sh4hin @s3cdev

Threat Emulation/Hunting | Linux/Mac enthusiast github.com/sh4hin Joined September 2012

Tweets

414
Followers

969
Following

4K
Likes

8K

sh4hin @s3cdev

6 months ago

@vxunderground @mrd0x @MalDevAcademy 👍

0 0 0 21 0

View Details

sh4hin @s3cdev

6 months ago

@scada_plc 👍 great idea

1 0 1 14 0

View Details

@0xcc00 Thanks for the great work on this PoC. I’m facing an issue ,the command output isn’t showing in the Gemini console, and it can’t detect live beacons. Not sure if I’m missing something. Happy to continue here or via DM

1 0 0 92 0

View Details

sh4hin @s3cdev

11 months ago

@arcanuminfosec 👍

0 0 0 49 0

View Details

sh4hin @s3cdev

2 years ago

@DebugPrivilege Good luck 👍

0 0 1 140 0

View Details

sh4hin @s3cdev

3 years ago

@djnn1337 Thanks, it was while back and the codes should be rewritten 😁

0 0 2 35 0

View Details

sh4hin @s3cdev

3 years ago

@djnn1337 Great job

0 0 0 27 0

View Details

sh4hin @s3cdev

3 years ago

@AliceCliment Great job

1 0 1 158 0

View Details

Matt Zorich @reprise_99

3 years ago

In nearly all of our on-premises engagements, a threat actor has taken total full control of Active Directory. If you are interested in the kind of things @MicrosoftDART finds, and how we recommend you secure Active Directory, then this blog is for you - techcommunity.microsoft.com/t5/microsoft-s…

10 212 581 73K 204

View Details

sh4hin @s3cdev

4 years ago

@cyb3rops BackgroundHost.exe

0 0 1 0 0

View Details

Matthew @embee_research

4 years ago

Reverse Engineering a #CobaltStrike #malware sample and extracting C2's using three different methods. We'll touch on #cyberchef, #x64dbg and Speakeasy from fireeye to perform manual analysis and emulation of #shellcode. A (big) thread ⬇️⬇️ [1/23]

17 359 1K 0 396

View Details

diversenok @diversenok_zero

4 years ago

I'm happy to share the results of months of research on code injection, process tampering, and their detection! 🥳 Here you'll find technique categorization, a dive into the underlying OS mechanisms, sample demos, detection suggestions, and much more: huntandhackett.com/blog/concealed…

10 122 291 0 98

View Details

Moritz @m_r_tz

4 years ago

Check out capa v4 with: 1. support for analyzing .NET executables 2. finer grained capability detection via instruction and operand features 3. many new and updated detection rules Blog: mandiant.com/resources/blog… Binaries: github.com/mandiant/capa/… Source: github.com/mandiant/capa

2 56 139 0 19

View Details

sh4hin @s3cdev

4 years ago

@zux0x3a Nice 👍

0 0 1 0 0

View Details

sh4hin @s3cdev

4 years ago

@Antonlovesdnb @SumoLogic Good luck

1 0 1 0 0

View Details

sh4hin @s3cdev

4 years ago

@runasand @flipper_net @nieldk :)

0 0 0 0 0

View Details

sh4hin @s3cdev

4 years ago

Great book, Well done!

hAPI_hacker @hAPI_hacker

4 years ago

@rahi_sec The ebook is currently available here nostarch.com/hacking-apis

1 2 21 0 9

0 0 1 0 0

View Details

S3cur3Th1sSh1t @ShitSecure

4 years ago

NimGetSyscallStub is now public, the first public fully working (didn't find another myself) Nim imlementation + PoC to grab fresh Syscalls from disk on runtime: github.com/S3cur3Th1sSh1t… @chvancooten even with a yara rule (with your template 🤓)