Kostas's banner

Kostas

@Kostastsale • 20,735 subscribers

I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦

Shorts

Sometimes the call comes a little too late and you gotta do what you gotta do 😂

Sometimes the call comes a little too late and you gotta do what you gotta do 😂

11,538 次观看

$I came across a great persistence mechanism and created a Sigma rule for it. Just drop your batch script or add a line that points to your payload inside C:\Windows\Setup\Scripts\ErrorHandler.cmd, and upon execution of C:\Windows\System32\oobe\Setup.exe, the payload will run. In the clip below, I have cmd.exe /c calc.exe as the payload. If ErrorHandler doesn't exist, you can create it along with the directory. Thanks to hexagon for posting about it 🙏 In regards to the rest binaries under the C:\Windows\System32\oobe\ directory, most of them will not work, whereas others will force a restart (i.e. audit.exe) 🔗:$

I came across a great persistence mechanism and created a Sigma rule for it. Just drop your batch script or add a line that points to your payload inside C:\Windows\Setup\Scripts\ErrorHandler.cmd, and upon execution of C:\Windows\System32\oobe\Setup.exe, the payload will run. In the clip below, I have cmd.exe /c calc.exe as the payload. If ErrorHandler doesn't exist, you can create it along with the directory. Thanks to hexagon for posting about it 🙏 In regards to the rest binaries under the C:\Windows\System32\oobe\ directory, most of them will not work, whereas others will force a restart (i.e. audit.exe) 🔗:

17,515 次观看

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

When Jev came out, this was exactly the kind of use case I had in mind. I’ve been experimenting with a variation of this in my own incident-review workflow since then, and I finally turned the idea into an open PoC and I'm calling it Jevline. The concept is pretty straightforward, give it one thing you’ve already confirmed is malicious, like a process, IP, domain, account or host. It will follow the telemetry from there to reconstruct the incident and timeline. Instead of asking Jev to reason over millions of events, Jevline only asks it about things actually connected to the incident. On one real lab intrusion, starting from a single malicious process across 2.3 GB and 1M+ records, it reconstructed 40 of 41 processes in the analyst-built attack chain in 21 seconds for $0.11. 𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱 705,017 records / 1.3 GB → 33/41 processes → 1 wrong decision → 10 seconds → $0.03 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗲𝘃𝗲𝗻𝘁 𝗹𝗼𝗴𝘀 310,942 records / 1.0 GB → 37/41 → 0 wrong decisions → 6 seconds → $0.03 𝗕𝗼𝘁𝗵 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿 1,015,959 records / 2.3 GB → 40/41 → 1 wrong decision → 21 seconds → $0.11 All three runs started from 2.8.exe alone. The analyst still reviews the result. Jev is deciding whether something belongs to the incident, not whether it is malicious. The clip below shows it working. Try it: Code:

When Jev came out, this was exactly the kind of use case I had in mind. I’ve been experimenting with a variation of this in my own incident-review workflow since then, and I finally turned the idea into an open PoC and I'm calling it Jevline. The concept is pretty straightforward, give it one thing you’ve already confirmed is malicious, like a process, IP, domain, account or host. It will follow the telemetry from there to reconstruct the incident and timeline. Instead of asking Jev to reason over millions of events, Jevline only asks it about things actually connected to the incident. On one real lab intrusion, starting from a single malicious process across 2.3 GB and 1M+ records, it reconstructed 40 of 41 processes in the analyst-built attack chain in 21 seconds for $0.11. 𝗘𝗹𝗮𝘀𝘁𝗶𝗰 𝗗𝗲𝗳𝗲𝗻𝗱 705,017 records / 1.3 GB → 33/41 processes → 1 wrong decision → 10 seconds → $0.03 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗲𝘃𝗲𝗻𝘁 𝗹𝗼𝗴𝘀 310,942 records / 1.0 GB → 37/41 → 0 wrong decisions → 6 seconds → $0.03 𝗕𝗼𝘁𝗵 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿 1,015,959 records / 2.3 GB → 40/41 → 1 wrong decision → 21 seconds → $0.11 All three runs started from 2.8.exe alone. The analyst still reviews the result. Jev is deciding whether something belongs to the incident, not whether it is malicious. The clip below shows it working. Try it: Code:

18,350 次观看 • 12 天前

I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website? Built with ChatGPT 4o with canvas (wanted to test it out😂) EDR Telemetry project 🔗:

I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website? Built with ChatGPT 4o with canvas (wanted to test it out😂) EDR Telemetry project 🔗:

140,663 次观看 • 2 年前

Enjoy your weekend yall 😅

Enjoy your weekend yall 😅

34,595 次观看 • 11 个月前

A Day in the Life of a CISO

A Day in the Life of a CISO

65,496 次观看 • 3 年前

It’s time! We’re slowly opening the gates to the Threat Hunting Labs for everyone who registered. Watch your inbox.

It’s time! We’re slowly opening the gates to the Threat Hunting Labs for everyone who registered. Watch your inbox.

18,954 次观看 • 8 个月前

没有更多内容可加载