Don’t let them bust your Windows… services!

Here is the third episode of the Hunting Rituals blog series where our experienced threat hunters keep on testing hunting techniques and sharing them with you. By the way, the co-starring solution of this series is our weapon of proactive cyber defense – Group-IB MXDR.

Last time we started talking about the latest methods to capture the abuse of Windows services and even shared two hypotheses to test out. Did you have an occasion to appreciate it? If not, check it out here.

As a logical sequence of the previous two test ideas, focusing on service creation and teaching you to hunt for the events of service installation, this time we are going to share the next two hypotheses that concern service execution. In this blog post, we uncover attackers in disguise and cover hunting for process artifacts of files executed as services, both EXE and DLL ones.

Now we stop raining spoilers, just follow the link to read the blog.

#threathunting #mxdr #Window

🤔 Do you think that regular software updates are enough to keep your Apple devices safe? There are certain vulnerabilities, like checkm8, that can't be patched by just updating iOS. In our Medium post, we discuss Apple devices that are still at risk of this vulnerability. Check it out now.

#Apple #iOS #cybersecurity #vulnerability

Group-IB has been contracted by Fawry, a leading Egyptian e-payment company, following an alleged attack by the LockBit ransomware group. We are collaborating closely with Fawry to investigate and enhance system security. Further details in our press release.

#cybersecurity #LockBit #ransomware #DFIR

Our first Cybersecurity Day in Vietnam was epic!

Our top experts discussed the country's cybersecurity landscape, while teams battled it out in the CTF competition. Huge thanks to everyone who graced this event!

#cybersecurity #CTF #Vietnam #events

🕵️‍♂️ Ever wondered what threat intelligence is, how it is collected, and who needs it? We've got you covered. In this Medium post, we'll introduce you to the fascinating world of cyber threat intelligence, breaking it down by answering a few seemingly simple questions.

#Cybersecurity #ThreatIntelligence