ܛܔܔܔܛܔܛܔܛ Profile Banner
ܛܔܔܔܛܔܛܔܛ Profile
ܛܔܔܔܛܔܛܔܛ

@skocherhan

24,320
Followers
26,749
Following
5,034
Media
66,358
Statuses

星空迷彩

London, UK
Joined May 2013
Don't wanna be here? Send us removal request.
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
A Windows PC got hacked. You are investigating it and trying to identify- if there's any malicious process ran on boot time? Simply open the file- "C:\Windows\System32\WDI\LogFiles\BootCKCL.etl" It contains all EXE, DLL or, SYS info that were started during the boot time. #dfir
Tweet media one
43
508
2K
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
In a forensic investigation, how to know if the victim had clicked on a malicious URL from MS Word document? • Go to below registry key- "HKEY_USERS\<SID>\SOFTWARE\Microsoft\Office\16.0\Common\Internet" See the value of 'UseRWHlinkNavigation'. It contains the last accessed URL
Tweet media one
3
150
603
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Attackers are creating websites with CAPTCHA puzzles. After solving the puzzle, user will be redirected to a phishing site. So, security products i.e. SEG can't block such site. Because, SEG can't solve the puzzle and so, can't know the phishing URL. #Phishing #CyberSecurity
Tweet media one
16
199
533
@skocherhan
ܛܔܔܔܛܔܛܔܛ
3 months
wget -r --no-parent target[.com/dir
Tweet media one
2
85
320
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Suppose, an attacker created a value 'AutoRun' under registry key 'HKLM\SOFTWARE\Microsoft\Command Processor'. And added malicious command as its value data. Now whenever you start Command Prompt, this command will auto run. It's a very important key to check when doing #DFIR
Tweet media one
4
83
310
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Suppose, you're doing a #DFIR on a cyber criminal's PC. You're suspecting that the person used VPN to do hacking stuff. But how to confirm that? Simply go to the below Windows Registry- "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" #protonvpn
Tweet media one
8
40
157
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 months
"In Azure AD, suppose a threat actor compromised an user and created an Automation. Now, even if you delete the user, threat actor can still access it using its webhook URL and get available connections (until you delete it)."
Tweet media one
1
41
145
@skocherhan
ܛܔܔܔܛܔܛܔܛ
7 years
Red Hot Rocks by Darren J. Bennett
Tweet media one
0
0
37
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
Trending on #git "Reverse Engineering for Beginners" free book by @yurichev
1
13
53
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Tweet media one
3
2
49
@skocherhan
ܛܔܔܔܛܔܛܔܛ
7 years
Ocean of Dawn by Rui Lucas
Tweet media one
0
0
36
@skocherhan
ܛܔܔܔܛܔܛܔܛ
7 years
Landscape by Krzysztof Tollas
Tweet media one
0
0
37
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
Blue
Tweet media one
0
0
40
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Scored third in United Kingdom on @RealTryHackMe , #ctf type cybersecurity training platform. #cybersecurity #cyber #security #tryhackme
Tweet media one
2
0
31
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
I have completed the Cyber Defense Learning Path on @RealTryHackMe . Learned a lot about vulnerability management, different forensics tools and even a bit of malware reverse engineering. #tryhackme #malware #dfir #CyberSec
Tweet media one
2
5
27
@skocherhan
ܛܔܔܔܛܔܛܔܛ
9 years
“Judge a man by his questions rather than by his answers.” — Voltaire
1
24
23
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
Horseshoe Bend by Jason Levi
Tweet media one
0
0
24
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Security Alert! A Windows Local Privilege Escalation exploit has been discovered and published yesterday! This can be exploited by cyber criminals.
Tweet media one
0
4
17
@skocherhan
ܛܔܔܔܛܔܛܔܛ
3 years
I just completed @Pentesterlab 's Recon Badge!!!
1
1
16
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Mathematical puzzle via @engineers_feed
Tweet media one
13
0
15
@skocherhan
ܛܔܔܔܛܔܛܔܛ
6 months
September's BSides New-Castle conference @bsidesncl was truly a place where security enthusiasts and pros came together to learn, share, and push the boundaries of cyber field. Special shout-out to @Coffee_Fueled and his fantastic Speaker Prep Workshop
0
6
12
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Tweet media one
2
4
14
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Something to read over the weekend
Tweet media one
0
1
13
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
0
0
14
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
Tweet media one
0
5
14
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
People lose their way when they lose their why.- Michael Hyatt #quote
0
6
13
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
Stargate Budapest by Mark_Mervai http://t.co/fEgp7IwdOb
Tweet media one
0
5
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Some WAFs (Web Application Firewall) can't parse JSON. So, if an attacker attempts SQL injection by prepending JSON syntax to the SQL query then WAF won't be able to check it. Which means, WAF bypass!
Tweet media one
0
6
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
7 months
Tweet media one
0
0
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 months
To XOR, or not to XOR? #CyberAttack
Tweet media one
3
0
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Humour de pentester :)
Tweet media one
0
0
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Cyber Kill Chain in Action
0
6
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Tweet media one
1
4
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Go script to guess an API key / OAuth token #pentest #bugbounty #security #apikey
Tweet media one
0
3
12
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Tweet media one
0
0
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
3 years
Check out Subject: Point Alpha on @Kickstarter #ColdWar #SupportIndieFilm
0
5
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Guide to Reversing and Exploiting iOS binaries Part 2: ARM64 ROP Chains
Tweet media one
1
4
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Windows 11 reverse shell in 7steps, undetected by Windows Defender
0
1
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Kali linux 2022.2 released check out the new tools
Tweet media one
0
3
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
6 months
After a 4 hour exam and 106 questions, I was awarded with the @CertifyGIAC GSEC certification. Thanks to @_IanReynolds and @SANSInstitute for a great training and learning material. Feeling grateful and ready to tackle new horizons. #infosec #cybersecurity #sans
Tweet media one
1
0
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
JVM Reverse Engineering - I have just completed this room! Check it out: #tryhackme #reverseengineering #java #bytecode #asm #jvm #jvmreverseengineering #jvmreverseengineering via @realtryhackme Special thanks for write-up incredible @__LillyK3lly__ 💞🇬🇷
Tweet media one
1
3
11
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Bohemian IceID byJosh Hopkins & Thibault Seret S2 Threat Research Team @teamcymru_S2 @BSidesCymru #CyberSecurity #ThreatHunting #threatintel #Malware
Tweet media one
1
0
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
8 Must Have PHP Quality Assurance Tools http://t.co/AygeGfTAOO via @bitfalls #testing #php
0
6
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Bypassing AVs by C# Programming v2.0 #redteam #pentesting #cobaltstrike
0
1
5
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Tweet media one
2
4
7
@skocherhan
ܛܔܔܔܛܔܛܔܛ
3 years
Tweet media one
1
1
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
FORTE12 over Ukraine #usaf #osint #Ukraine
Tweet media one
0
2
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 months
Scored #19 in DFIR Labs CTF. Leveraged Elastic and Kibana Query Language (KQL) for in-depth investigations of cyber attack challenges. Congrats to the winners!
Tweet media one
@TheDFIRReport
The DFIR Report
2 months
🎉 Today’s the day! 🎉 Our first DFIR Labs CTF starts at 17:00 UTC with 50+ participants! 🕵️‍♂️💻 Participants will tackle two cases, including a brand new one! Compete for the top spot and win free swag for the top 3. Good luck to all! 🍀 #dfir #soc #infosec #blueteam
3
8
34
1
1
7
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Have you ever noted rdpclip.exe executing? Or seen in TeamViewer/Anydesk logs signs of clipboard usage and wondered what was going on? This is comprehensive guide on how to perform CLIPBOARD forensics :) Woooo!!! #dfir #digitalforenciscs @inversecos
Tweet media one
0
3
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Tweet media one
0
0
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Windows PrivEsc - I have just completed this room! Check it out: #tryhackme #privesc #privilege escalation #windows #windows privilege escalation #tib3rius #windows10privesc via @realtryhackme
0
0
10
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
Burning Sunset by Fabio Cappellini
Tweet media one
1
4
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
7 years
Tulip Bed by Vidhya Ranganathan
Tweet media one
0
2
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Security Operations Centre (SOC) Tools
Tweet media one
0
2
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
1 year
Hackers heading to #h14420 event @Hacker0x01
Tweet media one
0
1
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Windows 11 reverse shell in 7steps, undetected by Microsoft Defender
0
2
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Elastic released 1000+ yara rules and 200+ endpoint behavior rules as a commitment to open security and transparency
Tweet media one
0
0
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Rename a EXE file's extension from exe to pif, scr or, com. Now double click on the file. It will run. Cyber criminals can create EXE malware and change the file extension from exe to scr. Now, if the victim double clicks on the file, victim is actually running the EXE malware.
Tweet media one
0
2
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Badbyte - I have just completed this room! Check it out: #tryhackme #ftp #enumeration #port forwarding #cve #cms #badbyte via @realtryhackme
0
0
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
Tweet media one
1
4
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
History of 127/8 as localhost/loopback addresses?
Tweet media one
0
1
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Conti - I have just completed this room! Check it out: #tryhackme #conti #ransomware #splunk #MITRE ID S0575 #contiransomwarehgh via @realtryhackme
0
0
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
Tweet media one
0
7
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 months
Lisa Forte @ BSides Bristol
Tweet media one
0
1
7
@skocherhan
ܛܔܔܔܛܔܛܔܛ
10 years
RT @GrowthHackers_ Lean startup lessons that helped Dropbox become a $10B company by Drew Houston http://t.co/YqmAKTwbfu #growthhacking
0
0
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Just completed Offensive Pentesting Learning Path #tryhackme #Pentesting #cybersecurity
Tweet media one
0
1
9
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Tweet media one
0
2
6
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
How do you print a whole year calendar in Python?
Tweet media one
0
0
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Tweet media one
0
1
6
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Android Malware Analysis - I have just completed this room! Check it out: #tryhackme #security #android #apk #androidmalwareanalysis via @realtryhackme
0
1
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
9 years
Creating a graph application with Python, Neo4j, Gephi
0
5
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
🇹🇳 Tunisian Air Force Lockheed C-130J-30 Hercules #02B26A TUN64 Z21121 took off from N'Djamena
Tweet media one
3
1
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Splunk Use Cases • Audit Log Tampering • Finding Large Web Uploads • Detecting Recurring Malware on Host • Brute Force Attacks • Unencrypted Web Communications • Finding New Local Admin Accounts • Basic TOR Traffic Detection • Rogue DNS detection
Tweet media one
0
3
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
8 years
Purple Sky by Ivan Hole
Tweet media one
0
8
7
@skocherhan
ܛܔܔܔܛܔܛܔܛ
9 years
Don’t try to be original, just try to be good. — Paul Rand #quote #startup
0
3
8
@skocherhan
ܛܔܔܔܛܔܛܔܛ
3 years
Check out Dies Caligo: A period piece pilot film by Dies Caligo on @Kickstarter #SupportIndieFilm #Sweden #drama #shortfilm
0
4
7
@skocherhan
ܛܔܔܔܛܔܛܔܛ
2 years
Beware! Attackers can add any subdomain before a Google form URL. Replace the 'apple' with your company name and it will still work! Employees may trust such phishing form by viewing the company name. #cybersecurity #phishing #redteam #hacking #cyber
Tweet media one
0
1
8