Lumma Stealer - 995 sinkholed domains by Microsoft gist.github.com/mthcht/4b16e...

it used to be great...

I started another list dedicated to mutex names for detection github.com/mthcht/aweso... Help me enhance this list, I still have plenty more to add!

THIS WEBSITE HAS BEEN SEIZED Discover domains tied to sinkhole NS servers at sinkholed.github.io Filter by TLD or NS, export in JSON/CSV, weekly update! Search for the known sinkhole Name Servers in DNS query logs and web access to the sinkholed domains to identify potentially compromised hosts!

😯 I have 652022 sinkholed domains extracted here github.com/mthcht/aweso...

🎭 #ThreatHunting February updates 🎭 🐙 release: github.com/mthcht/Threa... 🌐 Site: mthcht.github.io/ThreatHuntin... 🧬 yara: github.com/mthcht/Threa... 🐾 Specific artifact lists: github.com/mthcht/aweso...

From over at the Bad Place: There's an interesting NTFS symlink attack outlined here: https://dfir.ru/2025/02/23/symlink-attacks-without-code-execution/ Basically, if an NTFS filesystem is corrupted in a way to provide duplicate file names, Windows will […] [Original post on infosec.exchange]

It took just 3 hours: RCE → Metasploit C2 → Anydesk for remote GUI-access → LockBit ransomware Interestingly, we observed the threat actor using PDQ Deploy, a patch management tool. Read the report here:

A bookmark of my lists is now automatically generated after each update in my repo github.com/mthcht/aweso... I'm also looking to automatically add my starred repos lists github.com/mthcht?tab=s... in this bookmark but there doesn’t seem to be a API endpoint for the stars lists 🤔 ?

It's growing! Now at 38 services and 82 projects 🙈 What's your favorite LoLC2?

Pushed a #KQL for: Successful device code sign-in from an unmanaged device. Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code: | where EndpointCall == "Cmsi:Cmsi" 🏹Query: github.com/Bert-JanP/Hu...

In case you don't want to do this yourself, I just discovered that you can request access to a complete list of all existing domains across 1131 TLDs on czds.icann.org for free, including NS records! The lists are updated every month, approval is required for each TLD 🌍

Hey SDDL SDDL: Breaking Down Windows Security One ACE at a Time www.splunk.com/en_us/blog/s.... Thrilled to share my first blog at @splunk! @mhaggis.bsky.social and I take a deep dive into the weird & exciting world of SDDL and ACEs - what they are, how they work, and how attackers can abuse them.

Path masquerading zerosalarium.com/2025/01/path... Interesting technique, if you're hunting for this, you can directly search the unicode characters in Splunk 🥷

Most SOCs handle hundreds to thousands of detection rules in their SIEM. Proper categorization is essential when creating a new detection, as it helps define criticality, urgency, implementation effort, and verbosity level. Keeping things structured will reducing alert fatigue!

I'll keep this updated, let me know if you have any projects to add! some C2 candidates: github.com/lolc2/lolc2....

Cert Central .org is live! We track and report abused code-signing certs. By submitting to the website, you contribute to the DB of >800 certs—a DB you can access and view. Want to get more involved? Check out the Training and Research pages to learn more. 1/2

#ThreatHunting ideas for detecting command-line obfuscation techniques from github.com/wietze/Invok... with Splunk! (examples with EID 4688) Mixed Case Randomization Detection: This query counts uppercase/lowercase letters and return command lines with a near-equal ratio

I have a list of NS used for sinkhole domains and seized servers: raw.githubusercontent.com/mthcht/awesome… I'm searching for the domains, on my server I can resolve a record type for ~400 million domains per day with github.com/blechschmidt/m��� 😃 Massive improvement compared to other solutions!

I frequently get asked is "what skills do I need need to excel as an analyst", so I figure this is a good opportunity to shed some light on what analysis is, and why certifications alone won't make you a good analyst. www.jaiminton.com/high-impact-...

Say goodnight to the bad GUIDs ! badguids.github.io

There seemed to be enough interest so I decided to do a write up on what I have found about OneDrive Offline Mode. Hate to burn a forensic artifact but I’m concerned about what Microsoft feels is secure. #DFIR https://malwaremaloney.blogspot.com/2025/01/onedrive-offline-mode-recallish-vibes.html

#LOLBAS project update: Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation. Check it out: ⭐ lolbas-project.github.io

Adding character(s) to Command Line processing www.hexacorn.com/blog/2024/01... #threathunting

❄️ #ThreatHunting December + January updates ❄️ 🐙 release: github.com/mthcht/Threa... 🌐 Site: mthcht.github.io/ThreatHuntin... 🧬yara: github.com/mthcht/Threa... 🐾Specific artifact lists: github.com/mthcht/aweso...

I like these Threat Profiles pages! grab the IOCs, cross-check with your database, kick off a quick hunt 👌 app.validin.com

LOLC2 - a collection of C2 projects that operate exclusively through legitimate services lolc2.github.io, I'm probably missing some projects let me know ! 🌐 lolc2.github.io 🐙 github.com/lolc2/lolc2....

🥳👇

Are you hunting for BAD ASN IP ranges? my lists are automatically updated on github github.com/mthcht/aweso... Try searching for these IPs in your successful login logs or outbound network requests 🔎 (consider these as low signal for correlation or threat hunting sessions

I made a windows #DFIR artifacts collection MindMap, it's tough to fit everything into a readable overview (might change later)

Clean hash set - 12M rows www.hexacorn.com/blog/2024/12...

I just pushed a huge update to the project with 5,000 new reports, bringing the total to over 16,000! The next one’s going to be massive too!

Stealer repos on GitHub with their topics 😋 Saving this for later analysis: gist.github.com/mthcht/82885...

Pretty sure not many are hunting for VM tool usages. This persistence technique, used by Ragnar Locker ransomware, deserves more attention from defenders: embracethered.com/blog/shadowb...

My intelligence-gathering sheet for planning #ThreatHunting sessions

🦃 #ThreatHunting November updates 🦃 🐙Project: github.com/mthcht/Threa... 🏹 Site: mthcht.github.io/ThreatHuntin... 🧬 yara: github.com/mthcht/Threa... 🧬Specific artifact lists: github.com/mthcht/aweso...

Knowledge is power! Prepare your #ThreatHunting sessions by gathering intelligence reports on specific topics - could be tools, patterns, or threat actor groups 🏛️ mthcht.github.io/ThreatIntel-... Now featuring more than 1,000 search results in over 11,000 Intelligence Reports updated regularly!

On the hunt for all the tools this ransomware group used 🔭

Just a heads up. M$ is OCRing all your images in OneDrive for business in an unsecured database on your desktop/laptop. Happy Friday. #DFIR

Apparently, this is a thing 🤔 the legit Ookla speedtest.exe downloaded and executed by Dagon Locker and Dispossesor ransomware group (as far as i know) for network assessment

Check out our new report on a TA4557 intrusion. Make sure your team that handles resumes recognises these fake lures!

Windows.Storage . lol www.hexacorn.com/blog/2024/11...

Initial Access Detection Opportunities 🖥️ Quickassist detection: x.com/mthcht/statu... ✉️High volume of external emails sent to a single recipient 💬Teams interaction with a foreign tenant x.com/mthcht/statu... x.com/hir3n_s/stat... filter on usernames with IT,Help,Desk,support,Tech,Customer,Microsoft

So this is fun. I rarely check the DEFAULT registry give but in a recent investigation I saw evidence of a Sysinternals tool in here which gave me more confidence of program execution. Usually this is in an NTUSER but attacker was executing through the apppool user. #DFIR

Good morning, or evening. After a months, we're finally releasing the Dispossessor ransomware leaks. They're now available to download. Please exercise extreme caution. This archive contains ransomware payloads. vx-underground.org/Archive/Disp...

You can find download links to publicly-accessible disk images in this Insights article: arsenalrecon.com/insights/pub.... If you know of any more, please let us know!

If you're interested in Linux DFIR? Then check all our talks/workshops below. #Linux #DFIR #Cybersecurity CC: @maryst33d.bsky.social linuxdfir.ashemery.com

Week 47 - 2024 #DFIR thisweekin4n6.com/2024/11/24/w...

I’m looking for a new remote work opportunity starting in April. If you think I’d be a good fit for your team, let me know!

Great training materials available here: github.com/mthcht/aweso...