Just released a new, fast-paced, interactive binary patching plugin for IDA Pro. Check out a small blurb about it on the @HexRaysSA blog: https://hex-rays.com/blog/introducing-the-patching-plugin/

Code: https://github.com/gaasedelen/patching
🗣ret2systems


🎖@malwr

How can we run arbitrary code without allocating/overwriting executable memory? We "borrow" (abuse) instructions from ntdll.dll!

https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew


🎖@malwr

Today we published a new report on the new ModifiedElephant APT, and the years of attacks against groups and individuals in India.

Blog: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
Full Report: https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt
🗣TomHegel


🎖@malwr

Good news for all the infosec community. Now you can Export/Import VT Collections into/from MISP Events 🎉 by
@thetravelr https://blog.virustotal.com/2022/02/misp-and-vt-collections.html
🗣virustotal


🎖@malwr

FTK Imager Version 4.7.1 released >>
https://accessdata.com/product-download/ftk-imager-version-4-7-1
🗣chadtilbury


🎖@malwr

Rewrote Simple Process Injection using HellsGate in C# for fun and learning :)
It involved parsing ntdll to find and map the syscall ids for the involved functions and use the syscall numbers to directly invoke the the corresponding syscall.
Github repo: https://github.com/sbasu7241/HellsGate
🗣SoumyadeepBas12


🎖@malwr

Here is my post about orphan file name entries found on exFAT volumes written using Linux or macOS. This means that file names (or their parts) of deleted files having their directory entries partially overwritten can be recovered. #DFIR
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
🗣errno_fail


🎖@malwr

SHA-256 explained step-by-step visually :
https://sha256algorithm.com/
🗣binitamshah


🎖@malwr

Exploring Windows UAC Bypasses : Techniques and Detection Strategies :
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
🗣binitamshah


🎖@malwr

RE tip of the day: There are many PDF entries that can be misused by malware. For example, /Action with a /Launch argument can be used to execute an application specified with a /F entry. Arguments can be added using /P entry.
#infosec #cybersecurity #malware #reverseengineering
🗣re_and_more


🎖@malwr

WATCH: Discover the social engineering tactics employed by #APT36 or #EarthKarkaddan actors in our latest video.

Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
🗣TrendMicroRSRCH


🎖@malwr

New #PEsieve/#HollowsHunter (v0.3.4): https://github.com/hasherezade/pe-sieve/releases/ & https://github.com/hasherezade/hollows_hunter/releases - with threads' callstack scan. Check it out!
🗣hasherezade


🎖@malwr

CinaRAT Delivered Through HTML ID Attributes https://i5c.us/d28330
🗣sans_isc


🎖@malwr

https://www.virustotal.com/gui/file/6e01c3aee4e15dcea1cebc11a2d7c0c82187ffe01bda73c844ac4e95ee4ed839
#Rootkit #signed
🗣petrovic082


🎖@malwr

BinDiff export is finally on its way : I hope to be able to publish an update in a week or two…
🗣bSr43


🎖@malwr

ADExplorerSnapshot․py updates:
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
🗣c3c


🎖@malwr

The Microsoft Cybersecurity Reference Architecture.
🗣FrankMcG


🎖@malwr