Bashar (@1337bash) header
Bashar (@1337bash) profile picture

Bashar

@1337bash

I hunt for a living. I like breadcrumbs. Views expressed are my own.

 United States
Joined June 2012
  • Tweets752
  • Following758
  • Followers206
37Media
Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)Photo by Bashar (@1337bash)
Free Offensive Security Notes (OSCP, OSWE, OSEP, OSED) OSCP NOTES AD: drive.google.com/file/d/14ji… OSCP Notes : drive.google.com/file/d/1eYU… OSWE Notes: drive.google.com/file/d/1KIc… OSEP Notes: drive.google.com/file/d/1L9m… OSED Notes: drive.google.com/file/d/1_mP… #oscp #osed #oswe #osep #osce³ #pentest #hacking #infosecnotes #cybersecurity @elvtnx
Image from X (@TheMsterDoctor1)
Image from X (@TheMsterDoctor1)
Image from X (@TheMsterDoctor1)
Image from X (@TheMsterDoctor1)
26
860
10
2,444
242,060
Business email compromise doesn't get the same coverage as other cyber attacks, but it's still ubiquitous. If you use Sentinel or M365 Defender this article from @PeteABryan is an absolute must read. Great queries, guidance and threat intelligence for BEC- techcommunity.microsoft.com/…
1
48
168
19,595
New blog post! I love when adversaries use VHD files to distribute malware because VHDs can potentially contain a lot more data than the adversary intends to distribute. To see what I mean, check out this post: forensicitguy.github.io/vhd-… #malware #vhd

Malware via VHD Files, an Excellent Choice

Adversaries use lots of different file formats to distribute malware and one of my favorites has to be Virtual Hard Disk (VHD) files. You may have seen VHD files used with virtualization solutions...

forensicitguy.github.io
3
75
177
28,173
Nice series here >> Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells) pberba.github.io/security/20… (and good summary map in pberba.github.io/assets/post…)
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)

Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)

An introduction to monitoring and logging in linux to look for persistence.

pberba.github.io
2
49
122
12,695
Citrix Gateway VPN compromised via CVE-2023-3519 (a critical unauthenticated RCE) shows evidence of exploitation on 7th July, 11 days before the official patch. The attackers exfiltrated the system configuration file to then probably use the Metasploit module called "citrix_netscaler_config_decrypt" and gain access as the user "nsroot" (full system access), other important secrets about the network and internal users are leaked. Webshell/backdoor logout.php has 0 detections in VirusTotal, I shared it here: virustotal.com/gui/file/293f… 🚨 If you performed the update process to mitigate this vulnerability, assume that you might be compromised and perform a full assessment of the instances and users involved. Follow these recommendations: - cisa.gov/news-events/cyberse… - cisa.gov/news-events/cyberse…
Image from Germán Fernández (@1ZRR4H)
Image from Germán Fernández (@1ZRR4H)
Image from Germán Fernández (@1ZRR4H)
Image from Germán Fernández (@1ZRR4H)
8
220
6
572
139,208
Citrix NetScaler ADC CVE-2023-3519 resources -- Compromise Assessments @CISAgov advisory cisa.gov/sites/default/files… Deyda guide deyda.net/index.php/en/2023/… -- Vuln Checks Python github.com/telekom-security/… Nmap NSE script github.com/RootUp/PersonalSt… I'm gonna add more links in this🧵
5
147
3
356
67,417
Yesterday, I presented @jsecurity101 and my Malware Morphology workshop at @NorthSec_io. Thanks to the organizers and everyone who attended. If you missed it, you’re in luck the recording is available! 📼 Video: youtube.com/live/KTAeUjDBW3s… 🗒️ GitHub: github.com/jaredcatkinson/Ma…
Malware Morphology for Detection Engineers

Malware Morphology for Detection Engineers

As Defenders it is easy to view attacker behavior through a Techniq...

youtube.com
4
95
3
258
57,131
Today, me and @ateixei are releasing the EDR Telemetry project. This project aims to compare and evaluate the telemetry of various EDR products. ✅Introductory blog post: t.ly/9Ia3 ✅GitHub Repo: github.com/tsale/EDR-Telemet… ✅Comparison Table: t.ly/HMht
EDR Telemetry Project: A Comprehensive Comparison

EDR Telemetry Project: A Comprehensive Comparison

Endpoint Detection and Response (EDR) products have become essential to organizations’ cybersecurity strategies. As a result, understanding…

detect.fyi
44
322
20
798
169,377
PSA: Major new Timesketch release - the open source #DFIR timeline analysis platform. We have been working on redesigning and improving the user experience. 🧵Thread with screenshots:
6
62
4
150
34,561
Some really great sites you should bookmark loldrivers.io/ (just released) gtfobins.github.io/ lolbas-project.github.io/ lots-project.com/ filesec.io/ malapi.io/
LOLDrivers — Living Off The Land Drivers

LOLDrivers — Living Off The Land Drivers

Explore vulnerable and malicious Windows drivers, sample hashes, detections, and investigation tools.

loldrivers.io
25
381
5
1,040
117,438
Hey defense & blue team people ICYMI Kali released Kali Purple which is essentially SOC in a box with cool tools like TheHive, Suricata, Arkime, Elastic SIEM & Malcolm all bundled together & makes a great starting tool for getting defenses up gitlab.com/kalilinux/kali-pu…

Kali Linux / kali-purple / Documentation · GitLab

The ultimate SOC-in-a-box community project

gitlab.com
5
49
1
158
33,564
Hey #DFIR community... if you want to play with some basic Anti-Forensic stuff related to the NTFS file system, please check the challenge me & @maryst33d created. I don't want to spoil it, but there is probably something in it that not many know about! ashemery.com/dfir.html#Chall…
2
24
1
87
12,808
schtasks /create /tn "Task Name" /tr "C:\path\to\program.exe" /sc onstart /ru SYSTEM
Image from mRr3b00t (@UK_Daniel_Card)
19
74
5
367
89,437
❗Exciting news!❗ We've published nearly all the #BlueHat 2023 videos on the Microsoft Security Response Center (MSRC) YouTube channel. Happy viewing! 📺 msft.it/60195lV6Z
Microsoft Security Response Center (MSRC)

Microsoft Security Response Center (MSRC)

The Microsoft Security Response (MSRC) team identifies, monitors, responds to and resolves security incidents and vulnerabilities in Microsoft software. This helps our customers manage security...

youtube.com
2
100
1
274
31,964
"Parsing Multiple Registry Hives using VSC Toolset and RegRipper" #DFIR Probably one of those underrated tools that I really think you should check!... Hopefully this video will convince you to start using it in your investigations. Thanks @jasonshale youtube.com/watch?v=LokqW4nq…
Parsing Multiple Registry Hives using VSCToolset and RegRipper

Parsing Multiple Registry Hives using VSCToolset and RegRipper

This video explains how you can take advantage of a great tool name...

youtube.com
5
26
2,594
The following 5 workshops simulate multiple security events. Brought to you by the AWS Customer Incident Response Team (CIRT) 👇
3
87
2
247
42,551
Great new tool by @bananabr to find folders excluded from antivirus scanning by comparing file write times across tested folders. Writes to excluded folders finish much faster as they don't have their writes intercepted by AV. Clever! github.com/bananabr/TimeExce…
3
84
2
216
27,949
here are the slides from the talk @eric_capuano and i gave at @cactuscon on "Security Operations with Velociraptor": reconis.co/secops_with_vr you can watch the stream here: reconis.co/secops_with_vr_st… #CC11 #CactusCon #DFIR #infosec #secops #velociraptor @velocidex @Recon_InfoSec
Image from Whitney Champion 🍪🚀 bluesky @whit.zip (@shortxstack)
5
69
1
235
37,926
1/ We recently had a case where a TA compromised an Azure Global Admin account. The TA used the compromised account to spun up over 200 VMs to mine cryptos with it. The compromise was only noticed due to skyrocketing Azure costs. 💸 🧵 #CyberSecurity
28
103
14
479
196,364
Uploaded all my Offensive Security & Reverse Engineering (OSRE) course labs (docx) to my repo found below. Most of them have very detailed instructions and should be great to get you started in Software Exploitation. 1/n #Offsec #SoftwareExploitation #RE exploitation.ashemery.com/
Image from Ali Hadi | B!n@ry (@binaryz0ne)
92
1,731
31
5,379
534,406
Load more