🕵️ Windows Forensic Commands: Investigate, Analyze & Respond 🔍💻
When a security incident occurs on a Windows system, knowing which commands to run can make the difference between guessing and solid digital forensics 🧠⚖️
⤵️ Blue Team ⤵️
Given the recent events with VMPSoft DMCA'ing educational YouTube videos demonstrating how to unpack malware protected with VMProtect, we have decided to release a free to use unpacker which works for all versions of VMP 3.x including the most recent version.
Simply sign up/login here: https://t.co/7xp43sCIwv and then click on "Unpacker" on the top right corner.
For context:
https://t.co/8z6V6232YN https://t.co/kHm3O764FL https://t.co/T9EyF53FEV
The Windows Kernel Exploitation tutorial series is complete for both English and Spanish speakers. Huge thank you to @HackSysTeam for creating HEVD to begin with and thank you to @corelanc0d3r and @ret2wargames for creating resources that are free for those who can't afford them!
6 months ago, I started working on a way to better map the #ransomware ecosystem and its evolution, including rebrands.🔎
I am really happy to share this handmade cartography, which is based on @orangecyberdef resources, #OSINT and reverse engineering.
➡️ https://t.co/cKK57AM07f
Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code.
https://t.co/hTdAfHOUx3
I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅
If you're in #infosec and you feel a little down this week, this video is for you💙
🚨🚨WARNING 🚨🚨 We have confirmed that #Emotet is dropping CS Beacons on E5 Bots and we have observed the following as of 10:00EST/15:00UTC. The following beacon was dropped: https://t.co/imJDQTGqxV Note the traffic to lartmana[.]com. This is an active CS Teams Server. 1/x
#ESETresearch discovered a trojanized IDA Pro installer, distributed by the #Lazarus APT group. Attackers bundled the original IDA Pro 7.5 software developed by @HexRaysSA with two malicious components. @cherepanov74 1/5
Today I've launched https://t.co/ioguLMcADN. I've been analyzing malware source code that utilizes WinAPIs and have been categorizing them. Please feel free to contribute as I know the current list is not exhaustive.
I found some private keys on VT, enabling all of us to decrypt C2 traffic from a subset of all the malicious Cobalt Strike servers that are out there on the Internet. More details: "Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1" https://t.co/HMBZEV4akv
I tweaked https://t.co/Sahc22ongY a little bit and I uploaded trainings, courses, papers, presentations, and posts with the idea in mind that knowledge should be free. Some of the most interesting content follows: