Threat Hunting - DFIR - Detection Engineering
Joined February 2023
- Tweets147
- Following385
- Followers1.1K
- Likes305
The malicious vscode extension could be one of these extensions recently removed from the store DevCrew.devc-python-toolkit🤔? not shared yet by microsoft, check vsxsentry.github.io/ and use marketplace.visualstudio.com… to automatically block and uninstall these
1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.
Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
CTI and SOC folks, you’ll like this one!
ThreatCheck lets you select IOCs from any web page, bulk-extract and dedupe them, then pivot across 29 threat intel platforms with optional auto API enrichment.
chromewebstore.google.com/de…
github.com/mthcht/threatchec…
My new toxic trait:
A useful browser extension project every week 😆
It’s been a productive month. I almost replaced every extensions I used with my own. Funny enough, building a good dark reader extension without causing performance issues ended up being the hardest one, some are published now!
Launching oauthsentry.github.io
Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub).
Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾
ALT oauthsentry.github.io
Attackers keep abusing trusted tools until "just a browser issue" becomes full host compromise
Useful projects to help block the usual suspects
🧩EXTSentry extsentry.github.io
🧩Nehboro github.com/Nehboro/nehboro
💠LOLBAS lolbas-project.github.io/lol…
💠LOLRMM github.com/magicsword-io/LOL…
ALT https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/
You’ll find a reference link for each extension id in the project. Lmk if any of them are inaccurate. If you’d prefer to filter out certain categories such as excluding VPNs and keeping only the malware category, you can use the full dataset here: extsentry.github.io/feeds/sp…
Nehboro, a browser extension blocking phishing attempts on page load
nehboro.github.io
⚡️ Dedicated IOCs feed - Blocking BAD AS IP ranges, domains & reported urls
📊 97 heuristic detections for all kind of scams
🤖 AI Analysis on demand
hopefully in the webstore soon
socket.dev/blog/108-chrome-e…
108 additional malicious browser extensions !
They’re now added to the extsentry.github.io/ feed
protect your grandma with extsentry-guard chromewebstore.google.com/de…🧓
Almost everything people casually read as Git provenance is spoofable: identity, dates, messages, trailers, ancestry, refs, and tags.. and even signed commits does not make the timeline true; it only proves the payload was signed, the only real time anchor is "verified_at"
i gpg signed the commit so you can easily see when it was truly created hehe github.com/pcaversaccio/test…
