@HunterPlaybook

I document #ThreatHunting playbooks in the form of #jupyter notebooks and share them with the world! https://xitter.cf/t.co/djKSwSGXgA @Cyb3rWard0g

threathunterplaybook.com/
Joined December 2018
  • Tweets86
  • Following7
  • Followers6.2K
5Media
Thank you for sharing @DrAzureAD 😎! A process that is NOT Lsass attempting to access ("CloudDomainJoin" OR "WorkplaceJoin") AND "Ngc\KeyTransportKey" before exporting the Device certificate and transport key is interesting 😉 ✅ SACL ✅ Detection Idea: github.com/Azure/Azure-Senti…

Detect Access attempts to AAD Joined or Registered Devices Info and Transport Keys Registry Keys by...

This detection uses Windows security events to detect suspicious access attempts by the same process to registry keys that provide information about an AAD joined or registered devices and Transpor...

github.com
Dr. Nestori Syynimaa
@DrAzureAD15 Feb 2022
New #AADInternals version and related blog post (with multicolor arrows) out now! "Stealing and faking Azure AD device identities": o365blog.com/post/deviceiden… Credits to @gentilkiwi/#Mimikatz! #infosec #redteam #blueteam
2
22
1
62
ThreatHunter-Playbook retweeted
InfoSec Jupyterthon@jupyterthon3 Dec 2021
⏳ Good morning! #InfosecJupyterthon Day 2 is here! ⏰Starting at 8:30 AM (PST) 😎 Discord Q&A: discord.com/invite/tFsRKR72 🚀 Agenda: infosecjupyterthon.com/2021/… 📺YouTube Live Stream 🔴: aka.ms/Jupyterthon2021Live2 See you soon!

Discord - Group Chat That’s All Fun & Games

Discord is great for playing games and chilling with friends, or even building a worldwide community. Customize your own space to talk, play, and hang out.

discord.com
2
10
1
21
ThreatHunter-Playbook retweeted
Ashwin Patil
@ashwinpatil2 Dec 2021
Looking forward to speak on #ThreatHunting at scale with Spark notebooks at 4:15 PM PST. #infosecjupyterthon 👀Tune it to Youtube Livestream : youtube.com/watch?v=nMnHBnYf…
13
1
50
ThreatHunter-Playbook retweeted
InfoSec Jupyterthon@jupyterthon1 Dec 2021
🚨 #InfosecJupyterthon going live 🔴 in 24hrs 😎 Dec 2nd and 3rd at 8:30 AM (PST) 🗓️ The agenda for this year is 🔥🔥 aka.ms/Jupyterthon2021Agenda Live Streams 📺(FREE virtual event) Day 1: aka.ms/Jupyterthon2021Live1 Day 2: aka.ms/Jupyterthon2021Live2 @OTR_Community #MSTIC #Jupyter 🙏
1
42
7
73
🚨 Learning how to install #Sysmon for Linux 🐧 & send security events to #AzureSentinel in a research lab environment!! 🧪 #MSTIC #Microsoft 📡 Sysmon (SysinternalsEBPF) -> Syslog -> SIEM 🚀 ✅ Scripts ✅ ARM templates ✅ Sysmon configs and more.. techcommunity.microsoft.com/…
5
170
10
473
🚨 A few detection opportunities while interacting with local AD hybrid health agent registry keys & Azure AD connect health AD FS services ☁️ 📡SACLs & 🛰️Activity Logs (Directory Activity) FTW 🛡️ #AzureSentinel : github.com/search?q=repo%3AA… 🌎 @sigma_hq : github.com/SigmaHQ/sigma/pul…
Dr. Nestori Syynimaa
@DrAzureAD23 Aug 2021
Did you know that local admin can export AD FS Hybrid Health Agent secret and create fake Azure AD sign-in events? 😈 Read my blog "Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent" to learn more & how to do it with #AADInternals 🔥 o365blog.com/post/hybridheal…
1
33
78
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
6
142
22
315
🚨 New version of the Windows Security Events connector from #AzureSentinel reached public preview Looking for a way to test & filter the collection of event logs via XPath queries? I got you! 💜🍻 @MSThreatProtect #MSTIC @OTR_Community @OSSEM_Project techcommunity.microsoft.com/…
5
33
5
115
ThreatHunter-Playbook retweeted
Microsoft Security
@msftsecurity20 May 2021
It's time to go to SimuLand! 🎠🎡🎢 But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses. Get the details: msft.it/6017VxcHv

SimuLand: Understand adversary tradecraft and improve detection strategies | Microsoft Security Blog

At Microsoft, we continuously collaborate with customers and the InfoSec community to learn more about the latest adversary tradecraft so that we can improve our detection strategies across all our...

microsoft.com
7
166
32
329
ThreatHunter-Playbook retweeted
Open Threat Research@OTR_Community27 Apr 2021
Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏 mordordatasets.com/notebooks… 1⃣ A few tool-based comments at the host level 2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
Dr. Nestori Syynimaa
@DrAzureAD27 Apr 2021
New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥 Read the blog at: o365blog.com/post/adfs/ Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!
3
38
70
ThreatHunter-Playbook retweeted
Mary
@BocaChicaGal2 Apr 2021
This morning Starship SN15’s nosecone is heading into the high bay. It appears that SpaceX is not wasting any time in preparing SN15 to roll to the launch site ASAP.🔥🚀🔥 @NASASpaceflight
92
329
26
4,602
ThreatHunter-Playbook retweeted
Jose Rodriguez 🇵🇪@Cyb3rPandaH15 Mar 2021
Replying to @Cyb3rWard0g @OTR_Community @sigma_hq @ProjectJupyter @jack_halon @Flangvik @mvelazco
CVE-2021-27065 - @sigma_hq rule to detect adversaries modifying the offline address book (OAB) virtual directory in Exchange and setting the ExternalUrl property to script. #ProxyLogon chain event PR: github.com/SigmaHQ/sigma/pul…
1
9
23
ThreatHunter-Playbook retweeted
Open Threat Research@OTR_Community14 Mar 2021
Now that #ProxyLogon POCs are public, help defenders learn the underlying behavior? The weekend isn't over yet! @Cyb3rWard0g 1⃣ Azure Sentinel Env: github.com/OTRF/Azure-Sentin… 2⃣ Install 🐍, ⬇️ &💥 POC 4⃣ Share @Mordor_Project datasets, @sigma_hq rules, @ProjectJupyter notebooks
5
85
3
185
ThreatHunter-Playbook retweeted
Roberto Rodriguez 🇵🇪
@Cyb3rWard0g6 Feb 2021
Looking for anything to do this weekend? 😉 🔥 A way to create and start services remotely using the amazing NtObjectManager from @tiraniddo leveraging the latest support for named pipes RPC clients 🔥 Help us to create more PS scripts @OTR_Community blog.openthreatresearch.com/…
38
119
💥😱 @tiraniddo added "named pipe RPC client transport" to NtObjectManager 🔥 Thank you very much James for all your work 👏! I'll create PS scripts to cover a few scenarios 🍻 (Img 4) If anyone would like to help me, let me know 😉 @OTR_Community github.com/Cyb3rWard0g/WinRp…
2
46
2
133
Very happy to see the @OSSEM_Project leading the way to help standardize how we add metadata about the security events and relationships used in the detection rules / analytics we share with the community!! Thank you @Cyb3rPandaH ! I like the "How can you contribute?" section! 🍻
OSSEM@OSSEM_Project28 Oct 2020
Formalizing the mapping of security events to the @MITREattack data source objects concepts 🍻 We would love to hear your feedback and see your contributions to this community-led effort!! 💜 Thank you @Cyb3rPandaH 💜 Blog: medium.com/threat-hunters-fo…
22
1
55
ThreatHunter-Playbook retweeted
Security Datasets@SecDatasets27 Oct 2020
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks…
Johnny Shaw@jxy__s26 Oct 2020
I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging. herpaderping.com/

Process Herpaderping

Detection Evasion Exploit

jxy-s.github.io
1
43
3
119
HOW to contribute a @Mordor_Project dataset in 2 mins ⏳w/ the help of @redcanary ART & then contribute to @sigma_hq after exploring the data! @OTR_Community ♻️ Clear, Exec & Collect: youtu.be/6iteEfbuwU8 😈 Data: mordordatasets.com/notebooks… 🏹 Rule: github.com/OTRF/sigma/blob/m…
1
37
1
84
ThreatHunter-Playbook retweeted
DTM
@dtmsecurity16 Oct 2020
Check out mordordatasets.com/notebooks… and threathunterplaybook.com/not… - Mordor Dataset and Playbook entry for wuauclt.exe abuse with many thanks to @Cyb3rWard0g 🤜 for his epic work as ever! Will be updating blog with these links too for reference 💪
DTM
@dtmsecurity12 Oct 2020
I found an interesting #LOLBIN using Windows Update Client (wuauclt.exe) as a loader - blog, pull request to LOLBAS and in the wild sample here dtm.uk/wuauclt/ - I am hoping to finalise some of my work on the methodology I used soon @MDSecLabs so keep your eyes posted.

Code execution via the Windows Update client (wuauclt)

Its been a few months since my last post about uploading and downloading data with certreq.exe as a potential alternative to certutil.exe in LOLBIN land. I've been having a blast starting my new role...

dtm.uk
1
16
1
40
ThreatHunter-Playbook retweeted
Roberto Rodriguez 🇵🇪
@Cyb3rWard0g5 Oct 2020
Starting your week 🏡 & looking for ways to automate the deployment of #AzureSentinel w/ a basic Windows environment in your lab? 1) Go to GitHub (OTRF/Azure-Sentinel2Go) 2) Click on Win10 scenario 🏗️ -> ☁️ 3) Wait a few mins ⏲️ 4) Play 🚀 5) Repeat ♻️ techcommunity.microsoft.com/…
2
76
2
242
Load more