FedSearch
Just Another Blue Teamer · @LeeArchinal
100 followers · 159 posts · Server ioc.exchange
Open media

The next installment of the SentinelOne and blog series features Millie Nym as they demonstrate their unique reverse engineering techniques as they analyze a sample of ArechClient2. Enjoy and Happy Hunting!

***As usual, for this , I am going to leave out a piece of information and it is your job to find it! DM me with the answer or leave a comment!
Hint: Check the links in the article!***

Notable MITRE ATT&CK TTPs:
TA0005 - Defense Evasion
T1055.? - Process Injection: [fill in this blank]
T1562 - Impair Defenses: Disable or Modify Tools
T1112 - Modify Registry

TA0009 - Collection
T1005 - Data from Local System

TA0011 - Command and Control
T1102 - Web Service

Reverse Engineering Walkthrough | Analyzing A Sample Of Arechclient2
sentinelone.com/blog/reverse-e

#VXUnderground #minictf #cybersecurity #itsecurity #infosec #blueteam #threatintel #threathunting #ThreatDetection #happyhunting #readoftheday

Last updated 1 year ago
Original post

Just Another Blue Teamer · @LeeArchinal
97 followers · 158 posts · Server ioc.exchange
Open media

everyone! I am back from a weeklong "vacation" with an article from the SentinelOne blog but the research was conducted by Pol Thill. There was a challenge thrown down by and SentinelOne looking for research that was conducted but not previously published, which I think is a really interesting concept and needs to happen more often!

Anyways, here is Pol's research on Neo_Net, the Kingpin of Spanish eCrime! Enjoy and Happy Hunting!

Link in the comments!

Notable MITRE ATT&CK TTPs and Behaviors:
Mobile Matrix:
TA0035 - Collection
T1636.004 - Protected User Data: SMS Messages

TA0037 - Command and Control
T1437.001 - Application Layer Protocol: Web Protocols
T1481.003 - Web Service: One-Way Communication

Neo_Net | The Kingpin of Spanish eCrime
sentinelone.com/blog/neo_net-t

#happymonday #VXUnderground #cybersecurity #itsecurity #infosec #blueteam #threatintel #threathunting #ThreatDetection #happyhunting #readoftheday

Last updated 1 year ago
Original post

Tarnkappe.info · @tarnkappeinfo
2056 followers · 4417 posts · Server social.tchncs.de

#VXUnderground #volkerwissing #tilojung #richardroberson #pompompurin #PiaLamberty #pentagonleak #kattascha #elonmusk #lesetipps

Last updated 1 year ago
Original post

Tarnkappe.info · @tarnkappeinfo
1966 followers · 4229 posts · Server social.tchncs.de

#wyroczen #VXUnderground #utox #truecrime #ralfrosanowski #qtox #opbalochistan #novagallery #mediagoblin #JackRhysider #homegallery #GhostSec #gcam #bildungszwecke #videos #reverseengineering #podcast #malware #linux #lesetipps #kurios #itsicherheit #internet #empfehlungen #datenschutz #DarkCommerce #cyberangriffe #anonymous

Last updated 1 year ago
Original post

Tarnkappe.info · @tarnkappeinfo
1960 followers · 4215 posts · Server social.tchncs.de

#VXUnderground #sicherheitsvorfall #phishingattacke #PhishingAngriff #callofduty #activisiongehackt #activisionblizzard #gaming #cyberangriffe

Last updated 1 year ago
Original post

D33P_DIV3R · @D33P_DIV3R
13 followers · 6 posts · Server infosec.exchange

Oh yeah! I forgot to mention that I’m also a volunteer with and so if you have any questions or just want to connect feel free to reach out.

#VXUnderground #malpedia

Last updated 2 years ago
Original post

D33P_DIV3R · @D33P_DIV3R
24 followers · 16 posts · Server infosec.exchange

Oh yeah! I forgot to mention that I’m also a volunteer with and so if you have any questions or just want to connect feel free to reach out.

#VXUnderground #malpedia

Last updated 2 years ago
Original post

acrypthash👨🏻‍💻 · @acrypthash
240 followers · 124 posts · Server infosec.exchange

I really enjoy reading white papers in the morning when I have time. I just finished up this brief one written earlier in the year about bypassing PPLs in Windows:

papers.vx-underground.org/pape

PROCESS_QUERY_LIMITED_INFORMATION is capable of successfully opening tokens and reading them, which can then allow visibility on what permissions are needed to access and hollow out a service. There is nothing new here it seems, but still very interesting IMO. Elastic Security's implementation of a fix seems to be good by denying TOKEN_WRITE with certain trust labels.

#VXUnderground #blueteam #windows #exploit #token #malware #services #processhollowing

Last updated 2 years ago
Original post

ohCoz · @ohCoz
120 followers · 17 posts · Server infosec.exchange

you know it's a great night when you get lost down the VX-underground rabbit hole

#malwareresearch #VXUnderground

Last updated 2 years ago
Original post

Tarnkappe.info · @tarnkappeinfo
1529 followers · 3787 posts · Server social.tchncs.de
Tarnkappe.info - Intels Alder Lake BIOS-Quellcode angeblich online geleakt

#VXUnderground #quellcode #leak #intel #exploit #bios #AlderLake #kurznotiert #internet

Last updated 2 years ago
Original post

Tarnkappe.info · @tarnkappeinfo
1529 followers · 3787 posts · Server social.tchncs.de
Tarnkappe.info - REvil: Angriff auf milliardenschweren Fertigungsriesen

#VXUnderground #RansomwareErpressung #RansomwareAngriff #RansomwareREvil #MideaGroup #fsb #internet #hacking

Last updated 2 years ago
Original post

Tarnkappe.info · @tarnkappeinfo
1529 followers · 3787 posts · Server social.tchncs.de

#VXUnderground #RansomwareAngriff #MarasDukaj #Killnet #fbi #DusanPolovic #cyberangriff #internet #hacking

Last updated 2 years ago
Original post