I've updated the Antivirus Event Analysis Cheat Sheet to v1.9.0
- updates in all sections
- MS Exchange exploitation related indicators
- updated identifiers
Could @SophosLabs please fix the spelling of Webshel+l?
https://www.nextron-systems.com/2022/02/06/antivirus-event-analysis-cheat-sheet-v1-9-0/
🗣cyb3rops
🎖@malwr
- updates in all sections
- MS Exchange exploitation related indicators
- updated identifiers
Could @SophosLabs please fix the spelling of Webshel+l?
https://www.nextron-systems.com/2022/02/06/antivirus-event-analysis-cheat-sheet-v1-9-0/
🗣cyb3rops
🎖@malwr
Decoding Cobalt Strike: Understanding Payloads
https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
🗣pentest_swissky
🎖@malwr
https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
🗣pentest_swissky
🎖@malwr
Gendigital
Decoding Cobalt Strike: Understanding payloads
Identifying and Parsing Cobalt Payloads
IDACode - An Integration For IDA And VS Code Which Connects Both To Easily Execute And Debug IDAPython Scripts https://ift.tt/9jM4DvH #cybersecurity #bugbountytips #hacking #tools
🗣santosomar
🎖@malwr
🗣santosomar
🎖@malwr
🔥4
The Walmart Global Tech security team write about the Sugar ransomware operation, which appears to actively target individual computers rather than entire enterprises. https://medium.com/walmartglobaltech/sugar-ransomware-a-new-raas-a5d94d58d9fb
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr
Cuckoo and CAPE sandbox evasion in one legitimate Windows API function call? It is possible due to issues we found in Cuckoo and CAPE monitor.
@CapeSandbox @cuckoosandbox
https://research.checkpoint.com/2022/invisible-cuckoo-cape-sandbox-evasion
🗣_CPResearch_
🎖@malwr
@CapeSandbox @cuckoosandbox
https://research.checkpoint.com/2022/invisible-cuckoo-cape-sandbox-evasion
🗣_CPResearch_
🎖@malwr
Check Point Research
Invisible Sandbox Evasion - Check Point Research
Cuckoo and CAPE sandbox evasion in one legitimate Windows API function call? It is possible due to issues we found in Cuckoo and CAPE monitor.
Me watching somebody try to decrease Emotet AV detection by uploading stuff to VirusTotal 😅
🗣GossiTheDog
🎖@malwr
🗣GossiTheDog
🎖@malwr
Decrypted: Avast releases #free #decryptor for the #TargetCompany #ransomware: #AvastDecoded
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
Gendigital
Decrypted: TargetCompany ransomware
TargetCompany Ransomware Analysis Details
👍2
Another new post to start the week! This time around I take a look at a RTF document that exploits MS Office Equation Editor to deploy AgentTesla:
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
Tony Lambert
AgentTesla From RTF Exploitation to .NET Tradecraft
When adversaries buy and deploy threats like AgentTesla you often see this functional and entertaining chain of older exploitation activity with some .NET framework tradecraft you’d expect from some modern implants. In this post I’ll walk through analyzing…
Guess I will get to see how my theory on this will play out in real life now
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
TECHCOMMUNITY.MICROSOFT.COM
Helping users stay safe: Blocking internet macros by default in Office | Microsoft Community Hub
To protect our customers, users will no longer be able to enable macros obtained from the internet.
This media is not supported in your browser
VIEW IN TELEGRAM
Just released a new, fast-paced, interactive binary patching plugin for IDA Pro. Check out a small blurb about it on the @HexRaysSA blog: https://hex-rays.com/blog/introducing-the-patching-plugin/
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Microsoft blocks VBA macros originating from Internet based on MOTW flag.
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
👍2
This media is not supported in your browser
VIEW IN TELEGRAM
How can we run arbitrary code without allocating/overwriting executable memory? We "borrow" (abuse) instructions from ntdll.dll!
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr
Today we published a new report on the new ModifiedElephant APT, and the years of attacks against groups and individuals in India.
Blog: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
Full Report: https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt
🗣TomHegel
🎖@malwr
Blog: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
Full Report: https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt
🗣TomHegel
🎖@malwr
SentinelOne
ModifiedElephant APT and a Decade of Fabricating Evidence
A previously unreported threat actor has been targeting civil society for over a decade. Read about how it operates and its relationships to other threats.
Good news for all the infosec community. Now you can Export/Import VT Collections into/from MISP Events 🎉 by
@thetravelr https://blog.virustotal.com/2022/02/misp-and-vt-collections.html
🗣virustotal
🎖@malwr
@thetravelr https://blog.virustotal.com/2022/02/misp-and-vt-collections.html
🗣virustotal
🎖@malwr
FTK Imager Version 4.7.1 released >>
https://accessdata.com/product-download/ftk-imager-version-4-7-1
🗣chadtilbury
🎖@malwr
https://accessdata.com/product-download/ftk-imager-version-4-7-1
🗣chadtilbury
🎖@malwr
Exterro
Data Risk Management - Data Discovery & Privacy Platform | Exterro
Exterro's powerful data risk management platform unifies e-discovery, privacy, data governance, digital forensics, and cybersecurity compliance to…
Rewrote Simple Process Injection using HellsGate in C# for fun and learning :)
It involved parsing ntdll to find and map the syscall ids for the involved functions and use the syscall numbers to directly invoke the the corresponding syscall.
Github repo: https://github.com/sbasu7241/HellsGate
🗣SoumyadeepBas12
🎖@malwr
It involved parsing ntdll to find and map the syscall ids for the involved functions and use the syscall numbers to directly invoke the the corresponding syscall.
Github repo: https://github.com/sbasu7241/HellsGate
🗣SoumyadeepBas12
🎖@malwr
Here is my post about orphan file name entries found on exFAT volumes written using Linux or macOS. This means that file names (or their parts) of deleted files having their directory entries partially overwritten can be recovered. #DFIR
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
🗣errno_fail
🎖@malwr
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
🗣errno_fail
🎖@malwr
My DFIR Blog
exFAT: orphan file name entries
The exFAT file system was designed with Unicode file names and optional vendor-specific extensions in mind. To keep things simple, the file system specification allows the usage of multiple directo…
Exploring Windows UAC Bypasses : Techniques and Detection Strategies :
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
🗣binitamshah
🎖@malwr
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
🗣binitamshah
🎖@malwr