Microsoft Graph Permissions list classified by severity and privileged impact to detect risky OAuth consents, over-privileged apps, consent phishing, apps with dangerous access, and enrich SIEM detections/app reviews. github.com/mthcht/aweso...

CTI and SOC folks, you’ll like this one! ThreatCheck lets you select IOCs from any web page, bulk-extract and dedupe them, then pivot across 29 threat intel platforms with optional auto API enrichment. chromewebstore.google.com/detail/threa... github.com/mthcht/threa...

Launching oauthsentry.github.io Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub). Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾

Adding VSXSentry-Guard A VS Code extension that automatically blocks and removes malicious extensions from the VSXSentry feed. No enterprise policy management needed - one click and you're protected. marketplace.visualstudio.com/items?itemNa...

mthcht@mthcht.bsky.social · 4mo ago

💠 VSXSentry 💠 vsxsentry.github.io VS Code Extensions threat intel feeds for multiple platforms, VSIX analyzer, scripts & policy generator, remediation and forensic traces guide

Launching oauthsentry.github.io Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub). Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾

Nehboro, a browser extension blocking phishing attempts on page load nehboro.github.io ⚡️ Dedicated IOCs feed - Blocking BAD AS IP ranges, domains & reported urls 📊 97 heuristic detections for all kind of scams 🤖 AI Analysis on demand hopefully in the webstore soon

Automatically block and disable malicious browser extensions with a browser extension! Perfect for family devices or anyone who just wants simple protection, no GPOs or enterprise setup... now on the Chrome Web Store: chromewebstore.google.com/detail/extse...

ExtSentry Guard - Chrome Web Store

Detects and warns about known malicious browser extensions using the ExtSentry IOC feed.

chromewebstore.google.com

💠 VSXSentry 💠 vsxsentry.github.io VS Code Extensions threat intel feeds for multiple platforms, VSIX analyzer, scripts & policy generator, remediation and forensic traces guide

🧅 TOR archive feed: tor-archive.github.io Every IP that has ever been a TOR node! Searchable with full timeline, exit/guard/middle role, country, ASN, updated hourly since 2024.

🧩 ExtSentry 🧩 extsentry.github.io Browser Extensions threat intel feeds for multiple platforms + extension checker, permissions analyzer, policy generator, forensic traces guide, remediation playbook & endpoint inventory scripts github.com/ExtSentry/Ex...

GitHub - ExtSentry/ExtSentry.github.io: Browser Extension Threat Intelligence feed - extsentry.github.io

Browser Extension Threat Intelligence feed - extsentry.github.io - ExtSentry/ExtSentry.github.io

github.com

LOLC2 Collection of C2 frameworks abusing legitimate services to evade detection Major update: new projects tested, enriched data, and deeper insights. lolc2.github.io

LOLFSAAS Living off Free SaaS Hundreds of SaaS platforms with free tiers, documenting abuse surface, opsec risks, authent methods, C2 framework mappings, and operational limits. lolfsaas.github.io

LOLEXFIL Living off the land Data Exfiltration method lolexfil.github.io

If you want to experiment with the Splunk MCP Server splunkbase.splunk.com/app/7931, I just published a client to interact with it: github.com/mthcht/Splun... it cost around 5 cents per splunk query, an automated case investigation cost an average of 50 cents depending on the complexity.

GitHub - mthcht/Splunk-MCP-Client: Query Splunk in natural language using Claude AI and the Splunk MCP Server.

Query Splunk in natural language using Claude AI and the Splunk MCP Server. - mthcht/Splunk-MCP-Client

github.com

Lumma Stealer - 995 sinkholed domains by Microsoft gist.github.com/mthcht/4b16e...

Lumma Stealer sinkholed domains

Lumma Stealer sinkholed domains. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

it used to be great...

I started another list dedicated to mutex names for detection github.com/mthcht/aweso... Help me enhance this list, I still have plenty more to add!

THIS WEBSITE HAS BEEN SEIZED Discover domains tied to sinkhole NS servers at sinkholed.github.io Filter by TLD or NS, export in JSON/CSV, weekly update! Search for the known sinkhole Name Servers in DNS query logs and web access to the sinkholed domains to identify potentially compromised hosts!

sinkholed.github.io

😯 I have 652022 sinkholed domains extracted here github.com/mthcht/aweso...

mthcht@mthcht.bsky.social · last yr.

In case you don't want to do this yourself, I just discovered that you can request access to a complete list of all existing domains across 1131 TLDs on czds.icann.org for free, including NS records! The lists are updated every month, approval is required for each TLD 🌍

🎭 #ThreatHunting February updates 🎭 🐙 release: github.com/mthcht/Threa... 🌐 Site: mthcht.github.io/ThreatHuntin... 🧬 yara: github.com/mthcht/Threa... 🐾 Specific artifact lists: github.com/mthcht/aweso...

From over at the Bad Place: There's an interesting NTFS symlink attack outlined here: https://dfir.ru/2025/02/23/symlink-attacks-without-code-execution/ Basically, if an NTFS filesystem is corrupted in a way to provide duplicate file names, Windows will […] [Original post on infosec.exchange]

It took just 3 hours: RCE → Metasploit C2 → Anydesk for remote GUI-access → LockBit ransomware Interestingly, we observed the threat actor using PDQ Deploy, a patch management tool. Read the report here:

Confluence Exploit Leads to LockBit Ransomware

Key Takeaways The intrusion began with the exploitation of CVE-2023-22527 on an exposed Windows Confluence server, ultimately leading to the deployment of LockBit ransomware across the environment.…

thedfirreport.com

A bookmark of my lists is now automatically generated after each update in my repo github.com/mthcht/aweso... I'm also looking to automatically add my starred repos lists github.com/mthcht?tab=s... in this bookmark but there doesn’t seem to be a API endpoint for the stars lists 🤔 ?

mthcht@mthcht.bsky.social · 2y ago

📑 Detection Lists 📑 github.com/mthcht/awesome… #ThreatHunting #DFIR #SOC

It's growing! Now at 38 services and 82 projects 🙈 What's your favorite LoLC2?

mthcht@mthcht.bsky.social · 2y ago

LOLC2 - a collection of C2 projects that operate exclusively through legitimate services lolc2.github.io, I'm probably missing some projects let me know ! 🌐 lolc2.github.io 🐙 github.com/lolc2/lolc2....

Pushed a #KQL for: Successful device code sign-in from an unmanaged device. Query is available for AADSignInEventsBeta and SigninLogs. Less known is the AADSignInEventsBeta filter for device code: | where EndpointCall == "Cmsi:Cmsi" 🏹Query: github.com/Bert-JanP/Hu...

In case you don't want to do this yourself, I just discovered that you can request access to a complete list of all existing domains across 1131 TLDs on czds.icann.org for free, including NS records! The lists are updated every month, approval is required for each TLD 🌍

mthcht@mthcht.bsky.social · last yr.

I have a list of NS used for sinkhole domains and seized servers: raw.githubusercontent.com/mthcht/awesome… I'm searching for the domains, on my server I can resolve a record type for ~400 million domains per day with github.com/blechschmidt/m��� 😃 Massive improvement compared to other solutions!

Hey SDDL SDDL: Breaking Down Windows Security One ACE at a Time www.splunk.com/en_us/blog/s.... Thrilled to share my first blog at @splunk! @mhaggis.bsky.social and I take a deep dive into the weird & exciting world of SDDL and ACEs - what they are, how they work, and how attackers can abuse them.

Hey SDDL SDDL: Breaking Down Windows Security One ACE at a Time | Splunk

Explore SDDL in Windows security with our comprehensive guide to help enhance your defensive strategy against privilege escalation attacks.

splunk.com

Path masquerading zerosalarium.com/2025/01/path... Interesting technique, if you're hunting for this, you can directly search the unicode characters in Splunk 🥷

Most SOCs handle hundreds to thousands of detection rules in their SIEM. Proper categorization is essential when creating a new detection, as it helps define criticality, urgency, implementation effort, and verbosity level. Keeping things structured will reducing alert fatigue!

I'll keep this updated, let me know if you have any projects to add! some C2 candidates: github.com/lolc2/lolc2....

Catalin Cimpanu@campuscodi.risky.biz · last yr.

DFIR specialist Mthcht has released LOLC2, a collection of C2 frameworks that leverage legitimate services to evade detection lolc2.github.io