Georg311 - Network

Also quite nice #xzutils #xzbackdoor #xz :https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

Also quite nice #xzutils #xzbackdoor #xz :
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

Best #xz #xzutils #xzbackdoor summary/timeline so far:https://boehs.org/node/everything-i-know-about-the-xz-backdoor

Best #xz #xzutils #xzbackdoor summary/timeline so far:
https://boehs.org/node/everything-i-know-about-the-xz-backdoor

The xz gitlab issues right now https://github.com/tukaani-project/xz/issues/92 🙈

The xz gitlab issues right now https://github.com/tukaani-project/xz/issues/92 🙈

So... Under the premise that only #xz Version 5.6+ is compromised lts OS seem fine. Ubuntu is still using oder versions, Debian is only...

So... Under the premise that only #xz Version 5.6+ is compromised lts OS seem fine. Ubuntu is still using oder versions, Debian is only using newer ones in testing. Kali updated to 5.6 last week,but testing sources were already reverted to a 5.4 version so one can 'just upgrade'

Oh wow... https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers

Oh wow... https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers

https://www.bleepingcomputer.com/news/microsoft/hackers-stole-microsoft-signing-key-from-windows-crash-dump/Oh my.. Somehow this conclusion...

https://www.bleepingcomputer.com/news/microsoft/hackers-stole-microsoft-signing-key-from-windows-crash-dump/

Oh my.. Somehow this conclusion doesn't feel very satisfying

T568b, now with poeSo... Brown cable to thisWhite cable to that...Aaand finishedWho dares to plug the cable in..?Phew...it worked

T568b, now with poe

So... Brown cable to this

White cable to that...

Aaand finished

Who dares to plug the cable in..?

Phew...it worked

What if all of this was a ploy to get people to use advanced hunting / E5 #asr #asrrules #defender #signature #ASRmagedon #ASRmageddon

What if all of this was a ploy to get people to use advanced hunting / E5 #asr #asrrules #defender #signature #ASRmagedon #ASRmageddon

Great rule for finding out via advanced hunting what defender deleted```DeviceEvents| where ActionType ==...

Great rule for finding out via advanced hunting what defender deleted

```
DeviceEvents

| where ActionType == "AsrOfficeMacroWin32ApiCallsBlocked" and Timestamp >= datetime("2023-01-13 00:00:00Z")

| order by Timestamp

| where FileName endswith ".lnk"
```

Thanks reddit

https://www.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/j464ta6/

#ASRmagedon #asr #defender #signature

I've created a powershell script to try to fix the mess with the startmenu. It requires you to get the lnk files from some other pc but...

I've created a powershell script to try to fix the mess with the startmenu. It requires you to get the lnk files from some other pc but it should help in restoring from this
https://github.com/Georg311/RecreateStartMenu/
#defender #signature #ASRmagedon #ASR

I've created a powershell script to try to fix the mess with the startmenu. It requires you to get the lnk files from some other pc but...

I've created a powershell script to try to fix the mess with the startmenu. It requires you to get the lnk files from some other pc but it should help in restoring from this
https://github.com/Georg311/RecreateStartMenu/
#defender #signature #ASRmagedon #ASR

They're tracking the problem under MO497128 #ASR #defender #defender "workaround" is to set the Office Macro Win32 System...

They're tracking the problem under MO497128 #ASR #defender #defender
"workaround" is to set the Office Macro Win32 System Calls rule to audit only #ASRmageddon

#defender #signature desaster has a name: #ASRmageddon

#defender #signature desaster has a name: #ASRmageddon

Seems to be an ASR Rule"Block Win32 API calls from Office Macro ASR"

Seems to be an ASR Rule
"Block Win32 API calls from Office Macro ASR"

#defender #signature #update #taskbar https://www.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/

#defender #signature #update #taskbar https://www.reddit.com/r/sysadmin/comments/10ar1vb/multiple_users_reporting_microsoft_apps_have/

https://www.reddit.com/r/sysadmin/comments/10arfxt/potentially_faulty_virus_definition_update/

https://www.reddit.com/r/sysadmin/comments/10arfxt/potentially_faulty_virus_definition_update/

Heads Up - there's a #defender #signature #update which kills all shortcuts in the startmenu and on the taskbar

Heads Up - there's a #defender #signature #update which kills all shortcuts in the startmenu and on the taskbar

How do you keep up with all the stuff? sometimes i wish my day had 48hrs..#priorities #priorities

How do you keep up with all the stuff? sometimes i wish my day had 48hrs..
#priorities #priorities

Oh my... Thinking how Bad the #circleci breach may be...Let's See how it unravels

Oh my... Thinking how Bad the #circleci breach may be...
Let's See how it unravels

If you don't depend on #odbc or #scvmm that is

If you don't depend on #odbc or #scvmm that is