However, terminating the process isn't always convenient, especially if it's a critical system process that you don't want to disrupt. In the case of CLR code injection, a better approach is to load the malicious code into a new AppDomain and then unload that domain once it's done—leaving no lingering artifacts.
This is how it's implemented in my code: https://t.co/z6N6HEzlFY
Process still running, but all artifacts disappeared
@ANDREW1ALBERTT He is wonderful, but IMHO, with this lovely color it is much better to be a British cat, than a puppy.
Call him Barsik (popular cat name in Russia)
All incident response cases from 2019 in our yearly analyst report. Adversaries initial vectors, tools, #MITRE techniques and more. https://t.co/ISkLdw8OHo
Manufacturing (CNC) security presented by @574rz on @SecurityWeek’s Singapore ICS Cyber Security Conference. Now watch your #CNC spindles and #industry40 closely! Slides are finally available. Whitepaper to be published soon. #icssecurity#otsecurity https://t.co/oNBN4Ju36S
@jarnomn @gentilkiwi Mr Benjamin try to emphasize, that AV vendors sometimes can not detect/prevent the prosess of ectraction credentials, isn't it? Detecting just files are boring ;)
More on DCS security in our power plant automation research https://t.co/9NboZqsMpa from #36c3 talk https://t.co/w4EJ0Ck36V. Now with DIY assessment, wordlists and awesome visuals.
tldr; learn to do basic assessment by yourself, ask uncomfortable questions, update your DCS
Stories and lessons from Incident Response practice by Pavel Kargapoltsev on #ZeroNights 2019. Thanks for all the questions from audience and organisers for great event! Get the slides
https://t.co/c4hD1VkVjd ATT&CK inside! #DFIR#blueteam
@LasVegasLocally Seems like a part of the Boring Company advertising campaign:
1) Run a lot of nasty insects to LV
2) Give couple flamethrower to good guys
3) Make a good fire show
4) Increase capitalization of the Boring Company five times
как тебе такое @elonmusk ?
@malwrhunterteam Pizdec (пиздец) that word is quite popular at all of exUSSR republics.
Just because almost everything that happens in these areas is "пиздец" :) Other is quite similar like Georgian...
https://t.co/AaAVzLDQgh