Security Researcher | Previously threat research @Zscaler/@Securonix | Blog @ https://teapawt.net/t.co/8j1uV0aGPx | #DFIR #MalwareAnalysis #ActiveDirectory
Joined March 2011
- Tweets180
- Following138
- Followers1K
- Likes518
Pinned Tweet
I've started a new personal blog site.
If you are new to Active Directory, these blogs will help you to understand fundamentals of Active Directory, its different components, several AD attacks, concepts behind them & their detections.
rootdse.org/posts/active-dir…
Madhukar Raina retweeted
🚀 Excited to announce the launch of ExtensionHound! My new Open-Source Tool for Chrome Extension DNS Forensics
Chrome extensions often operate as black boxes, making network activity attribution nearly impossible. Traditional monitoring tools only show traffic originating from the chrome process, leaving security teams guessing which extension is behind a suspicious DNS query.
ExtensionHound addresses this challenge by analyzing Chrome’s internal network state and correlating DNS activity with specific extensions. It’s a purpose-built solution for investigating potentially malicious or unexpected extension behavior.
Key Features:
🔍 Visibility into DNS requests linked to individual Chrome extensions.
🔍 Optional VirusTotal integration for domain reputation analysis.
🔍 Flexible output formats to fit into your workflows.
🔍 Cross-platform support for Windows, macOS, and Linux.
ExtensionHound is designed for incident responders seeking better visibility into browser extension behavior, enabling faster and more precise investigations.
Explore the project on GitHub: github.com/arsolutioner/Exte…
Looking forward to your feedback and contributions!
Madhukar Raina retweeted
I am happy to announce JonMon2.0 has been published.
2.0 offers a lot of feature updates, as well as stability. More features still to come as time goes on. Enjoy and let me know if you have any issues or questions.
Link: github.com/jsecurity101/JonM…
Madhukar Raina retweeted
This new article from @dez_ reveals 4 attack techniques linked to SmartScreen and SmartAppControl. Check it out: go.es.io/4d5L2BR
Will you be at #BHUSA? Stop by @elastic booth #2350 to chat with Joe or catch his lightning talk!
#ElasticSecurityLabs #threattechnique
Madhukar Raina retweeted
We are proud to announce our very first technical blog post. An analysis of CVE-2024-21338, a Windows Kernel Elevation of Privileges vulnerability, its root cause, exploitation challenges and POC
crowdfense.com/windows-applo…
Madhukar Raina retweeted
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
Nice project for detection engineers. Good job @br0k3ns0und
Super excited to finally release a project I have been working on for the last few months!
🎊🎊 Introducing the REx: Rule Explorer project and Detection Engineering Threat Report (DETR) 🎉🎉
br0k3nlab.com/posts/2024/07/…
If you found LoFP from lolol.farm useful, this provides significantly more insights via a much more powerful platform (built on the @elastic stack!)
Happy hunting!
#DetectionEngineering #Security #ThreatHunting
Madhukar Raina retweeted
23 new Windows endpoint behavior detections/protections added - covering a variety of TTPs (including #grimresource shellghost and more)
github.com/elastic/protectio…
Madhukar Raina retweeted
I’m excited to announce that I have partnered with @zeropointsecltd to release my first educational course, BOF Development and Tradecraft. Learn how to write BOFs by following step-by-step instructions to create three operation-ready tools!
Link: training.zeropointsecurity.c…
Madhukar Raina retweeted
Holy shit #Recall is storing full text of your terminal commands in plaintext:
Madhukar Raina retweeted
MSI Leading to PlugX virustotal.com/gui/file/51d3…
- Zoom Meeting Theme
- DLL Side Load (File Master LLC)
- C2: buyinginfo[.]org
Yara: {4508ffb060030000e8a80c000083c4248d450889}
Elastic Detonate Results Below
#ProTip: For anyone looking for a temporary virtualized environment for testing malwares or other softwares or even to browse web, Windows Sandbox is a good built-in feature. It is very lightweight, throwaway kind of virtualized environment that provides a secure and isolated space to run potentially unsafe applications or to perform testing without affecting the main system. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine.
Works on Windows 10/11 Pro and Enterprise editions.
To enable it, go to "Turn on Windows features"> Windows Sandbox
Everything required for this feature is already included in Windows. There's no need to download anything additional.
Close the sandbox and all the software and files and the state are gone. Open the sandbox, and it is ready with a brand new temp environment.
The sandbox can be configured using a .wsb configuration file where you can enable or disable network, add some logon commands and much more.
#malwareanalysis #cybersecurity #DFIR
linkedin.com/pulse/windows-s… via @LinkedIn
Madhukar Raina retweeted
Wrote a detection tool which analyzes stack and thread metadata to find anomalies and hunt beacons from various C2 frameworks irrespective of sleep masking mechanisms such as Ekko, foliage or timers etc. Detects every c2 framework except ofcourse BRc4. Will publish this post a little polishing. Heres a quick video on it.
Madhukar Raina retweeted
new detection for multi-steps/split process injection pushed out
Example of PoCs:
github.com/Maldev-Academy/Ch… github.com/Kudaes/Split
Detection:
github.com/elastic/protectio…
Madhukar Raina retweeted
I published a step by step guide on using Windows event logs to hunt for malware trying to steal sensitive data from browsers e.g. cookies, passwords etc. security.googleblog.com/2024… #DFIR Hope it's useful!
Madhukar Raina retweeted
The xz backdoor was initially caught by a software engineer at Microsoft. He noticed 500ms lag and thought something was suspicious.
This is the Silver Back Gorilla of nerds. The internet final boss.
Madhukar Raina retweeted
New #PEsieve/#HollowsHunter (v0.3.9): github.com/hasherezade/pe-si… & github.com/hasherezade/hollo… - now you can search for your own signatures in memory. Details: github.com/hasherezade/pe-si…. Check it out!
Madhukar Raina retweeted
Mandiant researchers present the evolution of UNC4990, an actor that makes heavy use of USB devices for initial infection. UNC4990 primarily targets users based in Italy and is likely motivated by financial gain. mandiant.com/resources/blog/…
Madhukar Raina retweeted
Happy New Year! I have for you a new #PEbear (v0.6.7) with some of the requested features, such as strings, and patterns searching. Plus other improvements & bugfixes. Check it out! github.com/hasherezade/pe-be… 🐻💙
Madhukar Raina retweeted
New blog: Phishing for Primary Refresh Tokens and Windows Hello keys. This blog describes how we can use device code phishing to obtain PRTs and in some cases even add backdoor Windows Hello keys 🤯
dirkjanm.io/phishing-for-mic…