Wojciech Cieślak (@bodziurity) profile picture

Wojciech Cieślak

@bodziurity

Opinions are my own.

Joined April 2021
  • Tweets29
  • Following48
  • Followers58
11Media
Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)Photo by Wojciech Cieślak (@bodziurity)
We just released a new research about #Rilide Stealer on #SpiderLabs Blog. It features new functionalities, adaptation to Google Chrome Manifest V3 and some interesting in the wild campaigns 🔥 trustwave.com/en-us/resource…
1
1
271
This is a good #Shodan exercise and if you look closely you'll see that one of the TAs is a prankster. But the joke's on him, you can #Rickroll to find additional malicious infrastructure 🕺 teapawt.net/MichalKoczwara/status/…
Image from Wojciech Cieślak (@bodziurity)
Image from Wojciech Cieślak (@bodziurity)
Michael Koczwara (@MichalKoczwara) profile pictureMichael Koczwara
@MichalKoczwara19 May 2023
This is a great finding from @drb_ra from this one node 37.220.31.54 you can pivot with Censys and Shodan and uncover Bianlian C2 Infrastructure 🔥 threatfox.abuse.ch/browse/ma…
Image from Michael Koczwara (@MichalKoczwara)
3
4
20
3,681
Theory on #3CX exploitation. It may be related to Critical #CVE-2022-28005. Look for suspicious requests to /Electron/download/windows. Anyone can confirm? opencve.io/cve/CVE-2022-2800…
2
2
2
9
5,940
We've seen mass scanning activity on the honeypots from 197[.]248[.]10[.]44 around March 23-25.
1
2
899
CVE description kinda match Crowdstrike's observation. Not sure about the signed binary part though.
Image from Wojciech Cieślak (@bodziurity)
Image from Wojciech Cieślak (@bodziurity)
1
838
Fun #Follina (and not only) fact, you can add whatever after the '!' and exploit still works 🙃
Image from Wojciech Cieślak (@bodziurity)
Wojciech Cieślak retweeted
Vitali Kremez (@VK_Intel) profile picture
Vitali Kremez@VK_Intel4 Mar 2022
One more down: 👇"bentley aka "Max Galochkin" aka "volhvb" aka Conti ransomware group technical lead - his unique alias "volhvb" logged into RaidCall via his own YouTube video youtube.com/watch?v=K2OmGByM… ➡️into alias "volhvb" in Conti chats
Image from Vitali Kremez (@VK_Intel)
Image from Vitali Kremez (@VK_Intel)
1
13
2
51
Simple #yara rule for #SocGholish fake update JS files. github.com/Neo23x0/signature…
Image from Wojciech Cieślak (@bodziurity)
Image from Wojciech Cieślak (@bodziurity)
3
1
2
Wojciech Cieślak retweeted
The DFIR Report (@TheDFIRReport) profile picture
The DFIR Report
@TheDFIRReport24 Jan 2022
Cobalt Strike, a Defender's Guide - Part 2 ➡️In this report we talk about domain fronting, SOCKS proxy, C2 traffic, Sigma rules, JARM, JA3/S, RITA & more. Big shout-out to @Kostastsale for helping put this together! thedfirreport.com/2022/01/24…
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
6
337
25
746
Wojciech Cieślak retweeted
Wojciech Lesicki (@WLesicki) profile picture
Wojciech Lesicki@WLesicki28 Sep 2021
Interesting report about #cobaltstrike . We have here both what techniques are used by threat actors, but also how to emulate them. And, of course, detect. I’m very pleased that the @sigma rule created by @cyb3rops and me was mentioned.
Image from Wojciech Lesicki (@WLesicki)
Recorded Future (@RecordedFuture) profile pictureRecorded Future@RecordedFuture14 Sep 2021
Cobalt Strike was created with the best of intentions, but it has quickly gained traction with threat actors who use it for nefarious reasons. Learn more about how to detect Cobalt Strike in this deep-dive: bit.ly/3CpzmHF
2
24
2
54
Looks like there is new ITW CVE-2021-40444 sample. d793193c2d0c31bc23639725b097a6a0ffbe9f60a46eabfe0128e006f0492a08 hxxp://hr[.]dedyn[.]io/word[.]html hxxp://hr[.]dedyn[.]io/word[.]cab #CVE202140444
1
1
teapawt.net/bodziurity/status/1438…
Wojciech Cieślak (@bodziurity) profile pictureWojciech Cieślak@bodziurity15 Sep 2021
Replying to @bodziurity
And another one d733385ec0aa59ca5d07ac376a81c3a5e8ee29ea52871a897dd67b2822df9727 hxxp://wiyolo[.]com/b2cb1c3aec23c1c7/realise[.]html hxxp://wiyolo[.]com/b2cb1c3aec23c1c7/farm[.]cab
Image from Wojciech Cieślak (@bodziurity)
And another one d733385ec0aa59ca5d07ac376a81c3a5e8ee29ea52871a897dd67b2822df9727 hxxp://wiyolo[.]com/b2cb1c3aec23c1c7/realise[.]html hxxp://wiyolo[.]com/b2cb1c3aec23c1c7/farm[.]cab
Image from Wojciech Cieślak (@bodziurity)
1
1
cc @malwrhunterteam
1
Wojciech Cieślak retweeted
Florian Roth ⚡️ (@cyb3rops) profile picture
Florian Roth ⚡️
@cyb3rops10 Sep 2021
Sigma rule to detect file creation pattern as noticed in CVE-2021-40444 exploitation Report by @RonnyTNL teapawt.net/RonnyTNL/status/143636… Sysmon config change github.com/Neo23x0/sysmon-co… Sigma rule github.com/SigmaHQ/sigma/pul…
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
Image from Florian Roth ⚡️ (@cyb3rops)
Ronny (@RonnyTNL) profile pictureRonny@RonnyTNL10 Sep 2021
Replying to @cyb3rops @bodziurity
Here is a better view on the CreateFile with the Write's and Close.
Word writing .cab file

ALT Word writing .cab file

Word write cab, close file

ALT Word write cab, close file

1
46
2
126
Possibly good hunting/dfir artifact?🤔 Htm file dropped to Temporary Internet Files directory, VT Livehunt gives me solid results (running for 2 hr). #CVE202140444
Image from Wojciech Cieślak (@bodziurity)
Image from Wojciech Cieślak (@bodziurity)
1
11
1
37
New default #CobaltStrike #JARM hash, due to disabled TLS 1.1 in JAVA: 07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2 <--- (OpenJDK 11.0.11) Research in collaboration with @WLesicki
Image from Wojciech Cieślak (@bodziurity)
1
7
3
45
Change in response to 6th client hello message, which is TLS 1.1 "A 000 denotes that the server refused to negotiate with that client hello." github.com/salesforce/jarm
Image from Wojciech Cieślak (@bodziurity)
1
Load more