1/An interesting thing happened tonight. I was scrolling through clubhouse and found WileyCEO, Godfather of Grime (kicked off Twitter in July for antisemitic tweets) speaking. So I tweeted this (and included a screen shot, later deleted as I found out TOS don't allow it ...

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

THREAD:

Employees vs Employers

“We who toil for other people have all in some way been captured by pirates and sold into slavery.” –Law 24

It should be said plainly; employment is nothing more than the next step in the evolution of slavery.

The corporation you are employed by has a psychopathic level of indifference as to whether you live or die.

This is not Leftwing political rhetoric; it is a machiavellian reality you will have to contend with.

Your employer is not your ally; they are your adversary.

It is in your best interest for wages to be as high as possible, while it is in your employer’s best interest for wages to be as low as possible.

The freelancing blueprint 🧵👇

Disclaimer:

Freelancing is NOT for everybody, but it is for everyone 😎

Just give freelancing an honest attempt for a year.

If you enjoy it - cool.

If you don't - cool.

At least you tried.

Freelancing starts with a SKILL.

1. Learn how to make a website (Web Design).
2. Learn how to get sales for a business (Digital Marketing).
3. Learn Web Design and Digital Marketing.

I'd recommend option 3.

You're offering a once-off and monthly service.

Win-win.

Where do you learn this skill?

YouTube, Google and Udemy.

Don't overcomplicate it.

How do you make money from this skill?

Marketing and Branding.

This will help you get clients.

Compliance is fundamentally at odds with innovation and continuous improvement

Compliance tends to constrain operations to narrow sets of approved sequences of tasks as the means to assure the secure attainment of certain business outcomes. But at what cost ?

🧵

Operational practices have an emergent nature to them. They’re affected by people, their expertise, their relationships, their team goals, role perceptions and also member needs as humans and professionals.
In this entangled mess of variables, aspects practice-as-done are

Constantly morphed as a response to economic pressures (deadlines, business demands), workload demands (as people tend to automate or agree patterns to reduce cognitive load of tasks and become more efficient) and understanding of safety and security related barriers.

All of these tend to be fluid and non fixed. In this continuous interaction with the environment and different pressures acting on it, there are numerous opportunities for improvements which have local relevance and emerge out of local needs and interactions of elements. However

In order to do so, and to support innovation and continuous improvement the practices need to have a requisite level of variability so practitioners exercise their Fingerspitzengefühl (fingertip feel) for what works and what doesn’t, within their constraints and pressures