Nasreddine Bencherchali
8,498 posts
Nasreddine Bencherchali
@nas_bench
Detection @Splunk & @cisco | previously @nextronsystems | @sigma_hq & @magicswordio maintainer | Eternal Learner
How did we as a society, looked at the regex syntax and said yep that looks good, use this for pattern matching...
- Since everyone patches systems based on what infosec twitter is currently hyping. We should do a weekly hype for old vulnerabilities and pretend that they are new then maybe people will care.
- "Svchost.exe" Mind Map covering its cmdline options, logs and "normal" behavior. Link: github.com/nasbench/MindM… #Detection #BlueTeam #Windows
- Here is a stupid way to persist on a machine using WindowsTerminal profiles. 1-Modify the "settings.json" located in %localappdata% and add a custom profile that contains your payload 2-Change the "defaultProfile" value and put your GUID 3-Add the value "startOnUserLogin": true
- If you have Symantec SEP installed you can use the "Symantec.SSHelper" COM object to launch processes and download arbitrary files. The "User-Agent: Symantec Agent" can be used to identify requests made by the "HIDownloadURLFile"
- In addition to the documented "-e/--exec" flag in #lolbas about the "wsl.exe" binary (lolbas-project.github.io/lolbas/OtherMS…). We can also use the "--system" flag to run Linux (as root) /Windows commands. wsl --system [Command]
- A quick DFIR tip for the weekend Now that notepad on Win 11 saves its states and can open tabs. It means history is saved somewhere :) Well that somewhere is in %localappdata%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState A new location to monitor and
- Windows Services (Creation) Mind Map covering service creation and detection methods. Link: github.com/nasbench/MindM… #Detection #BlueTeam #Windows #Services
- By creating the key "telnet.exe" in the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" registry and setting the "Default" key to any executable. We can call it by running the command: rundll32.exe url.dll,TelnetProtocolHandler
- whoami /all ipconfig /all systeminfo net group "Domain Admins" /domain
"git status"
