Kostas (@Kostastsale) / X

Kostas

5,975 posts

Kostas

@Kostastsale

I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦

linktr.ee/kostastsale

Joined February 2017

Kostas
@Kostastsale
Mar 9, 2022
I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅 If you're in #infosec and you feel a little down this week, this video is for you💙
00:00
Kostas
@Kostastsale
Oct 10, 2023
This is a pretty nice graphic explaining how Kerberos Auth takes place. Useful to have as a reference when you have to explain and visualize attacks such as Pass The Ticket, Kerberoasting and AS-REP Roasting. Credit: @0xNarek 🙏🙏
GIF
129K
Kostas
@Kostastsale
Feb 12, 2024
vx-underground
@vxunderground
Feb 12, 2024
.@CrowdStrike placed an ad in the Super Bowl. We're not up to date with the current Threat Actor lore with them, but it appears as if one of the individuals in the commercial is the infamous Scattered Spider (the tall one with the curly blonde hair)
169K
Kostas
@Kostastsale
Dec 7, 2023
I updated the EDR telemetry project with corrected telemetry and new additions! See below the changes and upcoming EDRs: ✅ Corrected Trend Micro Telemetry ✅ Corrected ESET Telemetry 🌟 Added Qualys EDR 🎯New Additions Coming Up: 🔜 Sophos EDR 🔜 Cortex EDR Vendors are
160K
Kostas
@Kostastsale
Oct 18, 2024
🚨EDR Telemetry website is live! 🥳 I hope this makes it even easier for folks to compare the telemetry of EDR vendors and visualize their visibility gaps 🙂 ‣ Website🔗edr-telemetry.com ‣ GitHub 🔗github.com/tsale/edr-tele… **Telemetry results reflect the most recent
00:30
Kostas
@Kostastsale
Oct 14, 2024
I created the first draft of a website for the EDR telemetry project to help people quickly compare vendor telemetry visibility. What do you think about it? Are there any specific features you want to see for the website? Built with ChatGPT 4o with canvas (wanted to test it
127K
Kostas
@Kostastsale
Dec 21, 2023
Internal security teams watching the SysAdmins implementing all of their security hardening recommendations…
zaкovsкa
00:00
zaкovsкa
87K
Kostas
@Kostastsale
Jun 1, 2024
🚀 EDR Telemetry Project Update: New Comparison Feature Thanks to one of our contributors, we now have a way to compare the EDRs in this project! Now, the results are displayed in an easy-to-read table right in the terminal. Each EDR is ranked and scored based on its
106K
Kostas
@Kostastsale
Apr 19, 2023
Today, me and @ateixei are releasing the EDR Telemetry project. This project aims to compare and evaluate the telemetry of various EDR products. ✅Introductory blog post: t.ly/9Ia3 ✅GitHub Repo: github.com/tsale/EDR-Tele… ✅Comparison Table: t.ly/HMht
EDR Telemetry Project: A Comprehensive Comparison
From detect.fyi
169K
Kostas
@Kostastsale
Nov 18, 2021
I created a #CyberChef recipe to ease the extraction of URLs from the word document (.doc & .docm) which download #Emotet. It is not completely foolproof, but it worked 99% of the time for me. tinyurl.com/zexbjxcd
Kostas
@Kostastsale
Mar 30, 2024
Regarding the xz backdoored binary, see the one-liner below to check the version you have installed. **I wouldn’t suggest folks running the malicious binary with -v option🫠🫣 for xz_p in $(type -a xz | awk '{print $NF}' | uniq); do strings "$xz_p" | grep "xz (XZ Utils)" ||
SANS.edu Internet Storm Center
@sans_isc
Mar 29, 2024
A quick note about xz-utils backdoor: 1 - luckily, this was caught early. 2 - most run xz-utils 5.2/5.4. 5.6 is bad. 3 - quick check: `xz -V` 4 - Thanks to people who paid attention openwall.com/lists/oss-secu… cisa.gov/news-events/al…
175K
Kostas
@Kostastsale
Feb 3, 2023
Happy Friday 😆
61K
Kostas
@Kostastsale
Mar 14, 2022
Last week, @TheDFIRReport received a MS-themed phishing email with an HTML attachment. The email made a significant effort to appear legitimate. When we open the file, the code renders into what appears to be an HTML page mirroring the official MS account login page. 1/🧵
Kostas
@Kostastsale
Jul 9, 2022
When I tell people I work in #infosec, and they want me to explain what this means
Shawna™
00:00
Shawna™
Kostas
@Kostastsale
Oct 18, 2023
🚨Threat Actors are currently using PSMapexec. You should get familiar with it! The screenshot below is from a VERY recent intrusion that started from a WS_FTP server exploitation. They used PSMapexec A LOT during this intrusion. Full details on a future report...
178K