๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY) header
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY) profile picture

๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป

@0xCyberY

Cybersecurity Engineer @ COGNNA | Security Analyst | Penetration Tester | Purple Teamer

 127.0.0.1
0xcybery.github.io
Joined November 2012
  • Tweets1.5K
  • Following783
  • Followers883
104Media
Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)Photo by ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)
ุชุณุฑูŠุจ ุงู„ุจูŠุงู†ุงุชโ€ฆ ุฏุฑูˆุณ ู‚ุงุณูŠุฉ ู…ู† ุงู„ู…ุงุถูŠ ู„ุญู…ุงูŠุฉ ุงู„ู…ุณุชู‚ุจู„ haseen.leapat.org/blog/postsโ€ฆ #leapat
ุญุตูŠู† - ุฃุฏุงุฉ ูุญุต ุชุณุฑูŠุจ ุงู„ุจูŠุงู†ุงุช

ุญุตูŠู† - ุฃุฏุงุฉ ูุญุต ุชุณุฑูŠุจ ุงู„ุจูŠุงู†ุงุช

ุญุตูŠู† ู‡ูŠ ุฃุฏุงุฉ ู…ุชู‚ุฏู…ุฉ ูˆุขู…ู†ุฉ ู„ู„ุชุญู‚ู‚ ู…ู† ุชุณุฑูŠุจ ุงู„ุจูŠุงู†ุงุช ุงู„ุดุฎุตูŠุฉ. ุชุญู‚ู‚ ู…ู…ุง ุฅุฐุง ูƒุงู† ุจุฑูŠุฏูƒ ุงู„ุฅู„ูƒุชุฑูˆู†ูŠ ุฃูˆ ู…ุนู„ูˆู…ุงุชูƒ ุงู„ุดุฎุตูŠุฉ ู‚ุฏ ุธู‡ุฑุช ููŠ ุฃูŠ ุงุฎุชุฑุงู‚ ู„ู„ุจูŠุงู†ุงุช ู…ุน ุถู…ุงู† ุงู„ุฎุตูˆุตูŠุฉ ุงู„ูƒุงู…ู„ุฉ.

haseen.leapat.org
365
Phishing remains the most common method for compromising accounts. However, phishing through Google Workspace emails in a more stealthy and sophisticated manner is a story worth mentioning. Read the story : gist.github.com/zachlatta/f8โ€ฆ
almost_pwned.md

almost_pwned.md

GitHub Gist: instantly share code, notes, and snippets.

gist.github.com
525
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Chad Tilbury (@chadtilbury) profile picture
Chad Tilbury@chadtilbury12 Jun 2024
Following the Trail of Threat Actors in Google Workspace Audit Logs by @megan_roddie sans.org/blog/following-traiโ€ฆ >> A great intro to the cheat sheet: sans.org/posters/google-workโ€ฆ
Image from Chad Tilbury (@chadtilbury)
22
74
7,117
CAPA provides insights into the potential actions the program can perform. For instance, it may indicate if the file behaves as a backdoor, can install services, or communicates via HTTP. github.com/mandiant/capa #malwareanalysis #reverseengineering
GitHub - mandiant/capa: The FLARE team's open-source tool to identify capabilities in executable...

GitHub - mandiant/capa: The FLARE team's open-source tool to identify capabilities in executable...

The FLARE team's open-source tool to identify capabilities in executable files. - mandiant/capa

github.com
1
405
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
blackorbird (@blackorbird) profile picture
blackorbird
@blackorbird12 Dec 2023
Supply Chain Poisoning of 7ZIP on the Microsoft App Store #APT ti.qianxin.com/blog/articlesโ€ฆ
1
33
2
81
13,027
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Florian Roth โšก๏ธ (@cyb3rops) profile picture
Florian Roth โšก๏ธ
@cyb3rops6 Dec 2023
The sample mentioned in the @CISACyber report AA23-339A on attacks against Adobe ColdFusion CVE-2023-26360 is ForkDump by @BillDemirkapi - only ESET gets it right Sample virustotal.com/gui/file/a3acโ€ฆ CISA report cisa.gov/news-events/cyberseโ€ฆ
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
1
17
2
68
23,061
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
COGNNA | ูƒูˆู‚ู†ุง (@cognna) profile picture
COGNNA | ูƒูˆู‚ู†ุง
@cognna19 Nov 2023
Thank you for joining us #blackhatmea2023 ! It was an absolute pleasure meeting all of you in person, and we can't wait to welcome you at more exciting events in the future. Stay tuned for what's to come! #CognnaAtBlackHatMEA #ThankYou
Image from COGNNA | ูƒูˆู‚ู†ุง (@cognna)
3
2
3,493
I will be one of the exhibiter for @cognna at #blackhatmea. Visit us to explore our comprehensive range of threat management, threat detection, rapid response, and compliance assurance solutions to safeguard your organization against evolving cyber threats.
COGNNA | ูƒูˆู‚ู†ุง (@cognna) profile pictureCOGNNA | ูƒูˆู‚ู†ุง
@cognna14 Nov 2023
Great start to the first day of #BlackHatMEA2023! Looking forward to seeing you tomorrow for another exciting day! ุงู†ุทู„ุงู‚ุฉ ุฑุงุฆุนุฉ ู„ุฃูˆู„ ูŠูˆู… ููŠ ุจู„ุงูƒ ู‡ุงุช 2023 ู†ู†ุชุธุฑูƒู… ุจุดูˆู‚ ุบุฏุง ููŠ ูŠูˆู… ุฌุฏูŠุฏ
354
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Florian Roth โšก๏ธ (@cyb3rops) profile picture
Florian Roth โšก๏ธ
@cyb3rops31 Oct 2023
Introducing THOR-Cloud Lite ๐ŸŒฉ๏ธ: Seamless On-Demand Forensic Scanning Made Easy - apply YARA + Sigma + IOCs - it's free - many more features upcoming Blog ๐Ÿ“˜ nextron-systems.com/2023/10/โ€ฆ Release Session ๐Ÿ“บ youtu.be/ApeXFnFkKZg Register for Free โšก๏ธ thorcloud-lite.nextron-systeโ€ฆ
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
8
161
7
518
153,387
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
COGNNA | ูƒูˆู‚ู†ุง (@cognna) profile picture
COGNNA | ูƒูˆู‚ู†ุง
@cognna26 Oct 2023
Discover what's new in cybersecurity. #TrendCheck #Cognna #cybersecurity #infosec #security #hackers #threatintelligence #vulnerabilitymanagement #riskmanagement #CybersecurityMonth
Image from COGNNA | ูƒูˆู‚ู†ุง (@cognna)
2
2
673
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
COGNNA | ูƒูˆู‚ู†ุง (@cognna) profile picture
COGNNA | ูƒูˆู‚ู†ุง
@cognna25 Oct 2023
Image from COGNNA | ูƒูˆู‚ู†ุง (@cognna)
1
2
1
516
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Cyber Security Club (@KSU_Cyber) profile picture
Cyber Security Club
@KSU_Cyber23 Oct 2023
ุจุงู„ุชุนุงูˆู† ู…ุน @cognna ูŠุฏุนูˆูƒู… ู†ุงุฏูŠ ุงู„ุฃู…ู† ุงู„ุณูŠุจุฑุงู†ูŠ ุจุฌุงู…ุนุฉ ุงู„ู…ู„ูƒ ุณุนูˆุฏ ู„ุญุถูˆุฑ ุงู„ู†ุฏูˆุฉ ุงู„ุณูŠุจุฑุงู†ูŠุฉ ุจุนู†ูˆุงู† : " Cybersecurity Career Path" ู…ุน ุงู„ู…ุฏูŠุฑ ุงู„ุชู‚ู†ูŠ ู„ุดุฑูƒุฉ ูƒูˆู‚ู†ุง ู….ุฒูŠุงุฏ ุงู„ุดู‡ุฑูŠ ูŠูˆู… ุงู„ุงุซู†ูŠู† 30 ุฃูƒุชูˆุจุฑ ุงู„ุณุงุนุฉ 7:30 ู…ุณุงุกู‹ุง ูŠูˆุฌุฏ ุดู‡ุงุฏุฉ ุญุถูˆุฑ๐ŸŒŸ ุฑุงุจุท ุงู„ุชุณุฌูŠู„ : forms.gle/vJ4ExwPGxBy3CrmT9
Image from Cyber Security Club (@KSU_Cyber)
1
14
1
28
12,906
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
COGNNA | ูƒูˆู‚ู†ุง (@cognna) profile picture
COGNNA | ูƒูˆู‚ู†ุง
@cognna19 Oct 2023
Once you've identified the top three common #cybersecurity attacks, the next natural question that may come to mind is: 'How do I mitigate them?' So, here's the answer. #AskCognna #CybersecurityAwarenessMonth
Image from COGNNA | ูƒูˆู‚ู†ุง (@cognna)
1
2
1
483
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Florian Roth โšก๏ธ (@cyb3rops) profile picture
Florian Roth โšก๏ธ
@cyb3rops22 Aug 2023
You can either hunt for it or check and apply our Sigma rules If you're unsure whether a detection idea is already covered by an existing rule, you can use the sigmasearchengine.com/, which was developed by my team member @ph_t__ We've also integrated the API of that service into the Sigma VSCode extension
Image from Florian Roth โšก๏ธ (@cyb3rops)
Image from Florian Roth โšก๏ธ (@cyb3rops)
Threat Hunting (@Mahdi_htm) profile pictureThreat Hunting@Mahdi_htm22 Aug 2023
Initial Access with Compiled HTML File (CHM) have been used by different TAs including APT37 and APT41. For hunting/detecting them you should check hh.exe spawning mshta.exe or any other related LOBINs in Event ID 1 of Sysmon or 4688 See the execution flow in the following pics
Image from Threat Hunting (@Mahdi_htm)
Image from Threat Hunting (@Mahdi_htm)
Image from Threat Hunting (@Mahdi_htm)
Image from Threat Hunting (@Mahdi_htm)
1
48
2
183
32,812
If you want to test the EDR detections and correlation rules used by Blue Teams, you may need to create custom events in a specific event log. To do this, you can use Microsoft's eventcreate utility, which lets you create specific logs at APPLICATION or SYSTEM; for Sysmon logs,
Image from ๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป (@0xCyberY)
1
453
you can use SysmonSimulator. - eventcreate [learn.microsoft.com/en-us/wiโ€ฆ] - SysmonSimulator [github.com/ScarredMonk/Sysmoโ€ฆ] #EDR #detection
eventcreate

eventcreate

Reference article for the eventcreate command, which enables an administrator to create a custom event in a specified event log.

learn.microsoft.com
105
๐’œ๐ต๐’Ÿ๐’ฐ๐ฟ๐ฟ๐’œ๐ป ๐ต๐’œ๐’ข๐ป๐’ฐ๐’ฏ๐ป retweeted
Microsoft 365 Sales (@gitbitorg) profile picture
Microsoft 365 Sales@gitbitorg16 Aug 2023
Cybersecurity Certifications to pursue in 2023 (For FREE): 1. cybrary.it 2. futurelearn.com 3. edx.org 4. sans.org/cyberaces/ 5. gitbit.org
3
424
2
1,118
136,792
๐๐ข๐œ๐ก๐ž & ๐†๐ž๐ง๐ž๐ซ๐š๐ฅ ๐‚๐ฒ๐›๐ž๐ซ ๐ˆ๐ง๐œ๐ข๐๐ž๐ง๐ญ ๐ƒ๐š๐ญ๐š ๐’๐จ๐ฎ๐ซ๐œ๐ž๐ฌ - ransomwatch: [github.com/joshhighet/ransomโ€ฆ] - MalwareBazaar: [bazaar.abuse.ch/browse/] - Verizon Data Breach Investigations Report (DBIR): [verizon.com/business/resourcโ€ฆ]
GitHub - joshhighet/ransomwatch: the transparent ransomware claim tracker ๐Ÿฅท๐Ÿผ๐Ÿง…๐Ÿ–ฅ๏ธ

GitHub - joshhighet/ransomwatch: the transparent ransomware claim tracker ๐Ÿฅท๐Ÿผ๐Ÿง…๐Ÿ–ฅ๏ธ

the transparent ransomware claim tracker ๐Ÿฅท๐Ÿผ๐Ÿง…๐Ÿ–ฅ๏ธ. Contribute to joshhighet/ransomwatch development by creating an account on GitHub.

github.com
1
179
- APT & Cybercriminals Campaign Collection: [github.com/CyberMonitor/APT_โ€ฆ] - APTnotes: [github.com/aptnotes/data/bloโ€ฆ] - Data Breach Chronology: [privacyrights.org/data-breacโ€ฆ] - Breach-Report-Collection: [github.com/BushidoUK/Breach-โ€ฆ]
GitHub - CyberMonitor/APT_CyberCriminal_Campagin_Collections: APT & CyberCriminal Campaign Collec...

GitHub - CyberMonitor/APT_CyberCriminal_Campagin_Collections: APT & CyberCriminal Campaign Collec...

APT & CyberCriminal Campaign Collection. Contribute to CyberMonitor/APT_CyberCriminal_Campagin_Collections development by creating an account on GitHub.

github.com
1
86
- Map of worldwide ransomware attacks: [comparitech.com/blog/informaโ€ฆ] - Catalog of Supply Chain Compromises: [github.com/cncf/tag-securityโ€ฆ] - Software Supply Chain Compromises - A Living Dataset: [github.com/IQTLabs/software-โ€ฆ] - DeFi Hack database: [defillama.com/hacks] #cybersecurity
Ransomware Attack Tracker

Ransomware Attack Tracker

Confirmed ransomware attacks with per-incident evidence grading and published source ledgers.

ransomware.comparitech.com
89
Load more