New to defending? Short series of videos following a cyber attack start to finish.
8 videos under 5 minutes each which demonstrate a basic cyber attack from creating the phishing email, through to gaining persistence. The videos aren't sexy, but should be good if you are just starting out, and want some basic knowledge on what you should be looking out for.

https://blog.2code-monte.co.uk/2020/09/26/making-a-malicious-word-document-part-1-dde-vulnerability-feature/
🗣2codemonte

!remindme 20 hours
👤plamatonto

Cool
👤CallumIsCool69

Is this 2001, where 10 year olds made youtube videos with only notepad?
👤RegularAlicorn


🎖@malwr

SUNBURST Additional Technical Details
🗣0write

Additional information from FireEye regarding the SUNBURST malware. Some new, some already reported on and analyzed by other security companies.
👤0write


🎖@malwr

Recaf 2.X: The modern Java bytecode reversing tool
🗣PartOfTheBotnet

Looks really nice will have to try it out!
👤j_rapp

Hello again /r/ReverseEngineering its been over a year since I last shared my pet project, Recaf. Since then it has been almost completely re-written and is continues to make improvements upon what a reversing tool should provide.

2.X aims to make reverse engineering as user friendly as possible. How so? Here's the gist:

1. Automatic compiler integration
- Dependencies pulled from your current workspace (primary file plus any libraries)
- Can't find a dependency? Don't worry, Recaf will dynamically generate missing code for you via JPhantom. That's right, you don't even need to specify your missing compile dependencies.
2. Text based bytecode assembler with user friendly features
- Reference variables not by their index but by their source-code name for maximum legibility
- Write short bytecode snippets as plain old Java source code, Recaf will translate inline expressions for you
- See what values are on the stack and in your local variables at any point by selecting the line
- Verify all your modifications on the fly to prevent time-wasting mistakes
3. Multiple class representations, defaulting to decompiled code
- View the class in one of 3 decompilers, CFR, FernFlower, or Procyon
- Context sensitive right-click actions on source code elements
- Automatically suggest switching decompilers when errors occur in current one
- Code too obfuscated? Change the class representation to a table to show fields, methods, and class attributes in an organized table while retaining all the context sensitive menu actions
4. Highly configurable search
- Search for string constants by containment, equality, starts-with, ends-with, or regex
- You can do the same search types with member references
- You can also do the same for disassembled instruction text
5. Track changes per each class modified with the ability to revert to a prior state at any time
6. Apply mappings to an obfuscated file from a variety of popular mapping formats
7. Drag tabs to other windows for duplicate views that can be swapped out (Compare decompilers, switch one tab to table mode, etc)

More info on the documentation page: https://www.coley.software/Recaf-documentation/

And beyond those points, there's a lot more planned for the future.

I'm always looking for suggestions and bug reports, so do feel free to drop a comment.

Happy reversing and merry Christmas o/
👤PartOfTheBotnet


🎖@malwr

Various Visual Basic Macros-based Remote Code Execution techniques to get meterpreter invoked on the infected machine.
🗣digicat

It blows my mind that macros are still enabled by default.

A while back I walked into an organisation that had ongoing issues with ransomware. They got to call it "ransomware Friday" because of how common it was. They haven't had an incident in three years and I made the only change they had budget for - disable macros by GPO.
👤disclosure5


🎖@malwr

Threat Intelligence Feeds - threatview.io
Hello All,

In an effort to give back to the information security community, SOC Teams and DFIR folks, I have strated a portal for providing free threat intelligence feeds.

Currently published feeds contains malicious- Domains, IP, Bitcoin addresses, MD5 Hash, SHA Hash etc. collected from top blocklists, honeypots, pastebins etc. Feeds includes IOC for recent Sunburst/ Solarwinds incident.

Queries, Advise, Collaboration opportunities and IOC's are welcome - m@threatview.io

>> Threatview.io <<
🗣MohitK_

I'd love to get in touch with you.
👤indonemesis


🎖@malwr

Faking a JARM signature by replaying TLS Server Hello's
🗣Robbedoes_

This was actually a pretty slick writeup. I enjoyed the use cases mentioned in the article:

>They could be used by malicious actors to hide their applications when tools like JARM scanners are deployed to identify services in a network or on the internet. It can also be used for good. A honeypot replaying the fingerprint of a specific service can be used to setup a digital smokescreen for attackers.
👤-SnowBl1nd-


🎖@malwr

Microsoft Defender for Identity: ADFSDump
Microsoft updated Microsoft Defender for Identity to detect the ADFSDump tool’s use, which was the initial tool used in the Solorigate campaign. This blog post will describe what the attack does and bypass Microsoft Defender for Identity detection using a tool I have written, including mitigation to the attack.

https://thalpius.com/2020/12/28/microsoft-defender-for-identity-adfsdump/

&#x200B;

P.s. Don't forget to join the Discord server.
🗣thalpius


🎖@malwr