Curious about what's happening in the Windows Kernel after a Syscall?
I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️
https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/
Thanks again to @Set_hyx for the proofreading!
🗣AliceCliment
🎖@malwr
I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️
https://alice.climent-pommeret.red/posts/a-syscall-journey-in-the-windows-kernel/
Thanks again to @Set_hyx for the proofreading!
🗣AliceCliment
🎖@malwr
Digital Forensics Basics : A Practical Guide for Kubernetes DFIR : https://sysdig.com/blog/guide-kubernetes-forensics-dfir/ credits @sysdig
Kubernetes Hardening Guide by @NSAGov & @CISAgov : https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF (pdf)
🗣binitamshah
🎖@malwr
Kubernetes Hardening Guide by @NSAGov & @CISAgov : https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF (pdf)
🗣binitamshah
🎖@malwr
Sysdig
Practical Guide for DFIR Kubernetes | Sysdig
We covered the basic best practices to perform DFIR Kubernetes. We also simulated how to inspect and respond to a breach.
my first blog post -- taking a shot at malware analysis.
https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
🗣mars0x_
🎖@malwr
https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
https://medium.com/@mars0x/wannahusky-malware-analysis-w-yara-ttps-2069fb479909
🗣mars0x_
🎖@malwr
Medium
WannaHusky Malware Analysis w/ YARA + TTPs
Hello! I have recently gained a new interest in threat intelligence, malware research and analysis. In response, I have been taking courses…
Live-Forensicator - Powershell Script To Aid Incidence Response And Live Forensics https://bit.ly/3jd6Y3V #ForensicsInvestigations
🗣KitPloit
🎖@malwr
🗣KitPloit
🎖@malwr
PE file viewer/editor for Windows, Linux and MacOS.
Version 0.03
https://github.com/horsicq/XPEViewer
#hacker #infosec #malware #hacking #programming #reversing #opensource #xpeviewer #cybersecurity #windows #linux #osx #macos #qt #pe #exe #assembler #hex
🗣horsicq
🎖@malwr
Version 0.03
https://github.com/horsicq/XPEViewer
#hacker #infosec #malware #hacking #programming #reversing #opensource #xpeviewer #cybersecurity #windows #linux #osx #macos #qt #pe #exe #assembler #hex
🗣horsicq
🎖@malwr
GitHub
GitHub - horsicq/XPEViewer: PE file viewer/editor for Windows, Linux and MacOS.
PE file viewer/editor for Windows, Linux and MacOS. - horsicq/XPEViewer
Did you know that 7zip can "unzip" VMware VMDKs?
Quickly build a ~"goodware" repo for testing your #100DaysofYARA rules w/ a free Windows 10 VM https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
Unzip and uze 7zz to extract the VMDK
7zz x ~/MSEdge-Win10-VMware/MSEdge-Win10-VMware-disk1.vmdk -oMSEdge-vm
🗣stvemillertime
🎖@malwr
Quickly build a ~"goodware" repo for testing your #100DaysofYARA rules w/ a free Windows 10 VM https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
Unzip and uze 7zz to extract the VMDK
7zz x ~/MSEdge-Win10-VMware/MSEdge-Win10-VMware-disk1.vmdk -oMSEdge-vm
🗣stvemillertime
🎖@malwr
#Ghidra script to handle stack strings
https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-handle-stack-strings/
ℹ️ Sent from one of our channel members
🎖@malwr
https://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-handle-stack-strings/
ℹ️ Sent from one of our channel members
🎖@malwr
New blogpost detailing TTPs used by Zloader. It has been observed being delivered via malicious search engine ads and malicious emails. Check out the blog for more details and IOCs! #infosecurity #microsoft #cybersecurity #threatintelligence
https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/
🗣fr0gger_
🎖@malwr
https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/
🗣fr0gger_
🎖@malwr
Metamorphic Fuzzing of C++ Libraries
http://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2022/ICST.pdf
🗣johnregehr
🎖@malwr
http://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2022/ICST.pdf
🗣johnregehr
🎖@malwr
👍1
I started to use DFIRtriage in my malware analysis, it gives you a huge amount of information regarding the malware behavior.
https://github.com/travisfoley/dfirtriage
🗣fr0s7_
🎖@malwr
https://github.com/travisfoley/dfirtriage
🗣fr0s7_
🎖@malwr
👍1
My final blog post for varonis is now available which outlines how to get started with volatility. This tool is an absolute necessity for anybody in Incident Response and will prove invaluable when triaging compromised servers. #Malware
https://www.varonis.com/blog/how-to-use-volatility
🗣0xf0x_
🎖@malwr
https://www.varonis.com/blog/how-to-use-volatility
🗣0xf0x_
🎖@malwr
Varonis
How to Use Volatility for Memory Forensics and Analysis | Varonis
This article will cover what Volatility is, how to install Volatility, and most importantly how to use Volatility.
Blog post #3
In this blog, I cover the basics of the translation process of a virtual memory address into physical memory address as well as the PTE structure and usage of another WinAPI function with examples.
https://de-engineer.github.io/Virtual-Address-Translation-and-structure-of-PTE
#infosec
🗣coder_rc
🎖@malwr
In this blog, I cover the basics of the translation process of a virtual memory address into physical memory address as well as the PTE structure and usage of another WinAPI function with examples.
https://de-engineer.github.io/Virtual-Address-Translation-and-structure-of-PTE
#infosec
🗣coder_rc
🎖@malwr
👍1
Updated my ScheduleRunner to include the "hiding scheduled task" technique used by Tarrask malware. This technique can literally make your scheduled task invisible from query tools and Task Scheduler.
https://github.com/netero1010/ScheduleRunner
🗣netero_1010
🎖@malwr
https://github.com/netero1010/ScheduleRunner
🗣netero_1010
🎖@malwr
This repository contains a Red team Offensive Security Exploitation Tool
which uses TOR and OnionShare as long with Meterpreter Session.
https://github.com/ToxicEnvelope/SetmPloit
ℹ️ Sent from one of our channel members
🎖@malwr
which uses TOR and OnionShare as long with Meterpreter Session.
https://github.com/ToxicEnvelope/SetmPloit
ℹ️ Sent from one of our channel members
🎖@malwr
GitHub
GitHub - ToxicEnvelope/SetmPloit
Contribute to ToxicEnvelope/SetmPloit development by creating an account on GitHub.
👍1
New Blog! Lessons from the Conti Leaks
https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html
🗣BushidoToken
🎖@malwr
https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html
🗣BushidoToken
🎖@malwr
👍1
New Trend Micro data shows that Purple Fox operators are using trojanized software packages to trick users into downloading their payloads.
Read about #PurpleFox’s infection chain and learn about its new campaign here: https://research.trendmicro.com/36x6pPz
🗣TrendMicroRSRCH
🎖@malwr
Read about #PurpleFox’s infection chain and learn about its new campaign here: https://research.trendmicro.com/36x6pPz
🗣TrendMicroRSRCH
🎖@malwr
👍1
Check out the new blog post about my journey in implementing the technical aspects of Windhawk - implementing global injection and hooking in Windows.
https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/
🗣m417z
🎖@malwr
https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/
🗣m417z
🎖@malwr
M417Z
Implementing Global Injection and Hooking in Windows
A couple of weeks ago, Windhawk, the customization marketplace for Windows programs, was released. You can read the announcement for more details and for the motivation behind creating it. In this post, I’ll focus on my journey in implementing the technical…
The FBI, CISA & US Treasury Department have released a joint advisory to highlight the threat associated with cryptocurrency thefts & tactics used by a North Korean state-sponsored APT group (Lazarus/APT38/BlueNoroff/Stardust Chollima) since at least 2020 https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr
A practical guide to bypassing userland API Hooking https://perspectiverisk.com/a-practical-guide-to-bypassing-userland-api-hooking/ #Pentesting #APIHooking #CyberSecurity #Infosec
🗣ptracesecurity
🎖@malwr
🗣ptracesecurity
🎖@malwr