The Secret File Hidden Inside a File
A Windows user opened report.txt, checked its properties and found nothing suspicious. The file contained one ordinary sentence and occupied only a few bytes.
But the file was carrying something File Explorer did not reveal.
Windows NTFS supports Alternate Data Streams. This means one file can hold additional streams of data that do not appear when you open the file normally or run a standard directory listing.
In the image below, I added an internal note to report.txt. Get-ChildItem displayed only the normal file, but Get-Item -Stream * exposed the hidden note.txt stream.
This feature has legitimate uses, but attackers have also abused it to conceal scripts, payloads and stolen information. A file can look harmless while carrying data most users will never notice.
Windows does not always hide data by making the file invisible. Sometimes, it hides the data inside a file you can already see.
Save this PowerShell command for investigations:
Get-Item .\filename -Stream *
Have you ever checked a Windows file for alternate data streams?
Complete guide on how Bluetooth and BLE works by @tdcolvin
It also includes source code for a server and client Android apps that demonstrate the communication
https://t.co/m0T8Fg2qmf
Bluetooth LE spam attack is now ported to dedicated Android app to push notifications for Android and Windows
For Android, is can advertise over 170 devices
https://t.co/mT6It2DjbW
Tenho um drive com mais de 50 GB de materiais.
Nele vocรช encontra: apostilas, livros, questรตes, simulados, provas de vรกrios vestibulares, questรตes por assunto, cronogramas, kits de organizaรงรฃo nos estudos, resumos, mapas mentais, livros literรกrios, enfim, um drive mt rico.
Excellent series for learning a bit more about Linux kernel internals and exploitation techniques
Credits @_lkmidas
Part 1: https://t.co/QOg92z3lH9
Part 2: https://t.co/RLmwor9Hcq
Part 3: https://t.co/3PB8lwenPN
#Linux
๐ฃ ThreatMon's Analysis Report on #RokRAT Malware is published! ๐จ
๐ Our comprehensive investigation into the recent cyber attack attributed to #APT37 (Advanced Persistent Threat 37) has uncovered shocking details about the sophisticated #remote#access#trojan (RAT) known as RokRAT. This malicious software played a critical role in the attack by granting unauthorized access, siphoning sensitive data, and potentially maintaining control over compromised systems.
๐ปย Dive into the depths of APT37's #Attack #Chain with our report!ย ๐ป
๐ฌ Discover the attack vector, infection chain, and techniques utilized during the cyber assault. Gain a complete understanding of the RokRAT malware and its implications.
๐ก What more can you expect from our report?ย ๐ก
๐ ย We'll provide valuable insights into the Indicators of Compromise (IOCs) associated with RokRAT, empowering you to detect and mitigate potential threats. Plus, we've included a #YARA rule to aid in detection, ensuring you stay one step ahead of the game.
๐ฏ But wait, there's more!ย ๐ฏ
โ Uncover the #Mitre Att&ck techniques leveraged by APT37 in their malicious activities. Stay informed about their tactics and bolster your defenses against future attacks.
๐ Safeguard your systems with knowledge! ๐
Visit to access theย #IoCย data ๐ย https://t.co/CEH2fQ8kWV
Click here for detailedย #reportย ๐ย https://t.co/4ETXBzSClY
#reports #malware #cyber #cyberattack #cybersecurity #threatmon
I guess everyone already knows, but in case it might help someone, you can use IDACode by @layle_ctf to easily Run and debug your IDA scripts from VS Code