I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
This was a fun and worthwhile project. Can’t believe it was 20 years ago!
20th Anniversary of the Center for Internet Security. So glad to have been a part of that with my buddies @hal_pomeranz @jaybeale cisecurity.wistia.com/medias…
@SANSInstitute @CISecurity @educause
1
1
Far too many Linux incidents I investigate would not have happened had the site been using SELINUX in enforcing mode.
2
1
1
Hal Pomeranz retweeted
Good morning infosec. Here's some free consulting advice.
Remember that list of indicators CISA released for ransomware? Go through that list and detail what you have logs for and how far back you can search them. Document your capability gaps and share those with leaders. 1/2
5
109
8
586
The problem is that while you control the entire data store, you have to give access to small pieces of info. Those pieces will be aggregated outside of your control, just as they are today.
2
Hal Pomeranz retweeted
How Ryuk Ransomware operators made $34 million from one victim - @Ionut_Ilascu
bleepingcomputer.com/news/se…
3
93
12
205
Also not clear on the context for your request. You could track file access in excessive detail using auditd on Linux, but it would have to be configured beforehand. Won’t help if you’re investigating activity that has already happened.
1
2
See extundelete and ext4magic. The source code here is probably the best documentation you are going to find on this. There is no USN equivalent for Linux file systems.
1
Hal Pomeranz retweeted
For those that missed it, this loader performs process hollowing with full PE loading - without creating any RWX regions in the victim process
@hasherezade also does other awesome work like:
- github.com/hasherezade/pe-si…
- github.com/hasherezade/hollo…
not exactly RunPE, but I have a loader with manual PE mapping that does it: github.com/hasherezade/chime…
2
17
61