Here is my post about orphan file name entries found on exFAT volumes written using Linux or macOS. This means that file names (or their parts) of deleted files having their directory entries partially overwritten can be recovered. #DFIR
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
π£errno_fail
π@malwr
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
π£errno_fail
π@malwr
My DFIR Blog
exFAT: orphan file name entries
The exFAT file system was designed with Unicode file names and optional vendor-specific extensions in mind. To keep things simple, the file system specification allows the usage of multiple directoβ¦
Exploring Windows UAC Bypasses : Techniques and Detection Strategies :
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
π£binitamshah
π@malwr
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
π£binitamshah
π@malwr
RE tip of the day: There are many PDF entries that can be misused by malware. For example, /Action with a /Launch argument can be used to execute an application specified with a /F entry. Arguments can be added using /P entry.
#infosec #cybersecurity #malware #reverseengineering
π£re_and_more
π@malwr
#infosec #cybersecurity #malware #reverseengineering
π£re_and_more
π@malwr
The MISP cheat sheet has been updated with a representation overview showing how MISP is used to model a security incident. It's a usually a nifty overview when you don't have the time to read all of the documentation. #CTI #ThreatIntelligence
https://www.misp-project.org/misp-training/cheatsheet.pdf
π£MISPProject
π@malwr
https://www.misp-project.org/misp-training/cheatsheet.pdf
π£MISPProject
π@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
WATCH: Discover the social engineering tactics employed by #APT36 or #EarthKarkaddan actors in our latest video.
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
π£TrendMicroRSRCH
π@malwr
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
π£TrendMicroRSRCH
π@malwr
New #PEsieve/#HollowsHunter (v0.3.4): https://github.com/hasherezade/pe-sieve/releases/ & https://github.com/hasherezade/hollows_hunter/releases - with threads' callstack scan. Check it out!
π£hasherezade
π@malwr
π£hasherezade
π@malwr
BinDiff export is finally on its way : I hope to be able to publish an update in a week or twoβ¦
π£bSr43
π@malwr
π£bSr43
π@malwr
ADExplorerSnapshotβ€py updates:
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
- BloodHound 4.1+ output format support
- new output mode to dump all objects/attributes to NDJSON
https://github.com/c3c/ADExplorerSnapshot.py
π£c3c
π@malwr
GitHub
GitHub - c3c/ADExplorerSnapshot: ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHoundβ¦
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON. - c3c/ADExplorerSnapshot
Bulk_extractor V2.0.0 is finished!
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
Download the current source code from GitHub.
I'm presenting at @The_AAFS in Seattle about the long process of "sharpening" this #DFIR tool.
https://github.com/simsong/bulk_extractor/releases/tag/v2.0.0
π£xchatty
π@malwr
GitHub
Release bulk_extractor V2.0.0 RELEASE Β· simsong/bulk_extractor
Release 2.0.0 of bulk_extractor, a high-performance digital forensics tool that works like a "find evidence" button, pulling actionable intelligence out of disk images, files, memory dump...
I played Hayyim CTF because the organizers looked promising. There was a nice challenge to exploit a patched anti-virus and here's my write-up for it.
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
https://ptr-yudai.hatenablog.com/entry/2022/02/13/122744
π£ptrYudai
π@malwr
CTFγγγ
Writing Anti-Anti-Virus Exploit (AuViel - Hayyim CTF 2022) - CTFγγγ
Introduction I played Hayyim CTF 2022 with keymoon, st98, and theoremoon. We solved all pwn tasks there and stood the 3rd place. *1 There was a pwn challenge toβ¦
RE tip of the day: UPX structures are publically available, for example, https://buff.ly/3uAYU3L The most common ways how IoT malware authors modify them in samples is changing l_magic (UPX! signature) and p_filesize and p_blocksize fields
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
#infosec #malware #reverseengineering
π£re_and_more
π@malwr
β€1
termshark: A terminal UI for tshark, inspired by Wireshark
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
βοΈ 6980
#golang
https://github.com/gcla/termshark
π£GolangRepos
π@malwr
GitHub
GitHub - gcla/termshark: A terminal UI for tshark, inspired by Wireshark
A terminal UI for tshark, inspired by Wireshark. Contribute to gcla/termshark development by creating an account on GitHub.
New blog post about analyzing a stealer distributed via MSI files! S/O to @MSAdministrator for helping me improve my MSI analysis game in a big way:
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
π£ForensicITGuy
π@malwr
Tony Lambert
Analyzing a Stealer MSI using msitools
This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MSI payload distributing njRAT, Josh hit me up on Twitter toβ¦
Abusing LNK "Features" for Initial Access and Persistence
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
π£CyberWarship
π@malwr
VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
https://github.com/JonathanSalwan/VMProtect-devirtualization
π£JonathanSalwan
π@malwr
GitHub
GitHub - JonathanSalwan/VMProtect-devirtualization: Playing with the VMProtect software protection. Automatic deobfuscation ofβ¦
Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM. - JonathanSalwan/VMProtect-devirtualization
π1