Sam ☁️🪵
@Sam0x90
Followers
1K
Following
2K
Media
183
Statuses
2K
SOC/Intel | @SANSInstitute | @PacktAuthors https://t.co/itz9Mly1hK Love #PurpleTeaming #DE #CTI #DFIR
EMEA
Joined January 2010
💜Adversary Simulation and Purple friends💜.I'm happy to share this simulation plan which regroups a TOP 35 @MITREattack TTPs from 22-23. Based on open source intel, it's meant to ease the onboarding of more into Purple!.Have a look at the readme #CTI #TTP.
10
106
387
If anyone needs to convert the DarkWebInformer json into csv here is a quick script to properly convert it: .
0
0
0
@MITREattack Some tuning needed depending on the model by getting the right system prompt and settings like Top K if you want good accuracy and avoid hallucination.
1
1
1
#CTI #LLM #RAG.If anyone wants to use RAG with their LLM for the @MITREattack I've uploaded a quick script to convert json to md. Useful in your Ollama/Open WebUI setup. Chunking/embedding done auto by OpenWebUI. Then the model can refer to the KB.
2
11
71
Finaly payload googlerestricted.ide --> msbuild.exe. @NullPwner so stealc?.
🚨 Same Threat Actor is now delivering Windows Payload through the ~2800 compromised sites using ClickFix. It dinamycally changes depending on platform (user-agent) Mac/Win. 1: https://e.overallwobbly[.]ru/au1 (Dropper1: era-stau1.a) → PowerShell → Stage 1 Script (AutoIT). 2:
1
0
3
RT @MalDevAcademy: The Offensive Phishing Operations Course has been released. 81 modules are included in the initial launch, with the fir….
0
181
0
He's back!.
Based on the intel report screenshot below from Microsoft. I had added detection rules to my KQL repo .Same queries can be found in see screenshot .#ATP #ThreatHunting #KQL #SOC
0
0
1
RT @TheDFIRReport: 🌟New report out today!🌟. Confluence Exploit Leads to LockBit Ransomware. Analysis & reporting completed by Angelo Violet….
0
57
0
RT @MichalKoczwara: Threat Actor is using Gophish to impersonate/target KPMG (financial department). /64.227.171.144 (0/94 VT)./financeekp….
0
24
0
Is that a (sub)technique @MITREattack @jamieantisocial ?.". injects malicious code into. mstsc.exe"."injected code is a shellcode that loads another malicious library. to steal RDP credentials by hooking specific functions of the Windows library “SspiCli.dll”.
1
0
2
RT @br0k3ns0und: We are now developing @elastic threat hunting queries, alongside our detection rules, and openly sharing these as well! 🎉🎉….
0
86
0
Yes yes I know. yet another LOL, lol, but I believe we need this one too. Welcome to LOST: I recently added the new @msftsecurity Defender path exclusion listing technique shared by @VakninHai on WIP, we need you!. #LOLBAS #LOST
🚧WiP.Project LOST - Living Off Security tools to track security tools being utilized by pentesters/TAs to conduct activities like C2, command exec, data collection. do a pull request with your faviourite tool to add.#LoLBin #threathunting #EDR.
0
12
45
RT @OutflankNL: New Blog Alert! 🚨. Introducing Early Cascade Injection, a stealthy process injection technique that targets Windows process….
0
186
0
RT @magicswordio: 🚨🔥 LOLRMM IS LIVE! 🔥🚨. The wait is over, folks! 🥳🎉. We’re thrilled to announce the official release of LOLRMM — your new….
0
112
0
RT @binitamshah: Building an EDR From Scratch Part 1 - Intro (Endpoint Detection and Response) :
0
66
0
RT @0xanalyst: New phishing campaign that is sent to a lot of github repo owners. Has a powershell that drops what seems to be an infosteal….
0
2
0
Nice ALPHV simulation plan using @redcanary #ART. I suggest using @secrisk Vectr or my spreadsheet below (shameless plug). Currently using it again to help customer map their security controls to TTPs and assess efficiency for improvement. #PurpleTeam.
💜Adversary Simulation and Purple friends💜.I'm happy to share this simulation plan which regroups a TOP 35 @MITREattack TTPs from 22-23. Based on open source intel, it's meant to ease the onboarding of more into Purple!.Have a look at the readme #CTI #TTP.
0
22
83