLs from the web applications we wanted to assess with all parameters were available within the proxy logs. This gave us in-depth coverage of the different applications with all paths and parameters (from the GET method).
1/ #Hardening: More and more attackers in ransomware cases are attacking the ESXi and vCenter infrastructure to encrypt a large part of the systems in a company within a short time.
2/ Once an attacker has gained access to a network, the captured credentials are used for logging into the vCenter infrastructure.
Removing ESXi and vCenter from Active Directory prevents compromised Active Directory accounts from being used to authenticate directly to the
3/ virtualization infrastructure. Authentication would need to happen directly on the relevant systems, and administrators must have dedicated accounts for logging in. These measures cannot prevent compromise but at least make it more