Javier Ruiz (@n0dec) header
Javier Ruiz (@n0dec) profile picture

Javier Ruiz

@n0dec

Security Researcher. Infosec. 😝 Share what you know, learn what you don't. =[ https://teapawt.net/t.co/dK4hcFyN8z ]=

 Internet
github.com/n0dec/MalwLess
Joined October 2016
  • Tweets191
  • Following62
  • Followers169
Updated #MalwLess for sysmon v8. Now you can add RuleName field in rule sets. #Sysmon #DFIR #BlueTeam github.com/n0dec/MalwLess/re…
Image from Javier Ruiz (@n0dec)
Image from Javier Ruiz (@n0dec)
Image from Javier Ruiz (@n0dec)
13
15
Are you passionate about finding new #malware? The renowned AT&T Alien Labs Threat Intelligence team is looking to add to their research team to help design the next gen of threat protection and uncover new threats. Here’s more information - go.att.com/bf064462
Image from LevelBlue (@LevelBlueCyber)
4
7
Amazing #flareon8 prize!! 😍
Image from Javier Ruiz (@n0dec)
4
Get ready for the SEVENTH ANNUAL FLARE-ON CHALLENGE!!!! Starts on Friday, September 11, 2020 #flareon7 @FireEye @Mandiant fireeye.com/blog/threat-rese…
Mandiant Cybersecurity Consulting

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
1
55
7
154
Updates for Sysmon (v11.0), Coreinfo (v3.5), Process Explorer (v16.32) and LiveKD (v5.63) have now been posted! See what's new directly from @MarkRussinovich in his video update: youtube.com/watch?v=_MUP4tgd… Get the tools at sysinternals.com
10
277
21
566
Pretty cool! 😚 Thanks @FireEye
Image from Javier Ruiz (@n0dec)
7
Javier Ruiz retweeted
Cutter (@cutter_re) profile picture
Cutter@cutter_re6 Sep 2019
We just released Cutter v1.9 on #r2con2019 with a HUGE surprise - a full integration of Ghidra decompiler in Cutter! 🥳 Download v1.9 with the Decompiler from cutter.re For more info, keep reading >>
Image from Cutter (@cutter_re)
11
287
17
546
Finished #flareon6 😊😊 Thanks to @FireEye and all the FLARE team for these amazing challenges.
Image from Javier Ruiz (@n0dec)
8
Defeating Commercial and Custom Packers like a Pro - VMProtect, ASPack, PECompact, and more: youtu.be/N4f2e8Mygag?t=1
53
110
InfinityHook sample is live, please consult the readme. Massive kudos to @0xNemi for incredible code clean-up. Microsoft says this is not security issue, have fun. github.com/everdox/InfinityH…
GitHub - everdox/InfinityHook: Hook system calls, context switches, page faults and more.

GitHub - everdox/InfinityHook: Hook system calls, context switches, page faults and more.

Hook system calls, context switches, page faults and more. - everdox/InfinityHook

github.com
4
154
6
344
If you have a sandbox service running with Sysmon, please filter a little bit. 😅
Image from Javier Ruiz (@n0dec)
2
Javier Ruiz retweeted
clem (@clavoillotte) profile picture
clem@clavoillotte4 Jun 2019
Osquery for Windows local privilege escalation offsec.provadys.com/osquery-…
1
126
4
289
Javier Ruiz retweeted
Evilcry_ (@Blackmond_) profile picture
Evilcry_@Blackmond_28 May 2019
Analyzing ISFB – The Second Loader 0ffset.net/reverse-engineeri…
5
18
[VIDEO] Unpacking #Baldr stealer: youtube.com/watch?v=E2V4kB_g… #MalwareUnpacking #malware
5
66
156
Javier Ruiz retweeted
0verfl0w (@0verfl0w_) profile picture
0verfl0w@0verfl0w_13 Mar 2019
I've finally got around to completing my first post on reversing #ISFB, specifically, unpacking and analyzing the first stage loader (executable): 0ffset.net/reverse-engineeri… As always, all samples mentioned have been uploaded to @virusbay_io
Image from 0verfl0w (@0verfl0w_)
Image from 0verfl0w (@0verfl0w_)
Image from 0verfl0w (@0verfl0w_)
6
128
5
252
New blog post! Building an Office macro to spoof parent processes and command line arguments blog.christophetd.fr/buildin…
Image from Christophe Tafani-Dereeper (@christophetd)
Image from Christophe Tafani-Dereeper (@christophetd)
9
174
2
305
Javier Ruiz retweeted
Rolf Rolles (@RolfRolles) profile picture
Rolf Rolles@RolfRolles9 Mar 2019
1250 lines of Java later, I ported one of my abstract interpretation-based deobfuscation tools (msreverseengineering.com/blo…) to Ghidra:
Image from Rolf Rolles (@RolfRolles)
1
114
3
341
Javier Ruiz retweeted
herrcore (@herrcore) profile picture
herrcore
@herrcore27 Jan 2019
📢 Quick Tip Tutorial Video 📢 Have you noticed x64dbg is crashing when you try to analyze recent malware samples?? We explain why, how we worked around it, and their fix in the new release of the debugger! youtu.be/FNuFlhnfZQU #malware #x64dbg #OpenAnalysisLive
Malware Samples Crashing x64dbg Fixed!

Malware Samples Crashing x64dbg Fixed!

We dive into why some recent malware samples have been crashing in ...

youtube.com
2
43
3
87
Awesome #flareon5 prize! @FireEye
Image from Javier Ruiz (@n0dec)
6
Javier Ruiz retweeted
Stan Hegt (@StanHacked) profile picture
Stan Hegt@StanHacked18 Dec 2018
Attack Surface Reduction bypass: if Word is prohibited from spawning child processes, why not let the running instance of explorer.exe do the dirty job? Gotta ❤️ COM as a red teamer.
Image from Stan Hegt (@StanHacked)
11
178
8
384
🆕 Now with almost 700 🥝 samples! Pictured: head -1 <667 samples of invoke-mimikatz> | sort -u ⚠️ Attention #redteam: Did any of you make the list? 🐑 Some of these are great! 📜 Full list with counts: gist.github.com/itsreallynic… 🏆 Which is *your* favorite? I have a few...
Image from Nick Carr (@ItsReallyNick)
7
47
7
119
Load more