Best approach to include YARA/Sigma Rules for Thread Prevention
Heya.

I've been looking into assisting my currently deployed Endpoint Protection (McCrapee) with Yara/Sigma-Rules to catch intrusions that McAfee won't detect, including malicious word macros and others, like known APT IoCs and others.

I think tools like Loki and Thor are perfectly fine (thats pretty much an understatement, I love the Loki Scanner) for analysis on already compromised systems or analysing logs in my SIEM, but im more of looking for something that offers real time detection based on those rules, or at least enables me to automatically scan files from specific sources before they are actually executed (e.g. Mail Attachments or files downloaded from an webbrowser - thinking of previous emotet campaigns - but also files that are within an downloaded passworded .zip archive, unpacked and then executed).

Are there any real time solutions currently out there?I'd love a flexible system like that, which I can then dynamically a rules to, based on newly detected threads without the need to wait for my av vendor to deploy an update that is already outdated by the time it arrives..

Thanks!

Edit for clarity:

What I am looking for would be best described as another Endpoint Protection Client thats beeing deployed on all workstations and works alongside our current solution that provides the functionality to scan files (from certain locations) either on access or right after they are beeing downloaded using Yara Rules.

Reasoning for this is the lack of flexibility within our current solution, which yara rules do provide.

Most or possibly all yara based solutions I've seen so far are widely used for scanning possibly compromised systems or regular scans in general, but not as an additional layer of defense, which is what I am looking for.

Edit: spelling
🗣amapofmymind

I know of a couple solutions like this.

For one, I currently use a network file carver (suricata) to extract files from network flows and then spool them to disk. I've run yara rules against these and they definitely require some tuning, as they trigger constantly. Actual malicious files (vs. just packed or obfuscated) are few and far between.

I do know some private sector companies that do something like what you are describing. What they did was take yara and customize it to be their own inhouse EDR solution. So they write their own signatures to detect targeted attacks they discover in-house. However, all the example I know just used it as an on-demand scanner, vs. on-access. Not sure how you could implement that (and it would kill performance if you have a lot of signatures and disk I/O).
👤K3wp


🎖@malwr

For my cakeday, I present: adding occlusion queries to an old game I love, Blockland! (via DLL)
Video

A few changes were done using DLL injection:
- The game batches by texture normally, not by location, so a custom batching solution is needed.
- Occlusion queries are launched using a conservative bounding box surrounding the brick chunks.
- There are other fixes like a frustum culling improvement in order to cull chunks in the shadow map passes.

Code!
🗣Valcle


🎖@malwr

Scripts for Headless CWE Issue Detection
I want to use the Ghidra analyzeHeadless capability to automatically assess binaries and identify CWE issues. Does Ghidra fit such a scenario and is anyone aware of Ghidra scripts available to perform such analyses?

I have compiled binaries (ELF & amd64) from the Juliet 1.3 CWE test suite for C/C++ and run analyzeHeadless against them using the default out-of-the-box Ghidra scripts. I get no identification of any issues even though the original source has 100s of injected coding issues.

Perhaps I am thinking of Ghidra use and/or application incorrectly?

Btw, I am aware of BAP and cwe\_checker, but would like the broadest toolset for identifying as many vulnerabilities as possible in given binaries or firmware.
🗣dwardoh21


🎖@malwr

The mechanics of LockDown Browser - Blogpost
🗣Ferib

Pretty neat, been a while since I looked at this. A few years back they did quite a few more things, but the big one was the fact that they ran a local proxy and mitm'd all your web traffic. I'd assume they would still be doing all that though.

Bunch of other fun things too where it'd disable a lot of windows shortcuts to things such as run, task manager and so on using the usual registry keys. Hilariously, you used to be able to run their restore application (reverts all its system changes) while LDB is running and you'd get most stuff back.

The lab version of LDB is much easier to get around because it doesn't need admin to run, so it's scope of being able to be annoying as fuck is severely limited.
👤NotActuallyAdam


🎖@malwr

MAC Forensics
Looking for ideas on performing remote forensics on our Macs. Are there any alternatives for Kape/Kansa for Macs?
🗣Avinbihari

osquery, volatility after you've acquired a memory image
👤CommercialWay1

Check out GRR, it use to be a beast to setup, but I heard it was easier now. Also OSquery may do enough for your needs. I have not used, but I’ve heard of MIG (Mozilla InvestiGator). Of course there are lots of pay EDR tools, but im not sure which have the best mac support.
👤APT0001

Depends on what you need. Do you have physical access to it? Do need just disk? Memory? Google Rapid Response(grr), Fresponse( for collection), Autopsy, Plaso.
👤APT0001


🎖@malwr

Tesla Autopilot hacked to go 85mph in a 35mph zone
🗣kpness

Kids with tape: I'm gonna do what Is called a pro-gamer move
👤Daemon1530

That’s a pretty funny exploit. Just a silly piece of tape.

Put up another sign “run from cops”.
👤TsunamiTreats

This is from 2014 according to the YouTube comments e:(the auto pilot 1.0)
👤1337turbo


🎖@malwr

Finding Python ReDoS bugs at scale using Dlint and r2c (CVE-2020-8492)
🗣Schwag

This reminds me of a similar project done for Javascript a while back, looking for ReDoS vulns at scale live on websites: https://www.usenix.org/conference/usenixsecurity18/presentation/staicu
👤wargame-mods


🎖@malwr

Discovering Affine Equalities Using Random Interpretation


🎖@malwr

Reverse Engineering Carrot Crazy – Part 3 – Level Maps
🗣ShantyTownRed

Part 1: https://www.huderlem.com/blog/posts/carrot-crazy-1/
Part 2: https://www.huderlem.com/blog/posts/carrot-crazy-2/


🎖@malwr

⚠️ https://twitter.com/a14xt/status/1230614898822066176 ⚠️

🎖@malwr

How to proxy and tamper with Mobile Applications
If you've ever wondered how to intercept and tamper with Mobile Applications, here's two videos explaining how to setup a proxy on your device and do just that.

Android: https://youtu.be/cRN0WEzadsE

iOS: https://youtu.be/AWsvdiVN4PA

🗣mrturvey


🎖@malwr