Bypass Defender AV static detection:

If you name a malicious file DumpStack.log Defender doesn't scan it.
🗣mrd0x


🎖@malwr

Here is code that will detect threads which are impersonating on Windows via the TIB/TEB.

Turns out not many threads impersonate other users on Windows 10 it would seem.

The technique can be integrated in EDR sweeps as a indicator for implant injects.

https://gist.github.com/olliencc/df200e0049fa17036d9f867e024f57ad
🗣ollieatnccgroup


🎖@malwr

Shout out to the SOC team today. #infosec
🗣rootsecdev


🎖@malwr

How do you approach investigating computer security incidents?

Some useful tools worth having your IT staff get familiar with.

ProcMon
ProcessExplorer
AutoRuns
Wireshark
Log-MD
ProcDOT

#infosec #cybersecurity #MalwareAnalysis #DFIR
🗣shaktavist


🎖@malwr

Small diagram on my malware analysis workflow, using @unpacme, @IntezerLabs, @virustotal, @abuse_ch, @Mandiant capa rules and my dear #Ghidra.
🗣4rchib4ld


🎖@malwr

For those interested in Reverse Engineering, I wrote an article 2 years ago about how to analyze a "Portable Executable File (exe)" using WinDbg: https://nutcrackerssecurity.github.io/PE-file.html
🗣T3jv1l


🎖@malwr

Some awesome Win32k analysis for your Wednesday afternoon - what else? Great work by @w3knight
https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/technical-analysis-of-cve-2021-1732/
🗣spovolny


🎖@malwr

RE tip of the day: In malicious RTFs, the objects stored in the \objdata argument of the \object control word can be of various data types specified using \objclass:
* OLE2 (example: "Word.Document.8")
* OOXML
* PDFs
and others
#infosec #cybersecurity #malware #reverseengineering
🗣re_and_more


🎖@malwr

A curated list of Frida resources!

https://github.com/dweinstein/awesome-frida

#frida #android #cybersecurity #bughunting
🗣0xAsm0d3us


🎖@malwr

Short writeup on incident response case management, DFIR-IRIS (by @AirbusCyber / @White_Kernel ) and a bit of MISP ( @MISPProject ) #DFIR #CSIRT
https://www.vanimpe.eu/2022/01/05/incident-response-case-management-dfir-iris-and-misp/
🗣cudeso


🎖@malwr

Check Medusa's New script additions for SSL Unpinning / Dex Dump from Memory / Log4j test / Dex Class Loader hooks
https://github.com/Ch0pin/medusa
🗣Ch0pin


🎖@malwr

I've been maintaining a repo for interesting malware samples, artifacts and even exercises! Check it out on Github!

🎓 https://github.com/jstrosch/malware-samples
🗣jstrosch


🎖@malwr

Bcdedit /set {default} hypervisorloadoptions "EARLYKDINIT" this command allowed me to attach windbg to hyper-v successfully after struggling with win11. Incase it helps anyone..
🗣Essb33


🎖@malwr

Did you ever want to load dbk64.sys yourself and abuse the fact that it's a signed driver?
Maybe call the builtin kernel read/write (and many more!) routines because you don't have a driver signing certificate?
You can do that now! Check it out ;)

GitHub: https://github.com/ioncodes/ceload
🗣layle_ctf


🎖@malwr

Paper &Code of LiveOverflow and my ROOTS paper about fuzzing of Smart Contract VMs is out!

Peak Web 3.0: A Memory corruption in a VM _written in C#_ 👀

https://github.com/fgsect/NeoDiff/blob/main/roots21-2.pdf
🗣domenuk


🎖@malwr