Senior Security Analyst / Threat detection lead
Joined October 2011
- Tweets 14,261
- Following 98
- Followers 806
- Likes 2,614
Michel de CREVOISIER retweeted
So funny to see marketing people generate leads with “ransomware protection guides” which are basically the harding guides we used 20y ago except that everything is mapped to ATT&CK nowadays
15
89
7
399
Michel de CREVOISIER retweeted
Fuzzing Windows Defender, by @dj_s2w
medium.com/s2wblog/fuzzing-t…
10
20
Michel de CREVOISIER retweeted
System Design Blueprint: The Ultimate Guide blog.devgenius.io/system-des… #Pentesting #CyberSecurity #Infosec
30
125
Michel de CREVOISIER retweeted
After 28 years, SSLv2 is still not gone from the internet... but we're getting there i5c.us/d29908
11
1
21
Michel de CREVOISIER retweeted
.@Sloqman et al.:
Who Squats IPv4 Addresses?
dl.acm.org/doi/pdf/10.1145/3… [PDF]
2
5
16
Michel de CREVOISIER retweeted
Apple patched a macOS vulnerability found by Microsoft that lets attackers bypass SIP protection to deploy "undeletable" malware and gain access to victims' private data - @serghei
bleepingcomputer.com/news/se…
1
112
7
193
Michel de CREVOISIER retweeted
Detecting DLL Injection in Windows infosecwriteups.com/detectin…
52
224
Michel de CREVOISIER retweeted
I wrote this little #PowerShell module that wraps around DSInternals and provides password quality scan for #ActiveDirectory forest but adds some quality reporting around it. Wrote a short blog post on usage and general description evo.yt/y7oq
14
149
1
474
Michel de CREVOISIER retweeted
🚨 "A Practical Approach to Breaking & Pwning Kubernetes Clusters" training in #BHUSA. Learn to perform #Kubernetes, Cloud Native #Security, #Pentesting, Assessments, & Architecture reviews 🚀
Register before early bird pricing ends blackhat.com/us-23/training/…
#Hacking #RedTeam
1
23
100
Michel de CREVOISIER retweeted
How to geolocate mobile phones based on IP addresses?
nixintel.info/osint/geolocat…
@nixintel
@MwOsint
#OSINT #investigation #CTI #infosec #cybersecurity #DFIR #ThreatIntel #intelligence #reconnaissance
3
105
4
308
Michel de CREVOISIER retweeted
N. Korean Lazarus Group Targets Microsoft IIS Servers to Deploy Espionage Malware thehackernews.com/2023/05/n-…
24
1
61
Michel de CREVOISIER retweeted
Just published my first post in the Sigma blog:
Building Flexible & Reusable Detections with Sigma Placeholders
medium.com/sigma-hq/building…
16
1
39
Michel de CREVOISIER retweeted
Chaining DLL Hijacking and Format String to gain RCE on windows RDP Client CVE-2023-24905 cyolo.io/blog/dll-hijacking-…
22
1
41
Michel de CREVOISIER retweeted
Over the past 18 months, we've tracked a TA, we have named p0-LUCR-1: GUI-vil, that targets #AWS, with financial motives. Discover what sets them apart and how to detect them in our blog post: @permisosecurity
permiso.io/blog/s/unmasking-…
2
26
3
60
Michel de CREVOISIER retweeted
Microsoft is investigating app connectivity issues behind an ongoing Microsoft 365 outage
bleepingcomputer.com/news/mi…
3
45
3
86
Michel de CREVOISIER retweeted
while trying to avoid API hooking for service creation (calling into RPC directly) they generate a more suspicious windows service creation event 4697 (clientpid is eq to 0x0 only for remote)
Existing detection for this anomaly
github.com/elastic/detection….
trendmicro.com/en_us/researc…
27
89
Michel de CREVOISIER retweeted
The DFIR Report | IcedID Macro Ends in Nokoyawa Ransomware bit.ly/3OtkXmK
27
1
42
Michel de CREVOISIER retweeted
Lateral movement is a technique that cyber attackers use to search for high-value assets. Developed and supported by Stamus Networks, this #Suricata ruleset is specifically focused on detecting lateral movement in #Microsoft #Windows environments. hubs.la/Q01QyH1z0
10
27
Michel de CREVOISIER retweeted
I created this quick and dirty Powershell script to check your current system drivers against the awesome loldrivers.io list from @M_haggis @_josehelps @nas_bench
Hope you find it useful
gist.github.com/api0cradle/d…
15
143
4
422
Michel de CREVOISIER retweeted
My team mate @m_fielenbach recently created a python script to automate the process of discovering and exploiting ESC1 & ESC8 ADCS vulnerabilities: 🙌
github.com/grimlockx/ADCSKil…
So if you want to save some minutes of time in your next projects feel free to test it out. 🔥
6
181
3
466