I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
Hal Pomeranz retweeted
You have learned the lesson twice now (I hope) how it feels to patch whatever is vuln to this nightmarish hellscape.
Here's just a little voice to remind you to be documenting your process so it hurts less when you have to do it again later.
There will always be a later...
4
21
3
104
Hal Pomeranz retweeted
The 2022 @DFRWS USA CFP is now open. This is a great venue to publish a peer-reviewed paper in an academic setting that understands the value of memory forensics and malware analysis.
Please see the full details here:
dfrws.org/dfrws-usa-2022-cal…
#DFIR #infosec
10
1
7
Hal Pomeranz retweeted
Perhaps we'd do well to consider that discomfort as a human response to the moral weight of actions with consequences. Few important decisions in life are clear cut, devoid of weight or nuance. And we'd do well to face it head on rather than paper over it for 'business-as-usual'.
1
12
I am being bombarded with requests to join online expert witness directories (for the low, low monthly price of...). Are any of these useful for driving business? I am skeptical.
1
Hal Pomeranz retweeted
Anyone looking for a SOC manager role? My company is hiring. Comp package is best I’ve seen anywhere and the team is awesome. Some excellent talent to work with. DM me for details #infosecjobs #cybersecurityjobs
5
8
Hal Pomeranz retweeted
We have another session of @hal_pomeranz's course, "Linux Forensics," from Feb. 1-4, 2022!
10% of this course will be donated to @RuralTechFund! Check out what they do here: ruraltechfund.org/
Register for Hal's course here! : antisyphontraining.com/linux…
@Antisy_Training
1
13
35
PSA - The people who are actually working the problem don't give a crap how you pronounce #log4j
5
12
2
109
Hal Pomeranz retweeted
Don't know what an Azure Run Command is? Neither did I when we first stumbled on an attacker abusing this during a recent IR case. We wrote a short blog on these and what to look for if you're writing detections for your Azure VMs.
mandiant.com/resources/azure…
2
76
5
194
Hal Pomeranz retweeted
This is fantastic research and gives some good insight into what's going on in the phishing ecosystem.
I promised I would write a report covering my phishing research in 2021.
That report is now live:
steved3.io/data/Phishing-202…
Shout out to @AmandaFGoedde for helping me edit, as well as @ninoseki for making Miteru, and @urlscanio for creating an awesome tool to help defenders.
15
32
Hal Pomeranz retweeted
Kinsing cryptomining Linux malware has adopted #log4j to exploit new hosts. It is also bringing along a stealth rootkit to hide. In this article we go over what it is doing and how you can decloak it for incident response:
sandflysecurity.com/blog/log…
7
9
You can also use these pipelines for other data sources. The ""cat access.log | sed 's/.*"\([^"]*\)"$/\1/'" is how I'm extracting the user agent strings from the Apache log format. Everything after that is shell idioms you can apply to any data.
1
1
Looking for #log4j encoded user agents in Apache "combined" access log format:
"cat access.log | sed 's/.*"\([^"]*\)"$/\1/' | sort | uniq -c | sort -rn"
Histogram of all user agents in descending order (unique encoded user agents right above your shell prompt)
1
5
5
Hal Pomeranz retweeted
Just added support to LDAP Serialized Payloads in the JNDI-Exploit-Kit. This attack path works in *ANY* java version as long the classes used in the Serialized payload are in the application classpath. Do not rely on your java version being up-to-date and update your log4j ASAP!
25
658
77
1,678
Hal Pomeranz retweeted
"as long as people write parsers and connect them to the internet, i'll have work." --anon
Interesting Log4j payload I discovered, simply omit the closing brace }, and now you will potentially get a bunch of data exfiltrated to your server until the next } appears in that data. Had it work on a FANG target...
2
19
62
Hal Pomeranz retweeted
#log4j has resulted in many Linux system breaches. The Linux forensics cheatsheet below can find many of the artifacts post-compromise. If you want to automate all of this, you can get a free license of @SandflySecurity on our website.
Image version of the Linux Compromise Detection Cheatsheet for the PDF averse.
#sandflysecurity #DFIR #threathunting
40
92
Haven't yet been seeing this with #log4j but be aware that LD_PRELOAD rootkits are circulating in the wild. Use of LD_PRELOAD is uncommon, so spot suspicious processes with "grep -l LD_PRELOAD /proc/[0-9]*/environ"
FYI recent malware uses LD_PRELOAD to hide behind legit exe paths. sansec.io/research/nginrat
1
2
9