I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
Hal Pomeranz retweeted
Anyone looking for a SOC manager role? My company is hiring. Comp package is best I’ve seen anywhere and the team is awesome. Some excellent talent to work with. DM me for details #infosecjobs #cybersecurityjobs
5
8
Hal Pomeranz retweeted
We have another session of @hal_pomeranz's course, "Linux Forensics," from Feb. 1-4, 2022!
10% of this course will be donated to @RuralTechFund! Check out what they do here: ruraltechfund.org/
Register for Hal's course here! : antisyphontraining.com/linux…
@Antisy_Training
1
13
35
PSA - The people who are actually working the problem don't give a crap how you pronounce #log4j
5
12
2
109
Hal Pomeranz retweeted
Don't know what an Azure Run Command is? Neither did I when we first stumbled on an attacker abusing this during a recent IR case. We wrote a short blog on these and what to look for if you're writing detections for your Azure VMs.
mandiant.com/resources/azure…
2
76
5
194
Hal Pomeranz retweeted
This is fantastic research and gives some good insight into what's going on in the phishing ecosystem.
I promised I would write a report covering my phishing research in 2021.
That report is now live:
steved3.io/data/Phishing-202…
Shout out to @AmandaFGoedde for helping me edit, as well as @ninoseki for making Miteru, and @urlscanio for creating an awesome tool to help defenders.
15
32
Hal Pomeranz retweeted
Kinsing cryptomining Linux malware has adopted #log4j to exploit new hosts. It is also bringing along a stealth rootkit to hide. In this article we go over what it is doing and how you can decloak it for incident response:
sandflysecurity.com/blog/log…
7
9
Free Linux forensics information at archive.org/details/HalLinux…
2
4
You can also use these pipelines for other data sources. The ""cat access.log | sed 's/.*"\([^"]*\)"$/\1/'" is how I'm extracting the user agent strings from the Apache log format. Everything after that is shell idioms you can apply to any data.
1
1
Looking for #log4j encoded user agents in Apache "combined" access log format:
"cat access.log | sed 's/.*"\([^"]*\)"$/\1/' | sort | uniq -c | sort -rn"
Histogram of all user agents in descending order (unique encoded user agents right above your shell prompt)
1
5
5
Hal Pomeranz retweeted
Just added support to LDAP Serialized Payloads in the JNDI-Exploit-Kit. This attack path works in *ANY* java version as long the classes used in the Serialized payload are in the application classpath. Do not rely on your java version being up-to-date and update your log4j ASAP!
25
658
77
1,678
Hal Pomeranz retweeted
"as long as people write parsers and connect them to the internet, i'll have work." --anon
Interesting Log4j payload I discovered, simply omit the closing brace }, and now you will potentially get a bunch of data exfiltrated to your server until the next } appears in that data. Had it work on a FANG target...
2
19
62
Hal Pomeranz retweeted
#log4j has resulted in many Linux system breaches. The Linux forensics cheatsheet below can find many of the artifacts post-compromise. If you want to automate all of this, you can get a free license of @SandflySecurity on our website.
Image version of the Linux Compromise Detection Cheatsheet for the PDF averse.
#sandflysecurity #DFIR #threathunting
40
92
Haven't yet been seeing this with #log4j but be aware that LD_PRELOAD rootkits are circulating in the wild. Use of LD_PRELOAD is uncommon, so spot suspicious processes with "grep -l LD_PRELOAD /proc/[0-9]*/environ"
FYI recent malware uses LD_PRELOAD to hide behind legit exe paths. sansec.io/research/nginrat
1
2
9
Hal Pomeranz retweeted
If you need help with Linux Forensics? Please check out my repo with lots of content at the URL below, plus check @CraigHRowland and @hal_pomeranz work too #DFIR #log4j
linuxdfir.ashemery.com/ #DFIR #log4j
3
37
106