Pinned
New blog post and call for collaboration and sharing around
"Using NetBIOS names for pivoting and threat clustering"
I'm already tracking more than 40 clusters and growing...
c-apt-ure.blogspot.com/2025/10/using-…
TomU | I'm still here... til the end 🕊️🇨🇭
16.9K posts
TomU | I'm still here... til the end 🕊️🇨🇭
@c_APT_ure
#InfoSec professional, husband & father of two (in random order). #BlueTeam #DFIR #APT #CTI #RedTeaming #BSidesZH (RT/Likes ≠ endorsement) 👀➡️#MalwareChallenge
- Replying to @c_APT_ureHere are my slides from @Botconf talk "Hunting and Detecting APTs using Sysmon and PowerShell Logging" #botconf2018 #botconf SIGMA rules should be published soon /cc @cyb3rops< thx for help! github.com/c-APT-ure/my-p…
- "Windows Credentials: Attacks, Mitigations & Defense" by Chad Tilbury Thanks @chadtilbury for great work & sharing! Slides: first.org/resources/pape… Video: youtube.com/watch?v=gUruyh… #DFIR
- Replying to @c_APT_ure and @FIRSTdotOrgMy slides from #FIRSTCON2017 talk are now online @FIRSTdotOrg security-research.dyndns.org/pub/slides/FIR…
- What do you mean you forgot to implement the callback routine? Is that why all our malware infections are not connecting back to us? 😂😂😂 app.any.run/tasks/0c226f48…
- #misp42splunk A Splunk app to use MISP as a backend (lookup and store events) If you have TheHive installed, you also may create alerts github.com/remg427/misp42… @TheHive_Project @MISPProject
- Here are the slides from my .@Botconf Lightning Talk "#Sysmon FTW!" security-research.dyndns.org/pub/slides/Bot… and my blog post which should be a good starting point exploring Sysmon resources c-apt-ure.blogspot.com/2017/12/is-thi… #Botconf
- #MalwareChallenge How much #malware do you see distributed via #OneNote files? bazaar.abuse.ch/sample/b13c979… #Remcos RAT
- I guess it's official now. Will be presenting my (still ongoing research) about "DESKTOP-group" at @Botconf Thu 12/5 @ 9am seems like a tough spot 🤔 botconf.eu/botconf-2019/s… Still looking for collaboration on research groups.google.com/d/forum/deskto… If interested please apply #BotConf
- #MalwareChallenge What is that embedded Excel doing in the PDF? Haven't been able to successfully analyze it yet. bazaar.abuse.ch/sample/fe4d130…
- #MalwareChallenge Abuse of signed EXE for DLL sideloading Benign "hpreader.exe" when loading "msimg32.dll" from System32 virustotal.com/gui/file/08c7f…
- Replying to @c_APT_ure and @Ibrahimous
