#StateOfTheHack follow up. Thank you to everyone who tuned in, and we apologize for the technical difficulties and audio. We are going to get that figured out for future iterations. I wanted to follow up with indicators I talked about at the end to prove a point regarding #GDPR.:
My team develops sources and methods for pursuing adversaries across our customers networks, and beyond. We do not become reliant on a single source, nor do we allow the loss of a source to cripple our collection efforts. Loss of WHOIS information is not a deal breaker.
This is the domain I dropped in our #StateOfTheHack discussion today. The screenshot indicates we illuminated it on day zero of the adversary establishing it. The WHOIS information is privacy protected. However, we didn't discover the domain through registrant information. 
Two days later, someone uploaded the associated QUADAGENT sample to VirusTotal. This is insightful, as we can assess the threat actor actions a target within 48 hours of establishing infrastructure. However, the real story is how our team is able to get ahead of a nation state.
Keep this in mind when you see other practitioners complaining about the loss of WHOIS information. Lose your dependency.
QUADAGENT: d672d2d1b822f22249c3cc1d74b2afee and www[.]rdppath[.]com #apt #iran #threatintel #fireeye #tore #advancedpractices #adversarypursuit
QUADAGENT: d672d2d1b822f22249c3cc1d74b2afee and www[.]rdppath[.]com #apt #iran #threatintel #fireeye #tore #advancedpractices #adversarypursuit
• • •
Missing some Tweet in this thread? You can try to
force a refresh
