@snkhan

Malware, Forensics, Penetration Testing and food.

 London, United Kingdom
snkhan.co.uk
Joined April 2007
  • Tweets19.6K
  • Following326
  • Followers941
I won’t be maintaining or monitoring this account much longer, but you’ll be able to find me over at: infosec.exchange/@snkhan – at City of London, London

Sajid Nawaz Khan :donor: (@[email protected])

332 Posts, 479 Following, 159 Followers · CTI, DFIR, Python Data Analysis. Oh, and food, films, museums, plants, and kindness 🏳️‍🌈🇬🇧

infosec.exchange
1
1
2,855
Replying to @ninoseki
@ninoseki Hello Ninosekisan, I wondered whether you could help me with a Ruby selector query! I’m trying to only process rows from a CSV that contain “Cobaltstrike”. I’ve tried include, match and scan, but these all return Boolean. I need the full string so I can pass to map.
1
590
I was hoping to do something like this with the Mihari Feed selector: selector: "scan(/Cobaltstrike/).map { |v| v[0] }" Obviously this isn’t working because only the Boolean is passed to the map function, rather than the entire row for map to process. Appreciate your insight!
1
1
414
Replying to @santanderukhelp
@santanderukhelp Been sending this feedback to your Mobile Banking App Pilot team for weeks, with no response or fix. The “Pending” label is not vertically aligned in the box compared to the text in all other screens that use the same layout.
1
1
754
Thanks for fixing this! Next, can you increase the distance from the bottom of the “Back” label to the bounding beneath it, so it’s consistent across the Accounts and Transaction screens please? (Ideally by increasing it on the Transaction screen).
2
531
Sajid Nawaz Khan retweeted
にのせき@ninoseki26 Jan 2024
Finished my #JSAC2024 workshop this morning. ninoseki.github.io/jsac_miha… Thanks to @snkhan for his kindly help!
2
22
2,259
Replying to @cyb3rops
@cyb3rops @nextronsystems Hi Florian, hope you’re well! Just puzzled by this binary — the behaviour tab has a configuration that is consistent with a Cobalt Strike Beacon, but the binary is signed by Nextron Systems, and has 0 detections … virustotal.com/gui/file/48fd…
1
1
404
Looks like it is a legitimate Thor Cloud binary giving the signing information and network traffic, but curious about the attempted Beacon configuration extraction.
270
1/2 Threat groups are increasingly leveraging legitimate tools, such as RMM services, as part of their attack chains. Additionally, tunnelling tools are often deployed to bypass defensive controls by proxying traffic through services such as ngrok, and more recently, Cloudflare.
1
1
532
2/2 The latest @sigma_hq release includes a number of new and updated rulesets, including my own contribution, which aims to identify the creation of ad-hoc and ephemeral Cloudflare Quick Tunnels. Cloudflared Quick Tunnel Execution github.com/SigmaHQ/sigma/blo…… #dfir #threathunting
279
🪄The final #SigmaHQ r2023-12-21 release for this year is upon us. 🌟21 New Rules 🛡️55 Rule updates 🔬 30 Rule Fixes This release focused a lot on tuning and updating older rules. But we couldn't not finish the year without including a couple of interesting detections. - New detections for the Cloudlfared utility covering renamed versions, CLI options and DNS queries. - Coverage of some of the tradecrfat and IOCs used by the SVR/Cozy Bear as reported by CISA - A couple of MacOS rule targeting potential system information discovery using some built-in tools And much more 🚀 You can read about this by checking the release highlight blog -> blog.sigmahq.io/sigmahq-rule… Or check the full change log and start exploring this, by downloading the latest release -> github.com/SigmaHQ/sigma/rel… A special thanks to the many contributors that helped shape this release, specifically AaronS97, AdmU3, Blackmore-Robert, @celalettin_trgt, @frack113, GtUGtHGtNDtEUaE, @Joseliyo_Jstnk, mcdave2k1, @MosiMoradian, @phantinuss, @qasimqlf, Arnim Rupp, Stephen Lincoln, @snkhan, Swachchhanda Shrawan Poudel, tr0mb1r, @X__Junior
13
1
38
9,817
Replying to @StefanLdhl
@StefanLdhl Hello! The latest Countdown update has broken widgets entirely for me. The Event list is either not being populated, or only contains a fraction of events in the widget picker, vs what’s in the app. Appreciate your help!
2
1
668
Going into each event and resaving it appears to fix the issue.
474
IMPORTANT: Surprise shadowserver.org domain suspension (changed to clientHold). Currently working hard to escalate with registrar and get back online, but all services currently impacted, including email
1
17
5
24
21,022
Anyone have any suggestions as to how to decode a PowerShell SecureString via CyberChef? I have the Base64 blob, and a key, but can’t see any obvious way to decode. I can’t use the PowerShell IDE / debugger, it has to be a pure CyberChef solution. Thanks! /cc @mattnotmax – at Sheffield, England
3
3
5,169
Quite easily the most comprehensive (and frankly, outstanding) analysis of commercial RMM and cloud storage tools leveraged in human operated ransomware intrusions, by the @TrendMicroRSRCH team: jsac.jpcert.or.jp/archive/20… 1/2 – at City of London, London
1
6
17
4,140
Featuring detection opportunities for: RMM: AnyDesk, Atera, ConnectWise, LogMeIn, ngrok, RemoteUtilities, Splashtop, SupRemo, TeamViewer and TightVNC. Sync: FileZilla, FreeFileSync, GoodSync, MEGA, RClone and WinSCP. 2/2 #cti #dfir #threathunting – at City of London, London
1
627
Another insightful post by Matt Richard, this time on the subject of (over) sharing: medium.com/@mrichard91/omnip… 1/3 – at Leicester, England

Omnipotent adversary fallacy — should you give up your asymmetric advantages in cyber threat intel?

I previously shared some common cyber threat intelligence biases I have seen across many teams and organizations. The fallacy of the…

medium.com
1
1
317
“Bottom line — defenders create asymmetries by finding repeated signals and deploying that intelligence; revealing this information is necessary to protect others but comes at the cost of potential exposure, which negates the benefit.” 2/3 – at Leicester, England
1
212
Please don’t be discouraged from sharing — but do so in the appropriate communities, and with consideration of the potential advantage you might inadvertently be offering the adversary. PS — and absolutely don’t just do it for the clout. 3/3 – at Leicester, England
232
Replying to @c3rb3ru5d3d53c
@c3rb3ru5d3d53c Hi there, I’ve been following along with the OALABS demo of Binlex and wondered whether the outputs had changed at all? Instead of the `uniq -c` counts, the output I’m getting is JSON, making it harder to see the common traits. Thanks! youtube.com/watch?v=hgz5gZB3… – at City of London, London

Introduction To Binlex A Binary Trait Lexer Library and Utility -...

Join us with special guest @c3rb3ru5d3d53c for a deep dive into Bin...

youtube.com
1
261
Actually, using the `jq` example from the repo sorts this, thanks! – at City of London, London
1
1
156
Replying to @shodanhq
@shodanhq Good morning! I’m seeing an usually high number of Cobalt Strike detections today, using the “product:”Cobalt Strike” query: shodan.io/search?query=produ… #CobaltStrike – at Islington, London
1
1
417
From the 1,728 results, 39.8% don’t have an associated Beacon configuration. Has the way in which you identify these hosts changed in the past few days? I am reasonably confident that not all the identified hosts are actually Cobalt Strike … – at Islington, London
1
309
Replying to @LloydLabs
@LloydLabs Hi Lloyd, I’m eagerly awaiting your `exphash` PR, and noticed that the pefile implementation here github.com/erocarrera/pefile… returns the SHA256, whilst the PR for YARA expects a MD5. Would it not make sense to align the output from pefile to reflect the input for YARA? – at City of London, London

Add Export Hash Method by LloydLabs · Pull Request #354 · erocarrera/pefile

Much like an imphash, an exphash is simply a SHA-256 hash of the exports defined in the Export Address Table. This is helpful for comparing PE files which export functions, which can then be compar...

github.com
1
269
The workflow I’m expecting is to use pefile to generate the export hash, and then to plug that value into my YARA condition. At the moment this won’t work because pefile generates a SHA256, and YARA’s implementation requires an MD5. Forgive me if I’ve not understood this. – at City of London, London
1
197
I guess eventually I’d just use @stvemillertime’s RonnieColemanYARAParser (github.com/stvemillertime/Ro…) to print the MD5 using YARA’s console, i.e., pe.exphash. – at City of London, London

GitHub - stvemillertime/RonnieColemanYARAParser: An experimental script to perform bulk parsing of...

An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging. - stvemillertime/RonnieColemanYARAParser

github.com
1
171
Load more