1/ I am taking a little break but couldn’t resist checking-out my favourite open-source projects for any updates. Doing so, I thought it will be useful to share my top 10 projects that anyone in the #infosec field should know about. Here they are 🧵: 2/ 📊 HELK (buff.ly/3BHn9iR): The Hunting ELK (HELK) project provides an analytics and threat hunting platform for security teams to identify and respond to threats in their environment. Just load your logs and start hunting! #HELK #ThreatHunting

Many security teams scrutinize inbound connections, but they tend to overlook traffic leaving the network. Here are a couple of things I consider when #Threat_hunting for ExMatter or similar tools: 🧵👇

1⃣Create your baseline:
It is difficult to find anomalous activity if...

https://twitter.com/1ZRR4H/status/1655014346307559428

...you don't know what normal looks like.
🔹Gather historical network data of outbound connections. The longer the baseline, the better the results.

....⤵️

Threat actors have started leveraging a new RMM platform called Action1. This RMM has useful features. Let's take a look at what these are and how they use them🧵:

👀Console visibility:
➡️Missing Updates view
➡️Apps installed
➡️Detail info about the OS & Hardware of the host Using Action1, they are seen executing commands, scripts and binaries. To do that, they must first create a "policy" or an "app". The name of those will show up in the command line during execution:

⚙️App Deployment:
➡️action1_agent.exe -> <binary running as system>

1/x
For the past couple of weeks, #IcedID has been hitting hard, with post-exploitation activities beginning within ~1 hour from the initial infection.

Here are some TTPs and IOCs from these post-exploitation activities that will keep defenders ready.
🧵👇 2/x
🎯TTPs
➡️IcedID use of VNC
💡Over port 8080
➡️Multiple Cobalt Strike DLLs on disk
💡Overused directories - "C:\Windows\Tasks" & - "%user%\AppData\Local\Temp"
➡️Heavy use of PowerShell
💡Downloading payloads, exec PowerShell Cobalt Strike Loaders & other processes

#BruteRatel is difficult to detect without having access to WinAPI, NTAPI, and Syscalls as everything is done in memory. This hurts our efforts to hunt across behaviors upon executing the BRC4 payload.

Although all hope is not lost,there are some good indicators in the wires🧵👇 Looking into the unencrypted network traffic, there are some indicators we can hunt for and create detections based on the default BRC4 profile:

➡️Multiple POST requests against certain destinations
➡️All responses (apart from initial check-in) have 0 content with 200 status👇

As a defender, I read reports to stay up to date with recent threats reported by others in the industry. It also helps me generate ideas for future research, threat hunting, detection, or a deeper dive into TA's infra.

This is what I am looking for when I read them🧵
1/11 I'll use a couple of good and one not-so-good report example from this week's awesome collection of reports from thisweekin4n6.com.

🔥Useful reports🔥

- Bitter APT adds Bangladesh to their targets (@TalosSecurity)
- Cozy Smuggled Into The Box (@cluster25_io)
2/11

Last week, @TheDFIRReport received a MS-themed phishing email with an HTML attachment. The email made a significant effort to appear legitimate. 

When we open the file, the code renders into what appears to be an HTML page mirroring the official MS account login page.
1/🧵 @TheDFIRReport Looking into the code of the HTML file, we notice a couple of layers of obfuscation. Without much effort, we decoded the content. The script element contains URL and Base64 encoded code that will be executed by the browser.
2/