Best search🔎engines for Pentesters and Security Professionals.

→ google .com
→ Shodan .io
→ Censys .io
→ Hunter .io
→ redhuntlabs .com
→ fullhunt .io
→ onyphe .io
→ fofa .so
→ socradar .io
→ synapsint .com
→ binaryedge .io
→ ivre .rocks
→ crt .sh
→ spyse .com
→ vulners .com
→ PublicWWW .com
→ Pulsedive .com
→ ZoomEye .org
→ intelx .io
→ WiGLE .net
→ reposify .com
→ viz. greynoise .io

🗣NandanLohitaksh


🎖@malwr

For those following the news, the WhisperGate campaign (as initially described by Microsoft) has been quite impactful. Today, my blog for corporate has gone live regarding this wiper campaign, with the analysis of all four stages. Additionally, I uploaded the binary of stage 4 to VirusTotal, MalShare, and MalwareBazaar, making it accessible for all. The links are given below.

Link: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/return-of-pseudo-ransomware.html


ℹ️ Sent from one of our members


🎖@malwr

An old sample of the Lamberts (probably #WhiteLambert) appeared on VirusTotal.
This driver file intel440x.sys is also mentioned by name on the infamous drv_list.txt from The Shadow Brokers' leak. The logic itself is contained inside a compressed resource.
https://www.virustotal.com/gui/file/1eede29007619d207842ddcaadf41b17b47a456004df43189d1f6cf54a3b785b
🗣_CPResearch_


🎖@malwr

[1/n] Today I'm sharing the details of a research done by vaber_b, legezo, Ilya Borisov and myself on a UEFI firmware implant found in the wild, dubbed #MoonBounce. We assess that this formerly unknown threat is the work of the infamous #APT41. A 🧵
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
🗣_marklech_


🎖@malwr

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
https://github.com/infosecn1nja/Red-Teaming-Toolkit
🗣Dinosn


🎖@malwr

My research work from last year summarized in the blog post: Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA
https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/
🗣Pawp81


🎖@malwr

3.0: The Next Chapter. Today, we’re proud to announce the release of Binary Ninja 3.0. More than 6 months in the making, Binary Ninja 3.0 represents a huge leap forward in analysis and usability. Pseudo C decompilation, stack view and an overhauled UI https://binary.ninja/2022/01/27/3.0-the-next-chapter.html
🗣vector35


🎖@malwr

65 page history of REvil looks really nice
https://t.co/4hvdloS9Vo?s=09
🗣maldr0id


🎖@malwr

Day 29 #100DaysofYARA using maths; counting the number of resources in a PE that have MZ headers!

I can only count to 5 on one hand so thats why the counter went this high

https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar
🗣greglesnewich


🎖@malwr

Process Hollowing Alert is now in #SIGMA.

Sysmon Event ID 25 with a type of “image is replaced”
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_process_hollowing.yml
🗣SecurePeacock


🎖@malwr

Stop Windows Defender programmatically
https://github.com/lab52io/StopDefender
🗣pentest_swissky


🎖@malwr

I published a set of Python scripts that I use to integrate @dfir_iris , @MISPProject and @TimesketchProj #DFIR #CSIRT https://github.com/cudeso/dfir-iris-misp-timesketch
🗣cudeso


🎖@malwr

#MalwareAnalysis: Detecting Process Hollowing
The first pattern to look for are any calls to create processes in a suspended state:

> CreateProcessA
"dwCreationFlags" set 0x04 CREATE_SUSPENDED

Purpose is to disguise malicious code in a legit exe by replacing the contents.

Following the process being started in a suspended state... (usually svchost.exe but who's counting). Then there are API calls to native/non native APIs:

> ZwUnmapviewofsection
> virtualallocex
> writeprocessmemory
> setthreadcontext
> NTgetcontextthread
> ntreadvirtualmemory

Other ones:
> NTResumethread
> NTwritevirtualmemory
> ntsetcontextthread

The logic is to look for signs of processes being started in suspended state - then the process being hollowed, replaced with "malicious" contents and resuming of execution.

🗣inversecos


🎖@malwr

Driver loader for bypassing Windows x64 Driver Signature Enforcement. #Hack #108 (2016)
https://github.com/hfiref0x/TDL
🗣OPOSEC


🎖@malwr

Have you noticed that IDA sometimes renames and marks up local variables automatically? Read up on how Parameter identification and tracking aka PIT works:

https://hex-rays.com/blog/igors-tip-of-the-week-74-parameter-identification-and-tracking-pit/

#IgorsTipOfTheWeek #IDAtips #IDAPro
🗣HexRaysSA


🎖@malwr

I wrote a C++ library to parse Windows minidumps (.dump /mx) for another project; go check it out 🙏🏽!
https://github.com/0vercl0k/udmp-parser/
🗣0vercl0k


🎖@malwr