Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

Toby Lewis

@tobaslouis.co.uk
630 followers 1K following 72 posts

Global Head of Threat Analysis at @Darktrace.com All things Cyber Security Ops, Threat Hunting, Threat Intel and Incident Mgmt.

PostsRepliesMedia
Toby Lewis @tobaslouis.co.uk · 30/12/2025
Two birds. One proverbial stone.
010 1
Toby Lewis @tobaslouis.co.uk · 05/01/2025
A dog walk on the beach
030 3
Toby Lewis @tobaslouis.co.uk · 31/12/2024
By default, and unless you have a premium subscription, Graphs made in VirusTotal are public and form part of their community engagement. Want to know if anybody is researching an IOC? Want to know what other steps they've made in the investigation? VirusTotal public graphs will tell you.
Screenshot of VirusTotal Graphs
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
We can also use VirusTotal to tell us how many times this file has been uploaded, and a little bit of information about them. In this case, by a single user based in the US (by IP-GEO) and uploaded via API. This means that it either formed part of a script, or via an integration with another tool.
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
What else was in that "sharedStrings.xml" file - VirusTotal gives you the ability to view the contents of files. In this case, the only unique strings in the parent XLSX files are the IOCs we already know about. Maybe not the most exciting in this case, but worth a check!
XML blob of text showing all of the unique strings
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
In other words, somebody uploaded an XLSX of IOCs to VirusTotal, which then broke apart the constituent components as separate files. Then, realising that they made a mistake, requested that VirusTotal take down the original XLSX file. Unfortunately, that still left behind the constituent files
Screenshot from VirusTotal showing the process for requesting file deletion
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
So what Excel file was this "sharedStrings.xml" file originally part of? VirusTotal's "Compressed Parents" field reveals a SHA256 hash of a file.... which doesn't exist on VirusTotal. Or at least, it doesn't any more.
Screenshot from VirusTotal showing the hash of the compressed parentSearch results in VirusTotal showing zero results
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
A modern day Excel file (xlsx), is actually just a compressed file (zip), containing lots of individual components, such as fonts, graphics and other rich text content. This blog is a good breakdown if you're interested in diving in more: henrikmassow.medium.com/hacking-exce...
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
But what is sharedStrings.xml? Or more specifically "xl/sharedStrings.xml"?
Screenshot from VirusTotal showing the full filename of sharedStrings.xml
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
Interesting OpSec aspect with regards to the BeyondTrust compromise. (H/T to @GossiTheDog.cyberplace.social.ap.brid.gy for first spotting this) Having a search for some of the IOCs from the BeyondTrust blog, reveals that they appear in a file uploaded to VirusTotal on the 19th December
Screenshot from VirusTotal showing file uploaded on 19th December
120 2
Toby Lewis @tobaslouis.co.uk · 31/12/2024
5) BeyondTrust have shared the following IOCs, presumably IP addresses used by attackers to access BeyondTrusts infrastructure and to pivot into customers: 24.144.114[.]85 142.93.119[.]175 157.230.183[.]1 192.81.209[.]168 As well as some additional IPv6 addresses:
Screenshot of IOCs from BeyondTrust
100 1
Toby Lewis @tobaslouis.co.uk · 31/12/2024
More information on the breach: 1) In a letter to US Senators, it is revealed that attackers were able to gain access to a service at BeyondTrust that gave them remote access to US Treasury workstations. legacy.www.documentcloud.org/documents/25...
Screenshot of letter to US Senators detailing some of the facts of the breach
110 1
Toby Lewis @tobaslouis.co.uk · 04/12/2024
I can only read this in the voice of the guy who reads out the Football results.
A cinema listing showing Gladiator 2, Paddington 3
020 2
Toby Lewis @tobaslouis.co.uk · 30/11/2024
England Women’s Football is more fun to watch than the men’s game
020 2
Toby Lewis @tobaslouis.co.uk · 30/11/2024
OSINT challenge - Easy Edition #lionesses
Wembley Stadium - I did say this was easy.
010 1
Toby Lewis @tobaslouis.co.uk · 19/11/2024
As we're in this rapid growth of @bsky.app, not only are we going to see accnts impersonating high profile individuals, but critically, impersonating high reputation news sources. All it would take is some imaginative "Breaking News" to hit public confidence. Can the real BBC News please stand up?
Screengrab of search results in Bluesky for the handle "bbcnews". It shows a list of accounts all of which could be the real BBC news, but it's unclear.
053 5
Toby Lewis @tobaslouis.co.uk · 17/11/2024
A friend asked if I had any pre-prepared content on phishing. I was feeling particularly lazy, so got ChatGPT to give it a go. I actually quite like the simplicity of its response.
What is Phishing? Phishing is when a bad person tries to trick you into giving them your secret stuff, like passwords or credit card numbers. They pretend to be someone you trust!
050 5
Toby Lewis @tobaslouis.co.uk · 16/11/2024
Is it…. Not speeding?
Clickbait article with headline “Driver reveals trick to avoid speeding fines”
031 3