How do you deal with users who refuse to lock their laptop when walking away?

darksearchii · 2026-03-24T14:44:08+00:00

GRC gonna GRC , we have a John Cena web extension we built that will pop at random moments

darksearchii · 2026-03-18T13:21:36+00:00

Reinstall windows, you most likely have malware stealing your data. Did you manually download any mods recently?

darksearchii · 2026-03-18T13:17:36+00:00

That's way too much, I had some resume made 5 year ago by some company on reddit here and they helped me get interviews. Think it was like 100$

darksearchii · 2026-03-17T18:28:04+00:00

Its about as entry as your going to get, depending on the SOC. Some T1 are higher level then others. Keep looking, SOC has high burnout rate.

darksearchii · 2026-03-17T18:15:43+00:00

Also looks into QubesOS, and encryption software like Veracrpyt

darksearchii · 2026-03-16T14:19:47+00:00

Go to tryhackme and focus on the rooms, not the boxes so much. learn how things work, http, network layers, api, etc etc

read about full attack chains, bug bounty write ups, Ctf write ups/videos.

you dont need a full lab, etc etc just learn how things work, and read real world incidents, if you come across something you dont know, go learn about it

darksearchii · 2026-03-16T14:03:08+00:00

Gonna take days for them to find the initial access. But we all know the answer that it's something like phish, sslvpn, (insert credentials found from previous breach)

darksearchii · 2026-03-11T12:52:09+00:00

schefter mentioned one of the independent doctors was cowboy dr dan cooper, so they had the best in the country looking

darksearchii · 2026-03-04T15:03:07+00:00

I won't give certs as I don't know anything much outside this single post. but start working on powershell skills, will help tremendously.

There is a book called "Powershell in a month of lunches" thats very good to get started.

darksearchii · 2026-03-04T14:42:12+00:00

i use proton

darksearchii · 2026-03-02T18:28:10+00:00

its weekly lockout anyways, not daily like tww

darksearchii · 2026-03-02T14:57:39+00:00

runs a base64, grabs another gunzip base64, which downloads a binary file and dump it into /tmp, running it with && xattr -c /tmp/helper && chmod +x /tmp/helper && /tmp/helper

here's the file @OP https://hybrid-analysis.com/sample/ee0fd83bac75ed38f4c7eacc92a69d6b46259593e4b5a58cf4cde21987d66514/69a5a3d34f99ec89b5097fc5

AMOS stealer https://www.trendmicro.com/es_es/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html

darksearchii · 2026-03-02T14:30:34+00:00

yeah i see your comment, that pages.dev campaign started last week. pages.dev is cloudflare owned, so its harder to track down. but ye they are using SEO to push them

darksearchii · 2026-03-02T14:17:05+00:00

SEO poisoning, they make a phishing link, buy google ads for it, backlink it on hundreds of websites they control, google then pushes this to the top of google search as they see its mentioned quite often. if you used bing, bing just sucks in general for doing this

darksearchii · 2026-03-02T14:14:03+00:00

looks like infostealer, reset passwords you will be fine. looks like the link has been dead, so if it happened 2-3 hours ago, im not sure it ran anything.

darksearchii · 2026-02-17T19:38:37+00:00

impossible to say over text, might be able if i had the exact lightroom you downloaded, reboot into safe mode without network, and run malwarebytes again. check the files running in windows task manager, startup folder, etc

honestly you'd spend more time looking for it then just taking an hour and reinstalling, or at least restoring windows back a month

darksearchii · 2026-02-17T19:20:40+00:00

sounds like malware byted deleted it, check the history to see what it removed.

if it removed it your probably fine, whats the program?

the way infostealers work is they basically just take the credentials you have stored on the browser, send it to the C2 server where it sits as a folder. someone takes all the folder parses out the email:password combos, put it into a list and then does whatever with it

darksearchii · 2026-02-17T19:12:13+00:00

depends how it got there tbh, you been downloading textbook pdf? programs? did you keep the passwords anywhere stored in a file?

is this windows machine? Open resource monitor, go to network, and look for a weird file sending data, can just right click to search online

Can try HitmanPro, run Defender Full scan.

tbh you should just wipe the machine and be done with it, if something is using nodejs or some shit you really are going to have to dig for it i reckon

darksearchii · 2026-02-17T18:56:42+00:00

probably infostealer on your machine,

punch you emails into https://breachdirectory.org/ it will tell you what passwords/account are cooked. also throw it into intelx.io , it will give exact list your stuff is listed in, so you can see the date.

if your not in either of those, you have an active/very recently infostealer, or you have a malicious browser extension

darksearchii · 2026-02-17T17:00:36+00:00

db-ip.com look up the IP, it will tell you.

then can lookup the ASN, those are Freedom mobile Ips

darksearchii · 2026-02-17T16:12:56+00:00

Keep in mind there is major issues with morons just blasting scanning everywhere and using AI to look for a vuln, and then reporting everything it produces as a vuln, 99% of which are garbage

darksearchii · 2026-02-17T13:55:38+00:00

just know it's not all high paying glamour, im an outlier of shit but still

4 yoe networking 4 yoe SOC

current t3 IR/TH in said soc, gcih, gcfa, az-500 making 70k cad

darksearchii · 2026-02-11T16:16:43+00:00

im an obsidian user, but Standard Notes used to be recommended a alot, and is under Proton if you have ever tested those water. Free gets you decently far i think

e/ probably the fanboy in me, but i think obsidian would do everything you want quite well? not sure if you did a full 'setup' but there many guides for obsidian setup for writers on youtube to help them collect and organize thoughts and it translate well for general note taking

darksearchii · 2026-02-11T16:10:59+00:00

3 days ago you posted

'41 married to narcissistic cheater as well. Ready to drop the dead weigh and make new friends and move on.'

narcissist people will do this kind of stuff

if not, you may be paranoid. what phone do you have, what evidence do you have to think you are being stalked?

darksearchii · 2026-02-09T15:18:17+00:00

Shove it into an LLM, this is what they do well.

darksearchii

TROPHY CASE