Grayman

Zero Day Enthusiast

[Grayman @grayman_re]

New Post! Providing guidance on building a #windbg extension in C++ using #visualstudio. During my own #research there was only old #documentation. I hope this adds something valuable to people's own WinDBG extension journey:
https://t.co/pNmZSfT2qf

#reversing #development

[Grayman @grayman_re]

New blog post 🚨
Technical analysis of a multistage LNK Malware Campaign: https://t.co/ipdYWvTf0H

[Grayman @grayman_re]

New blog post: PE Headers for Malware Analysts
I walk through the PE/COFF file structure by building PEDetect, a C++ parser for examining PE Headers, Data Directories, and Sections.
https://t.co/bikGnTkBtM
#MalwareAnalysis #ReverseEngineering #WindowsInternals #PEFormat

[Grayman @grayman_re]

In Poland's largest cyberattack in recent years, #Russia #sandworm deployed #ESET dubbed #dynowiper. We have obtained the wiper and analyzed it here:

https://t.co/OyTW4P3SYA

[Grayman @grayman_re]

In my latest blog post, we are reverse engineering a Go ransomware sample to uncover its evasion techniques, encryption implementation, lateral movement capabilities, and anti-forensics methods

https://t.co/HlqIDXUTja

#malops #ransomware #ctf #malware #reversing

[Grayman @grayman_re]

New day, new blogpost!
Join me on deploying a VLAN specific for my malware analysis VM on #proxmox using #pfsense and #netgear

https://t.co/yA14zkWMoc

[Grayman @grayman_re]

MalOps released a new challenge and that means it is CTF time again! This time around, we are analyzing the Simda botnet malware using IDA Pro. Strap in, because we are going on a rollercoaster ride of encrypted payloads and anti-analysis techniques.

https://t.co/bTKWmceSMm

[Grayman @grayman_re]

Mamona Ransomware by GLOBAL GROUP released a new strain in July. Read my technical analysis to gather insights into how this ransomware strain operates.
https://t.co/JevAuvRDlu

#ransomware #malware #secops #malops

[Grayman @grayman_re]

New blogpost live! Analyzing APT37’s RokRat Loader by solving the https://t.co/jaeJVXdx15 malware challenge. Go check it out: https://t.co/9PHRxij4Z7

[Grayman @grayman_re]

Investigating a #darkside #ransomware infection is the main focus points in solving @BlueLabsOnline "SOC Alpha 3" #cyber #incident #investigation

https://t.co/nK7aMcxC8G

[Grayman @grayman_re]

Deploying #openvpn on #pfsense using #ldap authentication can be cumbersome.

Don’t worry, new in-depth tutorial is here!

https://t.co/5WSohRFCYi

[Grayman @grayman_re]

@vxunderground @Cyb3rMonk Nice!

[Mandiant (part of Google Cloud) @Mandiant]

The Flare-On Challenge is back for its 11th year! 🔥

This #CTF-style challenge for current and aspiring reverse engineers features puzzles across Windows, Linux, Web3, and even YARA.

Learn more and get ready to compete → https://t.co/qPOjkOSC2J

#Flareon11

[Grayman @grayman_re]

Recovering #BitLocker keys and working with Volume Shadow Copies #VSS are the main focus points in solving @BlueLabsOnline "The Key" #incident #investigation https://t.co/JEJEkyn8gW

[Grayman @grayman_re]

@DebugPrivilege From your POV, what's the difference between an infrastructure specialist and a generic security response engineer role within DART?

[Grayman @grayman_re]

Feeling nostalgic? I have posted the (long overdue) write-ups of #flareon challenges 3 and 4 on my blog: https://t.co/53hd6upk4z

[Grayman @grayman_re]

Bad Logic: Your Ultimate Forensic Foe. Challenge Accepted, Case Closed.

See my Blue Team Labs Online writeup for Bad Logic here: https://t.co/IOcGiN6Uot

[Grayman @grayman_re]

I recently discovered Blue Team Labs Online, which is the defensive variant of Hack The Box, and completed their "Countdown" investigation. See my writeup at https://t.co/4PuM5SQH3f

[Grayman @grayman_re]

@MaxRogers5 @HuntressLabs Hi Max,
Does one need to be physically located in the US to apply or does a willingness to work in Central Time/East Coast suffice? Thanks!

[Grayman @grayman_re]

@reprise_99 Hi Matt, thanks for sharing! Is this also open to folks outside of the US. As in, would Microsoft sponsor them to obtain the required permissions for working in the US, or is it only applicable to US citizens?