FreeBSD developer (ports committer) working in the field of cybersecurity / developer of FileInsight-plugins / Black Hat USA 2021 Arsenal speaker / OSCP+
Joined October 2009
- Tweets2.9K
- Following1.2K
- Followers931
- Likes499
MANTANI Nobutaka retweeted
I just released iwatobi, a new Sigma-based Linux DFIR tool specifically designed to detect php2shell attacks.
Nothing fancy yet, but hopefully it will be useful to some.
If you're doing Linux IR, give it a try! Issues and PRs to help improve it are always welcome!
github.com/Yamato-Security/i…
php2shell攻撃の検知に特化した、SigmaベースのLinux DFIRツール「iwatobi」を公開しました！
まだシンプルなツールですが、少しでも役に立てば嬉しいです。Linux環境でIRを担当されている方は、ぜひ試してみてください！改善のためのIssueやPRも大歓迎です！
github.com/Yamato-Security/i…
🤖 Made with AI
MANTANI Nobutaka retweeted
I'm developing ntfsfind and ntfsdump, tools for searching and extracting files directly from disk images.
Both tools support VMware snapshots without merging or converting VMDKs.
NTFS Spinal Cord Sword - SIPDEP sumeshi.github.io/posts/work… #dfir
MANTANI Nobutaka retweeted
For anyone who wants to check out @r3nzsec 's amazing IRFlow Timeline (to replace Timeline Explorer) but have to use Windows or Linux, I compiled binaries for those platforms. Feel free to submit issues if you find any bugs.
DFIRなどでTimeline Explorerより遥かに優れている「IRFlow Timeline」を使いたいけど、Macを持っていない！という方のために、Windows版とLinux版のリリースパッケージを作りました。
Windows Binary: github.com/Yamato-Security/i…
Linux Binary: github.com/Yamato-Security/i…
Website: r3nzsec.github.io/irflow-tim…
MANTANI Nobutaka retweeted
pstrings: a parallel strings extractor.
- 5.5 GB in 14 s (~278x faster than Sysinternals strings, ~10x faster than bstrings)
- ASCII + UTF16LE in a single pass
- UTF8 / CP932 / ISO-2022-JP / EUCKR / GB18030 / GBK / Big5 / Windows-1251
🔗 github.com/herosi/pstrings
#DFIR #forensics
MANTANI Nobutaka retweeted
Fileless execution on Linux still leaves (a lot of) observable behavior.
My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them.
Read it here ↓
elastic.co/security-labs/thr…
MANTANI Nobutaka retweeted
After the Defcon CTF this year I have been seeing a lot of people talk about the "death of the CTF" because of agentic tooling.
I had written a whitepaper on this back in march analyzing first blood times on Hack the Box machines.
The writing has been on the wall for a while. It has, for at least a year or so, been about agentic engineering at the top level and not about cyber skills.
suzulabs.com/suzu-labs-blog/…
MANTANI Nobutaka retweeted
Huge respect to api monitor. It's such a beautiful tool for windows apps but hasn't been updated for ages. wanted to keep that spirit alive so built a fresh one.
Currently tracking 30k apis. very early alpha so expect some bugs.☺️
would love your feedback and bug reports.
repo: github.com/kernullist/KnWin3…
MANTANI Nobutaka retweeted
New blog: Hooked on Linux — Rootkit Taxonomy, Hooking Techniques and Tradecraft
Part 1 of our Linux rootkit series exploring kernel & userland rootkits and the hooking techniques they use (syscall/function hooks, ftrace, eBPF, inline patching).
🔗elastic.co/security-labs/lin…
MANTANI Nobutaka retweeted
Unit 42/DFIR ReportのDFIRプロ、Renzon (@r3nzsec) が(Intel/ARM) MacネイティブのCSVタイムライン分析ツール IRFlow Timeline をリリース！🎉🥳
CSVだけでなくTSV/XLSX/EVTX/Plasoにも対応。イメージは“Timeline ExplorerのMac版”だけど、アナライザーも豊富で圧倒的に優秀！💪
ずっと欲しかったツール…嬉しい…🥹🙏 #DFIR
🔗 r3nzsec.github.io/irflow-tim…
🔗 github.com/r3nzsec/irflow-ti…
追伸：TEは約1GBまでだけど、IRFlow Timelineは約20GBまでインポート可能（それを超えるとクラッシュするので、その場合はTimesketch等のSIEMに…）
MANTANI Nobutaka retweeted
NSAのGhidraの公開から7年・・・Ghidra✖️AI、メカギドラを公開します!
- pyghidraによるヘッドレス実行でプラグインインストール不要
- プロジェクトへのロード、解析対象の切り替え、並列化に対応
- Ghidra Serverにも対応、24/7稼動する最強のチームメイトと協力して解析！
github.com/ghidra-user-jp/me…
MANTANI Nobutaka retweeted
ブログ JPCERT/CC Eyes「Windowsのイベントログ分析トレーニング用コンテンツの公開」を公開しました。標的型攻撃によってセキュリティインシデントが発生した際の調査手法などをまとめたトレーニングコンテンツについて紹介しています。^YS
blogs.jpcert.or.jp/ja/2026/0…
MANTANI Nobutaka retweeted
Just published a new blog post on Declarative Binary Parsing for Security Research with Kaitai Struct
husseinmuhaisen.com/blog/dec…
If you work on firmware RE, unknown protocols, C2 RE, or undocumented file formats, give it a read.
I start by defining a custom binary file format, then show how Kaitai Struct comes into play.
MANTANI Nobutaka retweeted
FreeBSD 15.0-RELEASE is now available: lists.freebsd.org/archives/f…
MANTANI Nobutaka retweeted
A deep dive into the Windows Alternate Data Streams (ADS) #infosec #dfir
winitor.com/pdf/NtfsAlternat…
MANTANI Nobutaka retweeted
New Blog Post: YAMAGoya: A Real-time Client Monitoring Tool Using Sigma and YARA Rules
blogs.jpcert.or.jp/en/2025/1…
MANTANI Nobutaka retweeted
Administrator Protection in Windows 25H2 Changes Everything
With update KB5067036, Windows quietly introduced Administrator Protection, and it changes how Windows handles admin rights.
Until now, being a local admin meant living like Clark Kent: doing normal tasks in plain clothes but turning into Superman the moment you hit “Run as administrator.” Same user, same identity, just with hidden powers always waiting to be (ab)used.
Administrator Protection breaks that link. When you elevate, Windows now creates a separate system account to handle the task, keeping Superman isolated and out of reach when you’re done.
Want to see how it really works under the hood? The new blog dives into it.
patchmypc.com/blog/administr…
#Intune #MSIntune #Windows #Windows11 #Security
MANTANI Nobutaka retweeted
#KaitaiStruct, a cross-language binary format parser generator, released a new major version 0.11! Java and Python serialization, partial object tree in the Web IDE, import fixes, `valid/in-enum` checks, null-terminated UTF-16 strings and much more! kaitai.io/news/2025/09/07/ka…
