Infosec.Pub
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
digicatM to blueteamsecEnglish · 16 days ago

The (!FALSE) Pattern: How SOAPHound Queries Disappear Before They Hit Your Logs

www.huntress.com

external-link
message-square
0
link
fedilink
2
external-link

The (!FALSE) Pattern: How SOAPHound Queries Disappear Before They Hit Your Logs

www.huntress.com

digicatM to blueteamsecEnglish · 16 days ago
message-square
0
link
fedilink
The (!FALSE) Pattern: How SOAPHound Queries Disappear Before They Hit Your Logs | Huntress
www.huntress.com
external-link
SOAPHound's LDAP query (!soaphound=*) never appears in Event 1644 logs, but it transforms into (! (FALSE)) through LDAP optimization. Understanding this transformation reveals a unique detection signature that most defenders have never seen.
alert-triangle
You must log in or # to comment.

blueteamsec

blueteamsec

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !blueteamsec@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 50 users / day
  • 163 users / week
  • 344 users / month
  • 953 users / 6 months
  • 226 local subscribers
  • 630 subscribers
  • 2.41K Posts
  • 202 Comments
  • Modlog
  • mods:
  • digicat
  • BE: 0.19.13
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org