APT35 Automates Initial Access Using ProxyShell

➡️Initial Access: #ProxyShell
➡️Discovery: net, ipconfig, PowerShell, quser, etc.
➡️PrivEsc: Scheduled Task
➡️Defense Evasion: Real-time Monitoring & WDigest enablement
➡️Credential Access: Comsvcs.dll

https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
🗣TheDFIRReport


🎖@malwr

Threads, Threads, and More Threads http://scorpiosoftware.net/2022/03/21/threads-threads-and-more-threads/
🗣zodiacon


🎖@malwr

Windows API - Exploring Virtual Memory and the Virtual Memory Management API, by @coder_rc
https://de-engineer.github.io/Understanding-Virtual-Memory-Paging-and-other-memory-related-concepts/
🗣DirectoryRanger


🎖@malwr

We're hiring for the @Mandiant #AdvancedPractices Research team!🦅

➡️Self-driven defensive- and intel-oriented research
➡️Support Mandiant IRs with research and detection
➡️Codify attacker methodologies
➡️Surface new activity

🔥Great team/mission/data🔥

https://jobs.smartrecruiters.com/Mandiant/743999814012433
🗣matthewdunwoody


🎖@malwr

My favorite IDA shortcut: ctrl-L lets you powerfully search across all func names & var names!
Want to find everything related to packets? Search it with Ctrl-L.
🗣whtaguy


🎖@malwr

Started collecting observed/hardcoded #mutex from various #malware families.

Feel free to send PRs: https://github.com/albertzsigovits/malware-mutex/blob/main/README.md
🗣albertzsigovits


🎖@malwr

PlugX: A Talisman to Behold

https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/plugx-a-talisman-to-behold.html

ℹ️ Sent from one of our channel members

🎖@malwr

RE tip of the day: In kernel mode, the system service dispatcher (aka KiSystemService/KiSystemCall64[Shadow]) is responsible for finding the requested function by its index number (SSN) passed in EAX in the SSDT table.
#infosec #cybersecurity #malware #reverseengineering
🗣re_and_more


🎖@malwr

Curious about what's happening in the Windows Kernel after a Syscall?

I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️

https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/

Thanks again to @Set_hyx for the proofreading!
🗣AliceCliment


🎖@malwr

Digital Forensics Basics : A Practical Guide for Kubernetes DFIR : https://sysdig.com/blog/guide-kubernetes-forensics-dfir/ credits @sysdig

Kubernetes Hardening Guide by @NSAGov & @CISAgov : https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF (pdf)

🗣binitamshah


🎖@malwr

my first blog post -- taking a shot at malware analysis.

https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
🗣mars0x_


🎖@malwr

Live-Forensicator - Powershell Script To Aid Incidence Response And Live Forensics https://bit.ly/3jd6Y3V #ForensicsInvestigations
🗣KitPloit


🎖@malwr

PE file viewer/editor for Windows, Linux and MacOS.

Version 0.03
https://github.com/horsicq/XPEViewer

#hacker #infosec #malware #hacking #programming #reversing #opensource #xpeviewer #cybersecurity #windows #linux #osx #macos #qt #pe #exe #assembler #hex
🗣horsicq


🎖@malwr

Did you know that 7zip can "unzip" VMware VMDKs?

Quickly build a ~"goodware" repo for testing your #100DaysofYARA rules w/ a free Windows 10 VM https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/

Unzip and uze 7zz to extract the VMDK

7zz x ~/MSEdge-Win10-VMware/MSEdge-Win10-VMware-disk1.vmdk -oMSEdge-vm
🗣stvemillertime


🎖@malwr

#Ghidra script to handle stack strings

https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-handle-stack-strings/

ℹ️ Sent from one of our channel members

🎖@malwr

New blogpost detailing TTPs used by Zloader. It has been observed being delivered via malicious search engine ads and malicious emails. Check out the blog for more details and IOCs! #infosecurity #microsoft #cybersecurity #threatintelligence

https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/
🗣fr0gger_


🎖@malwr

Metamorphic Fuzzing of C++ Libraries
http://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2022/ICST.pdf
🗣johnregehr


🎖@malwr

I started to use DFIRtriage in my malware analysis, it gives you a huge amount of information regarding the malware behavior.

https://github.com/travisfoley/dfirtriage
🗣fr0s7_


🎖@malwr

My final blog post for varonis is now available which outlines how to get started with volatility. This tool is an absolute necessity for anybody in Incident Response and will prove invaluable when triaging compromised servers. #Malware

https://www.varonis.com/blog/how-to-use-volatility
🗣0xf0x_


🎖@malwr

Blog post #3

In this blog, I cover the basics of the translation process of a virtual memory address into physical memory address as well as the PTE structure and usage of another WinAPI function with examples.

https://de-engineer.github.io/Virtual-Address-Translation-and-structure-of-PTE

#infosec
🗣coder_rc


🎖@malwr