Detect Ghost-In-The-Logs (when executed disables all ETW)
Sigma: https://github.com/Neo23x0/sigma/pull/704/files
Source: https://twitter.com/xknow\_infosec/status/1247932564293275650
🗣iveco_x
🎖@malwr
Sigma: https://github.com/Neo23x0/sigma/pull/704/files
Source: https://twitter.com/xknow\_infosec/status/1247932564293275650
🗣iveco_x
🎖@malwr
GitHub
Detect Ghost-In-The-Logs (disabling/bypassing ETW) by Iveco · Pull Request #704 · SigmaHQ/sigma
possible detections for Ghost-In-The-Logs
Free Pluralsight Technology Skills Video Courses
🗣angiec5408
No credit card is required if you sign up before May 1
Build in-demand tech skills without leaving your house. Get free access to 7,000+ expert-led video courses and more all month long.
New free accounts opened through April 30, 2020 will have access to Pluralsight’s library of video courses through April. Current active subscribers are not eligible for this promotion. Payment information will not be required for new free accounts opened through April 30, 2020. New free accounts opened after May 1, 2020, will only have access to a portion of Pluralsight’s library and will require payment information.
👤angiec5408
🎖@malwr
🗣angiec5408
No credit card is required if you sign up before May 1
Build in-demand tech skills without leaving your house. Get free access to 7,000+ expert-led video courses and more all month long.
New free accounts opened through April 30, 2020 will have access to Pluralsight’s library of video courses through April. Current active subscribers are not eligible for this promotion. Payment information will not be required for new free accounts opened through April 30, 2020. New free accounts opened after May 1, 2020, will only have access to a portion of Pluralsight’s library and will require payment information.
👤angiec5408
🎖@malwr
Pluralsight
Courses & Training for Individuals on an Online Learning Platform | Pluralsight
Advance your tech skills with Pluralsight, an online learning platform with expert-led courses, certifications, assessments and hands-on experiences.
The story of how I created a way to port Windows Apps to Linux
🗣ruidfigueiredo
You should take a look at AvaloniaUI for .NET, you can make native cross platform apps and it also should be easy to port from WPF.
👤QuinnBorn
Why not just build your Electron app with native extensions?
It’s not really a way to port Windows Apps it’s a way to turn Windows Apps into a server and make a whole new GUI in HTML.
👤TinyCollection
So basically write a server in .NET, a client in javascript + html, bundle them together using electron, and use stdin/stdout for for communication instead of a proper RPC framework.
👤random_lonewolf
🎖@malwr
🗣ruidfigueiredo
You should take a look at AvaloniaUI for .NET, you can make native cross platform apps and it also should be easy to port from WPF.
👤QuinnBorn
Why not just build your Electron app with native extensions?
It’s not really a way to port Windows Apps it’s a way to turn Windows Apps into a server and make a whole new GUI in HTML.
👤TinyCollection
So basically write a server in .NET, a client in javascript + html, bundle them together using electron, and use stdin/stdout for for communication instead of a proper RPC framework.
👤random_lonewolf
🎖@malwr
The Blinking Caret
The story of how I created a way to port Windows Apps to Linux - The Blinking Caret
Some day during a weekend sometime around the summer in 2018 I was doing house chores while listening to a podcast. The podcast I was listening to is called Coder Radio, and I was specifically listening to episode #322 Not so QT. That episode is about using…
Crime stories in digital forensics?
Crime stories in digital forensics? Any resource recommendations in learning about cases and crime stories involving digital forensics?
🗣RoosterUnchained
https://www.digital-detective.net/digital-evidence-discrepancies-casey-anthony-trial/
👤deltawing
Here are some case studies: https://www.youtube.com/playlist?list=PL9irkLlgx28f9MJbL\_ini0p1ZAGsHiKa5
👤bshavers
🎖@malwr
Crime stories in digital forensics? Any resource recommendations in learning about cases and crime stories involving digital forensics?
🗣RoosterUnchained
https://www.digital-detective.net/digital-evidence-discrepancies-casey-anthony-trial/
👤deltawing
Here are some case studies: https://www.youtube.com/playlist?list=PL9irkLlgx28f9MJbL\_ini0p1ZAGsHiKa5
👤bshavers
🎖@malwr
reddit
Crime stories in digital forensics?
Crime stories in digital forensics? Any resource recommendations in learning about cases and crime stories involving digital forensics?
Despite Infighting and Volatility, Iran Maintains Aggressive Cyber Operations Structure
🗣cyberg0100
🎖@malwr
🗣cyberg0100
🎖@malwr
Recordedfuture
Despite Infighting and Volatility, Iran Maintains Aggressive Cyber Operations Structure
Insikt Group provides deeper insight into ongoing research on the major military and intelligence bodies involved in Iran’s offensive cyber program.
Deep Dive Into TrickBot Executor Module "mexec": Hidden "Anchor" Bot Nexus Operations
🗣Cyberthere
🎖@malwr
🗣Cyberthere
🎖@malwr
SentinelLabs
Deep Dive Into TrickBot Executor Module "mexec": Hidden "Anchor" Bot Nexus Operations - SentinelLabs
New "mexec" module delivers tertiary malware and allows TrickBot to pivot within a network, deploy a variety of payloads and evade common detection methods.
IDA Home details revealed - 365$ / year subscription, single processor family choice, Python 3 support and debugger. Available early May.
🗣TheAdubbz
For that price, a decompiler is a must for me, and even then I would find it too expensive. I would much rather see it sit at $100 a year, with decompiler included for non commercial / private use. Then I will definitely consider it.
👤Miracleb
subscription model, only one processor, and apparently no hex-rays... i'm not sure how this is supposed to be more attractive than ghidra or pirated ida.
👤Effective_Swing
no decompiler
only one CPU arch
It does not looks good and it feels expensive for hobbyist.
👤Thaxll
🎖@malwr
🗣TheAdubbz
For that price, a decompiler is a must for me, and even then I would find it too expensive. I would much rather see it sit at $100 a year, with decompiler included for non commercial / private use. Then I will definitely consider it.
👤Miracleb
subscription model, only one processor, and apparently no hex-rays... i'm not sure how this is supposed to be more attractive than ghidra or pirated ida.
👤Effective_Swing
no decompiler
only one CPU arch
It does not looks good and it feels expensive for hobbyist.
👤Thaxll
🎖@malwr