@KyleTDavis1 You’ve always been a joy to work with, and have given me good advice related to work/cyber and anything else I’ve needed help with. I know you’ll thrive wherever you land next
Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint.
We use this tool internally to help track multiple threat actors with high confidence, improving attribution in many cases.
The tool has been released in the @Proofpoint Emerging Threats public #GitHub for other defenders to leverage.
Learn more about it here: https://t.co/I8IGC8mxCk
@ET_Labs #PDF #threatdetection #cyberthreat
@MalwareUtkonos@greglesnewich I do really like that you’re using the filesize in part of the location check like that, I don’t know if I have any rules that use the filesize in that way.
@MalwareUtkonos@greglesnewich Am I right in assuming that’s meant to make sure you’re only reading the eocd of the actual zip file and not any of the sub files? I have some rules where I’ve done something similar, I think it went something like: uint32be(@eocd[#eocd] + whatever) == 0xdeadbeef
the biggest skill jump I took with yara was to think how the bytes within a file relate to one another
Malware isn’t a monolith - it’s a composite of bytes, and those bytes have to work together to do their job.
we can exploit those unique relations to track em
@greglesnewich@MalwareUtkonos Definitely have to echo how impactful learning file formats was for improving my yara rules. How highly structured the
Zip format is makes rules very fun. The only sample rule I have rn is this old compression ratio one
On this DISCARDED episode, we uncover real-world detection wins, explore persistent threats like #TA505 and #Emotet, and dive into the importance of instincts in cybersecurity—because, as our guest puts it, sometimes good detection is all about the vibes. https://t.co/stWpG8ubo7