Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
John Lambert Profile picture
John Lambert
@JohnLaTwC
Corporate Vice President, Security Fellow, Microsoft Security Research, johnla(AT)https://t.co/3dGtq71Nby
Minh-Triet Pham Tran Profile picture 1 subscribed
Oct 20, 2023 • 12 tweets • 4 min read
I spoke at @MSFTBlueHat last week.
➡️
I will follow up with a link to the recording when it is posted.

Some highlights from my talk below👇👇👇github.com/JohnLaTwC/Shar… I talked about how incidents can teach powerful lessons and contain important truths for defenders. Image
Apr 9, 2022 • 6 tweets • 2 min read
If you work with event logs, here are 2 GREAT utilities:

Parse an EVTX file into JSO: github.com/omerbenamram/e…

Query a JSON stream: stedolan.github.io/jq/tutorial/

Combined with Sysmon and some built-in logs, there is a lot of power at your fingertips 💪 First, export a log to EVTX:
1⃣wevtutil epl Microsoft-Windows-Sysmon/Operational sysmonlog.evtx
2⃣wevtutil epl Security Security.evtx /ow:true
3⃣wevtutil epl "Microsoft-Windows-DNS-Client/Operational" DNS.evtx
Mar 13, 2022 • 24 tweets • 2 min read
I am preparing for an internal talk on career advice learned from working security crises. My notes 🧵 The fastest way to accomplish things is to build trust
Sep 26, 2021 • 10 tweets • 1 min read
My favorite story about VBS files is not the I Love You worm, but one that happened in building 40 at Microsoft. VB Script files are associated with WScript.exe by default. This is an important detail. The other host for VB Script files is CScript.exe.
Sep 24, 2021 • 6 tweets • 2 min read
I've had a lot of neat employee moments at Microsoft. here's one of them.
👇 It was Feb 4, 2014. The board had just named @satyanadella as CEO.
📎news.microsoft.com/2014/02/04/mic…
An email said he was going to make some remarks in a building across campus in like 30 minutes. I jumped in my car.
Sep 19, 2021 • 13 tweets • 5 min read
Found one of my Microsoft notebooks 📔 from 2005. Here are a few pages on what was on my mind then. The Longhorn (aka Windows Vista) security plan.
Sep 8, 2021 • 8 tweets • 6 min read
#HuntingTipOfTheDay
If you're in a SOC or IR role and don't use @GitHub because "you're not a developer", read on! It can be powerful when paired with #VirusTotal.

Came across this interesting command. What is it doing? 🤔 It certainly seems to be mucking with the event log, given the security parameter, it seems clear it's interested in the Windows security event log.
The most obvious explanation is that it is deleting records--the ones that correspond to the EventRecordIDs listed.
Aug 22, 2021 • 10 tweets • 3 min read
Some of my #infosec infographics in one thread
👇👇👇 Adversaries need credentials more than malware. Avoid the sins of Windows credential administration
📎
Aug 21, 2021 • 5 tweets • 2 min read
True #DFIR Tales
👇👇👇
Jul 27, 2021 • 4 tweets • 2 min read
#HuntingTipOfTheDay
Battle test your rules. Here is an incomplete detection rule for saving a specific registry key. How many ways can you come up with to bypass it? (reply!)

(?i)(reg)[\.(exe)]*\s+save\s+hklm\\HARDWARE

Here's how you play🕹️:
👇👇👇 1⃣ Go to regex101.com and paste the regex in.
2⃣ Develop test strings. A highlighted match means blueteam wins. Keep trying.
3⃣ Once you have a string with no match, verify the test string successfully dumps the regkey.
4⃣ 🍻
Oct 11, 2020 • 13 tweets • 15 min read
Some very interesting XLLs in the wild (#blueteam take note!). Will link to some research in this thread. This one loads a payload from an embedded resource and displays a decoy message.
📎virustotal.com/gui/file/1994a…
🎁🎇joesandbox.com/analysis/21041… ImageImageImageImage This XLL decodes a Base64 string using CryptStringToBinary and uses the Nt APIs to jump to it.
📎virustotal.com/gui/file/5644a… ImageImageImage
Sep 14, 2020 • 14 tweets • 4 min read
Want to see the most beautiful equation in math? I’ll show you. It starts with the Roots of Unity. Image
Jul 29, 2020 • 7 tweets • 1 min read
"The best way to show that a stick is crooked is not to argue about it or to spend time denouncing it, but to lay a straight stick alongside it"
― D.L. Moody "There is no love, there are only proofs of love"
― Pierre Reverdy
Jul 29, 2020 • 10 tweets • 3 min read
Wonder how these tweets from 2015 aged:
1⃣ 2⃣
Jul 10, 2020 • 4 tweets • 3 min read
Full of avalanche debris to hike over and logs to traverse. ImageImageImage Brush that is way over your head and tricky footing over a hidden floor of logs, roots, and holes. And hazards. ImageImageImage
Jul 10, 2020 • 5 tweets • 2 min read
Pacific Northwest: If you look closely at this panoramic view of Gold Creek Valley (Cascades in WA state), notice the downed trees at left and the bare mountainside with waterfalls at right. Image In 2007 there was a massive avalanche on the right side. The force was so strong it carried across Gold Creek and up the left side of the valley causing the trees to fall UPHILL. Image
Jul 8, 2020 • 4 tweets • 3 min read
This month marked 20 years at Microsoft. Here’s how I celebrated: ImageImageImageImage ImageImageImageImage
Mar 28, 2020 • 8 tweets • 8 min read
This change @DidierStevens talks about starts with a file discussed on twitter:
This started with a pentest Excel4 macro file by @spamv noticed by @malwrhunterteam:
🔗virustotal.com/gui/file/ccef6…
🧐
Feb 9, 2020 • 17 tweets • 13 min read
Inspired by this @FireEye post on VBA stomping and the excellent research by @VessOnSecurity @StanHacked @haroldogden @bigmacjpg @OrOneEqualsOne @DidierStevens @ptrpieter @a_tweeter_user @malwaresoup @femmeshoto

I did some spelunking for VBAStomped files. Here's a roundup
👇👇 What is VBA Stomping? One powerful use of it is to make the source code of a macro say one thing, but execute something else by changing the generated pcode:

(all credit to @VessOnSecurity, @StanHacked, @OutflankNL, TEAM @Walmart, and more) Image
Jan 31, 2020 • 5 tweets • 3 min read
#FFVT Follow Friday on interesting VT Submitter Ids. My first is ec31b410 uploading from Denmark. Examples in this thread Image Maldocs that launch code via CreateShortcut and SendKeys
🔗virustotal.com/gui/file/6d630…
🔗virustotal.com/gui/file/65420… Image
Jan 29, 2020 • 6 tweets • 3 min read
Would someone use the Olympics to phish? Yes, yes they would.
🆕hxxps://amazingmonkeys.es/tokyo2020comiteeolympic/
🆕hxxps://amazingmonkeys.es/olympiccomitee/
hxxps://154dst.com/comiteeolympic/
hxxps://154dst.com/olympiccomitee/
hxxps://154dst.com/olympicinternationalcomitee/ Image and
🆕hxxps://amazingmonkeys.es/tokyo2020portal/