Logo
Picture

Ayush Anand @Securityinbits

Detection engineering, threat hunting, malware analysis. One defender bit at a time. newsletter.securityinbits.com Join for free → Joined September 2015
  • Tweets
    722
  • Followers
    2K
  • Following
    340
  • Likes
    1K
Securityinbits Profile Picture

Ayush Anand @Securityinbits

a day ago

An attacker pointed a signed ScreenConnect client at their own relay. The command line gave it up. ?e=Access&y=Guest&h=&p= - e= is the role. Access = unattended, Support = attended - h= and p= are the relay. instance-*[.]screenconnect[.]com:443 = cloud, 8041 = theirs 1. Never filter on e=Access. Operators start on Support, then upgrade 2. Baseline h=. Alert on an unseen relay Mine: wonderxp[.]top and relay[.]robertsonins[.]co. Both 8041, both unseen. Deep dive lands Thursday.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 days ago

There are plenty of ways to build a detection lab, but elastic-container is the fastest Elastic stack setup I know. One script gives you: - Elasticsearch + Kibana + Fleet - Detection Engine on, prebuilt rules bulk-enabled by OS - 100% containerized, one command up or down Have Claude or Codex set it up for you. Credit: Andrew Pease (@andythevariable). github.com/peasead/elasti…

Securityinbits Profile Picture

Ayush Anand @Securityinbits

3 days ago

Ever closed a ScreenConnect case on EDR timestamps alone? My EDR's last event on the operator: 17:09. The product's own Application log had them working until 17:17. Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='ScreenConnect'; Id=100,101,201} | Sort-Object TimeCreated | fl TimeCreated, Id, Message - 100/101 = operator connect/disconnect with session label - 201 = file transfer. Two implants on one box: scream care, then spacex7. A 4 min incident was 12 min.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a week ago

BlackFile shut down in May. The crew is still in play as Redact, Pink, Helix and Falcon. Helpdesk call to your personal phone, then a "passkey enrolment" AiTM page. EDR sees nothing. 3 identity tells (GTIG): - MFA factor registered right after abandoned pushes - UAL FileAccessed from a python-requests / PowerShell UA - SSO sign-in via commercial VPN or residential proxy cloud.google.com/blog/topics/th…

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a week ago

@SwiftOnSecurity Thanks. Happy to hear your feedback or suggestions when you get to it 😊

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a week ago

Ever closed an RMM alert because the tool was sanctioned? Stop hunting AnyDesk by filename. Rank it by how rare it is across your fleet. A sanctioned tool is everywhere. A renamed copy on 1 host is the lead, even as Invoice_Viewer.exe still carrying AnyDesk's PE metadata. Full case, 32 ransomware groups and why your EDR sees a legit tool, in my Article below. 🔎

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 months ago

x.com/i/article/2081…

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a week ago

One process. 254 IPs. 5 ports. One time window. That's a network sweep, and the binary name never entered the logic. A dcount threshold on DeviceNetworkEvents catches Advanced IP Scanner, Advanced Port Scanner, and NetScan the same way. Signature-free 🔎

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 weeks ago

@Kostastsale @ThruntingLabs Thank you, will try. Lol 😆

Ayush Anand retweeted
Kostastsale Profile Picture

Kostas @Kostastsale

2 weeks ago

Been testing GPT-6 Astra against some recent malware we collected through IR engagements. I used the ChatGPT Chrome extension with Guacamole running a @ThruntingLabs FlareVM environment directly inside the browser. Samples included a recent SynkLoader, SystemBC and a few fairly nasty obfuscated DLLs. Using high effort, Astra got through the analysis in roughly 15 minutes and found pretty much everything I was looking for, including obfuscated configuration, encrypted passwords embedded in the binaries and the important execution behaviour. That part impressed me, but overall, computer use is insane! Compared with GPT-5.6 Sol, the difference is huge. Astra was much better at understanding what was on screen, interacting with the tooling and moving through the analysis without getting lost. This changes the automation angle quite a bit. You can now start thinking about automating workflows around the actual tools analysts already use, rather than having to rebuild everything around APIs and custom integrations. Just throw Computer Use at it and let it do the work. Very interesting direction for DFIR and malware analysis!

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 weeks ago

The best data point would be bytes sent, since this query is focused on data exfiltration. But I don't think MDE captures that field, so I wrote these queries to identify the initial infection instead. If you have another data source such as proxy logs, you may be able to correlate the initial MDE hit with that proxy data.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 weeks ago

I'd recommend excluding ports 80 and 443, and focusing on the SFTP portion, whether that's the standard port 22 or a custom port used by the attacker. If this still returns too much data, I'll filter by IP after collecting basic WHOIS data. Let me know what you see. I hope this helps.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

2 weeks ago

@thebluesec Yeah, it may generate noise but worth hunting as ransomware group uses filezilla for exfil.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

3 weeks ago

Your FileZilla alert is buried under installer and auto-update traffic. Cut that chatter and one connection is left standing. 🔎 The vendor noise lives on 80/443. Filter it. What survives on a file server: fzsftp.exe to a public IP on a custom port (3333), non-IT user, outside change windows. That's the connection to triage.

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a month ago

securityinbits.substack.com/p/detecting-re…

Securityinbits Profile Picture

Ayush Anand @Securityinbits

a month ago

One SSH tunnel made 302 connections. 296 of them failed. That's not a pivot, that's a subnet sweep. Two signals: destination cardinality and failure rate. A fixed forward holds one IP, one port, zero failures. A subnet sweep churns many IPs, many ports, successes and failures together. Same mechanism. Different shape. I reproduced all three in the lab and put the rows side by side. Full breakdown 👇

Trends for United States

Real Madrid
Go Birds
Rashford
Mourinho
Vini
Fulham
Diomande
#OlandriaxDallasDiariesVlog
Valverde
Lammens
#HardRockBet
Cunha
Huijsen
NFL Sunday
Good Sunday
OLANDRIA YOUTUBE
Yom Kippur
Puka
Go Pack Go
Ladd

You might like

writing & sharing on adversary tradecraft, malware, threat detection, AI-nexus intel and all things #yara
Steve YARA Synapse Mi...
@stvemillertime
18K Followers
Malware Researcher | Developer | @Cryptolaemus1 | @NVIDIA bsky: myrtus@malwareindepth.com
Myrtus
@Myrtus0x0
9K Followers
MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️
Karsten Hahn
@struppigel
26K Followers
Malware slayer Member of @CuratedIntel
Arkbird
@Arkbird_SOLG
16K Followers
Recovering sysadmin that now chases adversaries instead of uptime. Sr Malware Analyst @redcanary
Tony Lambert
@ForensicITGuy
6K Followers
#Malware C2 hunter #infosec passionate. Tweets are my own.
Dee
@ViriBack
11K Followers
Security Researcher at @_CPResearch_ All opinions expressed here are mine only. https://t.co/bNWc3k9HwF
Jiří Vinopal
@vinopaljiri
11K Followers
Threat Researcher @proofpoint | @Cryptolaemus1
Tommy M (TheAnalyst)
@ffforward
15K Followers
Teaching Threat Hunting, Detection Engineering, and KQL https://t.co/uAlYlXIpyV @BluRavenSec Microsoft Security MVP #ThreatHunting #DataScience
Mehmet Ergene
@Cyb3rMonk
14K Followers
ReversingLabs is the trusted name in file and software security. RL — Trust Delivered.
ReversingLabs
@ReversingLabs
7K Followers
Payloads or it didn't happen. https://t.co/rAVsWT6dcl
CAPE Sandbox
@CapeSandbox
5K Followers
nao_sec
@nao_sec
13K Followers
🐗 🦅 Threat Intelligence @ Google
Bryce
@bryceabdo
7K Followers
Work hard in silence , let success make the noise.
m4n0w4r
@kienbigmummy
6K Followers
James
@James_inthe_box
22K Followers