@catsalad #you #will #never #get #me #alive

@Beggarmidas @Lizette603_23

I'm not one for conspiracy theories, but even I sense something doesn't quite add up.

There were too many #TechBros on team #Trump with too much to lose by publicly backing him, but they CONFIDENTLY did anyway.

Trump: #Get out and vote, just this time. You won’t have to do it any more. Four more years, you know what? It’ll be fixed, it’ll be fine, you won’t have to vote any more, my beautiful Christians.”

Something stinks! PM sent...

Managed to create a #powershell script to disable the self-service purchases too speed it up a bit.

# This script disables self-service purchase for all Microsoft products.
# Requires Global Admin permissions to set the correct values.

try{
Get-InstalledModule MSCommerce
}catch{
Install-Module MSCommerce
}
Import-Module MSCommerce
Connect-MSCommerce

#Get all of the products that is available for self-service purchase.
$products = Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

foreach ($product in $products)
{
write-Host "Disable self-service purchase on: "-NoNewline
Write-Host $product.ProductName -ForegroundColor Red -NoNewline
Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $product.ProductID -Value "Disabled"
write-host "[DONE]" -ForegroundColor Green
}

# Finds the Copilot SKU and disables self service
# Uncomment the two lines below and comment out the foreach loop if you only want to disable self-service for Copilot
#$product = Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Where-Object {$_.productname -eq "Microsoft 365 Copilot"}
#Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -Value "Disabled" -ProductId $product.productID

Once the registry key was modified and the payload linked to in the registry data, persistence was successfully gained, which enabled the adversaries repeated access to the victim. This is a great article and just the tip of the iceberg when it comes to technical details, so check it out for yourself! Enjoy and Happy Hunting!

The Updated APT Playbook: Tales from the Kimsuky threat actor group
https://www.rapid7.com/blog/post/2024/03/20/the-updated-apt-playbook-tales-from-the-kimsuky-threat-actor-group/

I know I share this Cyborg Security Community hunt package a lot, but it's because this behavior is extremely commonly used! It is just one of many behaviors that we help you hunt for that stand the test of time!

Autorun or ASEP Registry Key Modification
https://hunter.cyborgsecurity.io/research/hunt-package/8289e2ad-bc74-4ae3-bfaa-cdeb4335135c

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #huntoftheday #get hunting