@0rig3n

Incident Response and Threat hunting

Joined June 2010
  • Tweets149
  • Following388
  • Followers89
13Media
It's that time of year. We are pleased to bring you HackNWA Conference 2025: Sock Puppet Tycoon - Disposable Machine, Network, Server, Client and Identity;Make frens and influence ppl Great speakers, activities, panelists, and afterparty concert in Bentonville Get your tickets!
7
2
11
1,345
👏 Congratulations. I know being on the Blue side can be stressful! Had a fun time thinking Red team thoughts :)
Southwest CCDC@SWCCDC11 Feb 2024
Congratulations to the following teams for qualifying for the 2024 SWCCDC regional event: @Baylor @LATech @PhilanderSmith @SamHoustonState @SAC_PR @TAMU @UTAustin @utulsa We look forward to seeing everyone in March!
39
Woot! @OrOneEqualsOne speaking at @Sp4rkCon !!
1
12
402
Great talk by @kaoticfen at @Sp4rkCon !!!!
1
7
159
Gonna be in Bentonville on April 15th attending #Sp4rkCon and then performing at a separate party later. About to take over this whole midwest con party scene 😤
HackNWA@HackNwa29 Mar 2023
Looking for a day packed with infosec events on Apr 15th you should check out #Sp4rkCon and @HackNWA in Bentonville. All events are free and open to the public! hacknwa.org/HoK.NFO
2
5
1
12
2,601
I'm teaching my PowerShell For InfoSec course live online for the first time on 3/2/23 and 3/3/23. It is a 2 day class for $575 from @Antisy_Training. Have you already taken the On-Demand (pre-recorded) version? What did you think? Check it out here: antisyphontraining.com/power…

PowerShell for InfoSec: What You Need to Know - Antisyphon Training

antisyphontraining.com
14
30
3,089
The next run of PowerShell for InfoSec:What You Need to Know! w/ @OrOneEqualsOne, that be during our summit, we're honored to be supporting @cybher_dsu w/ 10% of our revenue from this class! Class registration: antisyphontraining.com/power… Support this project: cybher.org/
4
5
1,140
Just learned about this cool lots-project by @mrd0x. Here is a MDE KQL #threathunting query that looks for lolbins talking to lots-project domains. gist.github.com/jllangley/ac…

Threat hunting search, lolbins talking to lots domains.

Threat hunting search, lolbins talking to lots domains. - lolbin-lots.txt

gist.github.com
Thinking of different ways of #threathunting lolbins, especially ones that don’t normally communicate over the network. This is a good base query to get started in Microsoft Defender for Endpoint. #kql gist.github.com/jllangley/eb…

Search Microsoft Defender console for lolbins making network connections.

Search Microsoft Defender console for lolbins making network connections. - Lolbins.md

gist.github.com
Microsoft has been tracking Iranian actor PHOSPHORUS’ ransomware sub-group known as DEV-0270, aka Nemesis Kitten. The group is responsible for multiple attacks typically using high-severity vulnerabilities to gain access. TTPs and more in our latest blog: microsoft.com/security/blog/…
2
124
9
205
Microsoft MDE kql queries based on IP/Hashes from [redacted]'s report on Bian Lian gist.github.com/jllangley/59… #ThreatIntel

Bian Lian KQL search

Bian Lian KQL search. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
2
1
When I switched from offensive security (Red Team) to defensive security (Blue Team) I promised to share my thoughts about my experience and here they are - finally. 😀 medium.com/walmartglobaltech…

My Journey: From Pentest to Red Team to Blue

I was a web application developer in 2010 when I learned about pentesting. I fell in love with the idea that I could get paid to break…

medium.com
5
66
3
332
~Free STUFF~ We still have 10 unclaimed copies of "Hacking API" book. So if you want to win one of those, simply Like & RT. This month we give away 50 books, 5 Burp & 5 Pentester Academy licenses. Follow @traceableai and @InonShkedy for more giveaways 🥳🥳
42
495
6
660
Really highlights the importance of enabling Diagnostic logs for KeyVaults.
inversecos
@inversecos17 May 2022
1\ 👿How to detect and compromise Azure Key Vaults🔐 Attackers target Azure vaults to pillage JUICY 🥵 data for data collection & lateral movement as they contain: - API keys - passwords - certificates 👇Check out my blog for the attack & detection👇 inversecos.com/2022/05/detec…
1\ How to detect file timestomping 👀 APT28, APT29, APT32, APT38 have all used this defence evasion technique to modify malicious file creation times. 😈 Did you also know it's possible to timestomp $FN time? 👇👇 BLOG & TL;DR BELOW 👇👇 bit.ly/3KsX1ua
12
263
8
721
Replying to @briankrebs
Stop. Putting. Critical. Comms. On. Your. Network. You know its bad when even Microsoft is telling you to not use Microsoft.
3
1
25
Azure #threathunting query. Find who in your environment is performing password resets on VMs. This catches ssh key, ssh password and windows password resets. gist.github.com/jllangley/0d…

Azure VM password reset query

Azure VM password reset query. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
1
When Cloud threat hunting I like to keep an eye on who is trying to deploy new resources where the action is denied. Nested groups are the enemy of a well implemented RBAC solution. Azure query here -> gist.github.com/jllangley/8c…

azquery.kql

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
AzureActivity| where TimeGenerated > ago(1d) | where ActivitySubstatusValue == 'BadRequest' | where OperationNameValue == 'MICROSOFT.RESOURCES/DEPLOYMENTS/VALIDATE/ACTION' | extend resource_ = tostring(parse_json(Properties).resource) #ThreatHunting
1
Azure hunt query, looking for new resources they being deployed but was denied. Not a common as you might think. Got any cloud hunting queries to share?
Load more