Neo23x0

rule MAL_BACKORDER_LOADER_WIN_Go_Jan23 {
   meta:
      description = "Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server."
      author = "Arda Buyukkaya (modified by Florian Roth)"
      date = "2025-01-23"
      reference = "EclecticIQ"
      score = 80
      tags = "loader, golang, BACKORDER, malware, windows"
      hash = "70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8"
   strings:

Neo23x0

This is a list of the domains used in the contact email addresses found in the Fortinet dump file as published by Belsen Group and analysed by Kevin Beaumont on Mastodon : https://cyberplace.social/@GossiTheDog/113834848200229959
Some of these domains may just be the domains of free email services or services providers working for the actual victims. 

AE
----------------------------------------------------------------------
acsllc.ae
aisdubai.ae
alhamra.ae
alrayan.ae
alshirawi.ae

Neo23x0

# Basic Shell Escapes
rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e 'bash -c "bash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/bash -i' 127.0.0.1:/dev/null
rsync -e 'dash -c "dash 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/dash -i' 127.0.0.1:/dev/null
rsync -e 'zsh -c "zsh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/zsh -i' 127.0.0.1:/dev/null
rsync -e 'ksh -c "ksh 0<&2 1>&2"' 127.0.0.1:/dev/null
rsync -e '/bin/ksh -i' 127.0.0.1:/dev/null

Neo23x0

title: Correlation - Multiple Failed Logins Followed by Successful Login
id: b180ead8-d58f-40b2-ae54-c8940995b9b6
status: experimental
description: Detects multiple failed logins by a single user followed by a successful login of that user
references:
    - https://reference.com
author: Florian Roth (Nextron Systems)
date: 2023/06/16
correlation:
    type: temporal

Neo23x0

Guide to Use Nextron's Sigma EVTX Checker

It's a fast go-based scanner for Linux, Windows, and macOS that applies Sigma rules and outputs the matches as JSON.

Clone the Sigma Repository and cd into it

git clone https://github.com/SigmaHQ/sigma.git
cd sigma

Neo23x0

My LinkTree

https://linktr.ee/cyb3rops

Neo23x0

Removed Articles on MDSec's NightHawk

Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice

by Proofpoint

https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice

Studying "Next Generation Malware" - NightHawk’s Attempt At Obfuscate and Sleep

by Austin Hudson

Neo23x0

#!/bin/bash -x
hostname=$(hostname)
source=$(echo "$SSH_CONNECTION" | cut -d' ' -f 1)
geo=$(geoiplookup "$source")
curl -X POST --silent --data "payload={\"text\": \":bust_in_silhouette: SYSTEM: $hostname USER: $USER SOURCE: $source GEO: $geo\"}" https://hooks.slack.com/services/XXXXXXXX_YOURHOOK_XXXXX > /dev/null

Neo23x0

https://thedfirreport.com/
https://www.zerodayinitiative.com/blog/
https://codewhitesec.blogspot.com/
https://www.digitalshadows.com/blog-and-research/
https://blog.talosintelligence.com/
https://www.riskiq.com/blog/
https://www.sekoia.io/en/blog-sekoia-io/
https://www.nextron-systems.com/blog/
https://www.microsoft.com/security/blog/
https://blog.truesec.com/

Neo23x0

VT Dorks to Find Samples Signed with Leaked NVIDIA Certificates

References: https://twitter.com/cyb3rops/status/1499514240008437762 https://twitter.com/GossiTheDog/status/1499781976835993600

More background: https://twitter.com/FuzzySec/status/1499462430275084307

All files signed with the certificates