Twitxy
Saved
@mgreen27's profile picture
View on X

Matthew Green 🌻

Verified account This account is verified. Learn more

@mgreen27

#DFIR and research.
Sydney, Australia mgreen27.github.io Joined August 2010
1.6K Following 2.3K Followers 3.1K Posts

Latest posts 5

Matthew Green 🌻 Verified account @mgreen27
ESET on Turla's Cereal: modular .NET toolset living inside Exchange.

Hunt:
- unexpected .NET assemblies in `EdgeTransport.exe` memory
- `ncobjapi.dll` / `wbemcomn.dll` dropped in `System32\wbem\`
- Exchange-named `*.ni.dll` files in the .NET native image cache
- IIS hits to `/owa/sdds/`

welivesecurity.com/en/eset-resear…
www.welivesecurity.com Exchange for breakfast: Turla’s Cereal tricks are not for kids ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks.
Matthew Green 🌻 Verified account @mgreen27
S5PIVOT (Qilin) reuses similar persistence to what we observed in VIPERTUNNEL. Hunt for:
- a numeric scheduled task
- pythonw.exe running from ProgramData with no arguments
- sitecustomize .py in Lib\ loading the payload via runpy

hexastrike.com/resources/blog…
hexastrike.com S5PIVOT – A Python Backconnect Proxy Hidden Inside a Qilin Ransomware Intrusion - Hexastrike... S5PIVOT is a Python backconnect proxy found in a Qilin ransomware intrusion. Hexastrike breaks down the access, exfiltration and encryption chain.
1 replies 4 reposts 15 likes 1.1K views View on X
Matthew Green 🌻 Verified account @mgreen27
Securelist links a probe to a memory-based ToolShell intrusion. Storm-2603: moderate confidence.
securelist.com/storm-2603-fil…

At the time, I wrote CLRaptor (labs.infoguard.ch/posts/clraptor…) after a similar case, covering how to hunt reflected assemblies with Velociraptor.
securelist.com How to detect fileless attacks exploiting ToolShell: analyzing the Storm-2603 incident Kaspersky researchers analyze a complex fileless cyberattack by Storm-2603 involving ToolShell exploitation and subsequent runtime subversion, and discuss how to detect such intrusions.
2 replies 5 reposts 15 likes 903 views View on X
Matthew Green 🌻 Verified account @mgreen27
Nice to see the AI vuln-hunting story end in patches, not AI dooming. 948 kernel LPEs fixed in one run.
OpenAI Verified account @OpenAI 6d
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.

In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
View quoted post on X