Marc Rivero López

Avui #17Agost i sempre un record dolorós Han passat 2 anys dels #AtemptatBarcelona i #AtemptatCambrils però el nostre pensament és encara amb totes les víctimes i familiars Agraïment als cossos de #seguretat #emergencies i a tothom que va ajudar en aquells fets traumàtics #17A

Question about tools in #cybersecurity #infosec and #ThreatIntelligence, what app/software do you use to take notes and store research information? For example, in OSINT investigations, tracking campaigns, actors... Please RT!! I need a good one!! ;) #tools #threatintel #malware

3. next lookup for the x64 directory and look at remote desktop related directory, somewhere around the lines of r..topservices; look at the files and compare the original one with these one using Bindiff for example

2. once you have the cab files, I used @Laughing_Mantis great #Powershell script 'patchexctract.ps1' to extract the files in categorized folder and structure: "Powershell -ExecutionPolicy Bypass -File Extract13.ps1 -Patch windows10.0-*.msu -Path c:\Patch\Aug19

1. For those who want to investigate what is patched with eg #CVE-2019-1181 or 1182: start with downloading the patch file, in my case for Win10 a 266MB file. Next use "Expand F:* windows(patch file).msu . " to extract cab files