Amcache is now SQLite!
Seems that both the old hive and new versions are still populated in parallel but will need to update your tools and processes incase the registry updates stop.
Check out @phillmoore’s write up #dfir
Seems that both the old hive and new versions are still populated in parallel but will need to update your tools and processes incase the registry updates stop.
Check out @phillmoore’s write up #dfir
2
2
29
3,512
Zach retweeted
I worked with @svch0st and @TheDFIRReport to put out a report in less than 24 hours. This is especially timely given the threat actor's use of OpenClaw and Claude in the mass exploitation of CVE-2025-55182 (React2Shell).
An exposed open directory gave us the full operational footprint: scanner harness, AI-orchestrated post-exploitation, Telegram C2, and thousands of exfiltrated .env files across 900+ confirmed compromises.
#Claude #OpenClaw #DFIR
An exposed open directory gave us the full operational footprint: scanner harness, AI-orchestrated post-exploitation, Telegram C2, and thousands of exfiltrated .env files across 900+ confirmed compromises.
#Claude #OpenClaw #DFIR
We identified an exposed server that provided unusual visibility into a large-scale, multi-victim exploitation and collection operation. Artifacts on the host showed that Claude Code and OpenClaw were embedded in the operator's day-to-day workflow, supporting troubleshooting, nement of the collection pipeline. Logs indicated more than 900 confirmed compromises, with tens of thousands of harvested .env files spanning AI, cloud, payments, databases, messaging and more.
Read the full report: thedfirreport.com/2026/04/22/bis…
5
25
105
18,938
Zach retweeted
NEW LAB: APT40 Ivanti Exploitation
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
9
41
194
32,314
Zach retweeted
New XINTRA course‼️
Advanced IIS Post Exploitation, Detection & Evasion
Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.
If your detection and response capabilities lag exposure, this course bridmory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques
Syllabus and preview videos here👇
xintra.org/courses/9-adva…
@XintraOrg
Advanced IIS Post Exploitation, Detection & Evasion
Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.
If your detection and response capabilities lag exposure, this course bridmory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques
Syllabus and preview videos here👇
xintra.org/courses/9-adva…
@XintraOrg
2
33
253
31,428
Zach retweeted
NEW LAB: Mustang Panda 🐼🔍
Chinese cyber espionage APT targeting a government body across the U.S, Europe, and APAC
Test your blue team skills on
👀 .NET malware
👀 DLL Sideloading
👀 Webshells
👀 Procdumps
Lab Contributors
Adversarial Emulation: @MDSecLabs @offensiveninja vch0st
Solve it here👉xintra.org @XintraOrg
Chinese cyber espionage APT targeting a government body across the U.S, Europe, and APAC
Test your blue team skills on
👀 .NET malware
👀 DLL Sideloading
👀 Webshells
👀 Procdumps
Lab Contributors
Adversarial Emulation: @MDSecLabs @offensiveninja vch0st
Solve it here👉xintra.org @XintraOrg
5
78
413
53,506
Check out our new report on a TA4557 intrusion.
Make sure your team that handles hiring/resumes recognises these lures!
Make sure your team that handles hiring/resumes recognises these lures!
🌟New report out today!🌟
The Curious Case of an Egg-Cellent Resume
Analysis & reporting completed by @_pete_0, @svch0st and guest contributor @k3dg3 from @proofpoint!
Audio: Available on Spotify, Apple, YouTube and more!
👇 Click the link below to read the report!
2
3
18
4,988
Zach retweeted
Inside the Open Directory of the “You Dun” Threat Group
Analysis & reporting completed by @pcsc0ut & @svch0st.
Audio: Available on Spotify, Apple, YouTube and more!
Report: thedfirreport.com/2024/10/28/ins…
Analysis & reporting completed by @pcsc0ut & @svch0st.
Audio: Available on Spotify, Apple, YouTube and more!
Report: thedfirreport.com/2024/10/28/ins…
0
26
66
10,421
Zach retweeted
NEW LAB RELEASE: Airbuzz✈️🔍
Lazarus Group (North Korea) targeting aerospace defence companies as a part of their 3 year long Operation Dream Job campaign.
👇Solve the incident here👇
xintra.org
Test your blue team skills on:
👀Memory Analysis
👀 PCAP on Techniques
👀DLL Side Loading
Lab Contributors
Adversarial Emulator @q8fawazo
Incident Responder @r3nzsec
@XintraOrg
Lazarus Group (North Korea) targeting aerospace defence companies as a part of their 3 year long Operation Dream Job campaign.
👇Solve the incident here👇
xintra.org
Test your blue team skills on:
👀Memory Analysis
👀 PCAP on Techniques
👀DLL Side Loading
Lab Contributors
Adversarial Emulator @q8fawazo
Incident Responder @r3nzsec
@XintraOrg
5
45
236
33,770
Zach retweeted
NEW LAB 🥳: WinDbg Crash Dump Analysis by @DebugPrivilege
Using WinDbg to analyze dumps of CVE-2024-29824 and CVE-2023-29357 exploited in the wild.
👇Solve the incident here 👇
xintra.org
Test your memory forensic skills on:
👀Reflective DLL Injection
cting remote code execution
👀Extracting payloads from memory
@XintraOrg
Using WinDbg to analyze dumps of CVE-2024-29824 and CVE-2023-29357 exploited in the wild.
👇Solve the incident here 👇
xintra.org
Test your memory forensic skills on:
👀Reflective DLL Injection
cting remote code execution
👀Extracting payloads from memory
@XintraOrg
8
82
282
39,628
Zach retweeted
New report recently delivered to our all intel customers:
➡50+ gov sites compromised
➡Backdoors on IIS servers
➡SEO manipulation to boost a gambling site
➡Chinese Attribution and Tooling
➡Custom Infra and Tooling
Interested in learning more ➡️ thedfirreport.com/contact/
➡50+ gov sites compromised
➡Backdoors on IIS servers
➡SEO manipulation to boost a gambling site
➡Chinese Attribution and Tooling
➡Custom Infra and Tooling
Interested in learning more ➡️ thedfirreport.com/contact/
2
32
104
9,476
Zach retweeted
NEW LAB RELEASE: TechTonik Inc 🥳
End-to-end emulation of a CISA write-up about Russian Intelligence attacking Jetbrains to target tech companies (APT29)
👇Solve the incident here 👇
xintra.org
Test your detection skills on:
👀 TeamCity Exploitation (N-Day)
👀 ux + Windows Forensics
👀 DLL Hijacking
Lab Contributors
Adversarial Emulator @ZephrFish
Incident Responder @svch0st
@XintraOrg
End-to-end emulation of a CISA write-up about Russian Intelligence attacking Jetbrains to target tech companies (APT29)
👇Solve the incident here 👇
xintra.org
Test your detection skills on:
👀 TeamCity Exploitation (N-Day)
👀 ux + Windows Forensics
👀 DLL Hijacking
Lab Contributors
Adversarial Emulator @ZephrFish
Incident Responder @svch0st
@XintraOrg
7
42
235
36,005
While being a very controversial feature, Recall is a really amazing #DFIR forensic artefact! @phillmoore @SwiftForensics and I dive in Recall in this blog.
We've created some @velocidex Velociraptor hunts and KAPE targets for investigators.
cybercx.com.au/blog/forensic-…
We've created some @velocidex Velociraptor hunts and KAPE targets for investigators.
cybercx.com.au/blog/forensic-…
5
36
112
9,686
> Containment Steps
Below are the things tried. Each action I'd re-download the mailbox to ensure I still had access.
Entra ID Users page
❌Revoke user sessions in the UI
❌Reset password
❌Revoke-AzureADUserAllRefreshToken
more...
Below are the things tried. Each action I'd re-download the mailbox to ensure I still had access.
Entra ID Users page
❌Revoke user sessions in the UI
❌Reset password
❌Revoke-AzureADUserAllRefreshToken
more...
2
0
2
1,206
Entra ID Application page
❌Revoking the permissions consented
❌Remove the victim user assignment from the app
❌Disabling app user log in on application page
❌Deleting the app (also you lose visibility)
WELL WHAT DID WORK?
☑️The only thing that worked was to disable the user
❌Revoking the permissions consented
❌Remove the victim user assignment from the app
❌Disabling app user log in on application page
❌Deleting the app (also you lose visibility)
WELL WHAT DID WORK?
☑️The only thing that worked was to disable the user
3
1
4
1,037
> The Test
Installed and consented to the application user with PerfectData. Saved the inbox to pst, and waited to ensure it flowed into UAL. Repeated the same action after each containment action.
Installed and consented to the application user with PerfectData. Saved the inbox to pst, and waited to ensure it flowed into UAL. Repeated the same action after each containment action.
1
0
2
950
> Log Accuracy - MIA (E5 or until MS makes them free ⌚️)
For the MIA events associated with the malicious app, they did not line up per items download locally...
There was always an initial event, however some requests to download the inbox seemed to never even be logged.
For the MIA events associated with the malicious app, they did not line up per items download locally...
There was always an initial event, however some requests to download the inbox seemed to never even be logged.
1
0
2
826
🧵Hey all, for any DFIR peeps that have done their fair share of BECs you've probably come across malicious apps
TLDR:
➡️Even if you are lucky and have a user with E5, MailItemsAccessed doesn't cover 100% of all items accessed
➡️Revoking apps access is hard... like really hard
TLDR:
➡️Even if you are lucky and have a user with E5, MailItemsAccessed doesn't cover 100% of all items accessed
➡️Revoking apps access is hard... like really hard
4
13
88
11,053
Zach retweeted
NEW LAB RELEASE: Husky Corp 🥳
Midnight Blizzard have compromised Husky Corp in this end-to-end cloud lab. Test your skills on:
👀Pass the PRT (Token Based Attacks)
👀Entra ID Backdoors
👀Skeleton Key Attack
👀 Managed Identity Abuse
👀Cloud Administrator Privilege Escalation
re 👇
xintra.org
Lab Contributors
Adversarial Emulator @HuskyHacksMK
Incident Responder @svch0st
@XintraOrg
Midnight Blizzard have compromised Husky Corp in this end-to-end cloud lab. Test your skills on:
👀Pass the PRT (Token Based Attacks)
👀Entra ID Backdoors
👀Skeleton Key Attack
👀 Managed Identity Abuse
👀Cloud Administrator Privilege Escalation
re 👇
xintra.org
Lab Contributors
Adversarial Emulator @HuskyHacksMK
Incident Responder @svch0st
@XintraOrg
9
74
387
64,175