Windows Killed Process Canary - A Windows Service to detect if it has been shutdown and hibernate if multiple instances are (detecting i.e. Ryuk acitivity)
🗣darronofsky
🎖@malwr
🗣darronofsky
🎖@malwr
GitHub
GitHub - nccgroup/KilledProcessCanary: A canary designed to minimize the impact from certain Ransomware actors
A canary designed to minimize the impact from certain Ransomware actors - nccgroup/KilledProcessCanary
Does an OS update change the user account creation date? User insists OS was not changed but feature update done so it affected the user creation date show in the SAM registry
Is this possible?
🗣netau20
Yes. Windows updates can screw with lots of timestamps, including the account creation date.
👤lithium630
What OS are we talking about? Windows 10 (without much else info, I'll just guess that since most home PCs seem to be using it now...)
Check the registry for some additional information. System -> Setu. In there you'll see something along the lines of "Source OS (Updated on...) which will show you each update of the OS.
To get the original date of the OS install, go to Sam -> Domains -> Account. You should see two values... "F" and "V". In the F value you're going to highlight and sweep values 08 through 15 (this will be a total of 8 hex values.) Decode those in Windows 64-bit LE and you'll have the original time of the OS installation.
So that should give you the original install along with every update. And that should give you a clearer picture of what exactly is going on.
👤Bad_Grammer_Girl
Are you using something like RegRipper against a local user account on a Windows machine?
👤shinyviper
🎖@malwr
Is this possible?
🗣netau20
Yes. Windows updates can screw with lots of timestamps, including the account creation date.
👤lithium630
What OS are we talking about? Windows 10 (without much else info, I'll just guess that since most home PCs seem to be using it now...)
Check the registry for some additional information. System -> Setu. In there you'll see something along the lines of "Source OS (Updated on...) which will show you each update of the OS.
To get the original date of the OS install, go to Sam -> Domains -> Account. You should see two values... "F" and "V". In the F value you're going to highlight and sweep values 08 through 15 (this will be a total of 8 hex values.) Decode those in Windows 64-bit LE and you'll have the original time of the OS installation.
So that should give you the original install along with every update. And that should give you a clearer picture of what exactly is going on.
👤Bad_Grammer_Girl
Are you using something like RegRipper against a local user account on a Windows machine?
👤shinyviper
🎖@malwr
reddit
Does an OS update change the user account creation date? User...
Is this possible?
Wubes is like Qubes containerization for Windows 10. It uses the Windows 10 sandboxing technology to isolate applications - the initial release supports Firefox..
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - nccgroup/Wubes: Qubes containerization on Windows
Qubes containerization on Windows . Contribute to nccgroup/Wubes development by creating an account on GitHub.
A Guide to Ghidra Scripting Development for Malware Researchers
https://labs.sentinelone.com/a-guide-to-ghidra-scripting-development-for-malware-researchers/
🗣Cyberthere
🎖@malwr
https://labs.sentinelone.com/a-guide-to-ghidra-scripting-development-for-malware-researchers/
🗣Cyberthere
🎖@malwr
SentinelOne
A Guide to Ghidra Scripting Development for Malware Researchers - SentinelLabs
Automation is the key to becoming a more effective malware analyst, and Ghidra scripting is an essential tool in your arsenal. Get started here!
Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server
🗣quellaman
🎖@malwr
🗣quellaman
🎖@malwr
Unit 42
Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server
Due to a surge of malicious activity surrounding four zero-day Microsoft Exchange Server vulnerabilities, we assess the threat and suggest COAs.
New in Ransomware: AlumniLocker, Humble Feature Different Extortion Techniques
🗣ajokewaitingtohappen
🎖@malwr
🗣ajokewaitingtohappen
🎖@malwr
Trend Micro
New in Ransomware AlumniLocker Humble Feature Different Extortion Techniques
We recently discovered two new ransomware variants, AlumniLocker and Humble, which exhibit different sophisticated behaviors and extortion techniques post-encryption.
Deception Engineering: exploring the use of Windows Service Canaries against ransomware
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
NCC Group Research Blog
Deception Engineering: exploring the use of Windows Service Canaries against ransomware
We prototyped a Windows Service Canary to help detect and respond to certain pre-ransomware trade craft. The ultimate goal being to alert and minimize the impact of ransomware deployments.
ATTACK&DEFENCE VERIFICATION AUTOMATION
https://medium.com/@92.murat.o/attack-defence-verification-automation-d129c33465a2
🗣FinchAndrei
Nice approach and integration. Only downside - the tools involved come in with a 6-digit USD/year price tag - for smaller teams and budgets an oss oriented implementation could be welcomed, e.g. using Shuffle as the SOAR tool, etc.
https://github.com/frikky/shuffle
👤vornamemitd
🎖@malwr
https://medium.com/@92.murat.o/attack-defence-verification-automation-d129c33465a2
🗣FinchAndrei
Nice approach and integration. Only downside - the tools involved come in with a 6-digit USD/year price tag - for smaller teams and budgets an oss oriented implementation could be welcomed, e.g. using Shuffle as the SOAR tool, etc.
https://github.com/frikky/shuffle
👤vornamemitd
🎖@malwr
Medium
ATTACK&DEFENCE VERIFICATION AUTOMATION
How is attack&defence simulation automation done? Verify and control your Security and SOC teams 24/7. This attack was previously blocked…
New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence - Microsoft Security
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Microsoft News
GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence
Microsoft has identified three new pieces of malware being used in late-stage activity by NOBELIUM – the actor behind the SolarWinds attacks, SUNBURST, and TEARDROP.
I often get asked what does if __name__ == “__main__” do? Here's an explanation!
Read about it here :) https://www.conorjohanlon.com/if\_\_name\_\_eq\_\_main\_\_explained/
🗣conoroha
🎖@malwr
Read about it here :) https://www.conorjohanlon.com/if\_\_name\_\_eq\_\_main\_\_explained/
🗣conoroha
🎖@malwr
Conor J O'Hanlon
What does if __name__ == "__main__" do?
Having if __name__ == "__main__" in a Python script will allow any code in this if statement to execute if that Python script is executed as the main script