As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Chris at AskClees
SQLite Databases at hex level - Craig Ball at ‘Ball in your Court’
The Metadata Vanishes - DFIR Review
- Marcelo Caiado
Desafios e oportunidades na perícia digital - Didier Stevens
oledump Indicators - Magnet Forensics Weekly CTF
- Melissa at Sketchymoose’s Blog
Windows Subsystem for Linux: Finding the Penguin - Alexander Jäger at Open Source DFIR
Sigma in Timesketch – let’s rule the sketch - Warlock
Exploring the Hive — Deep Inside the Window Registry - Tetra Defense
Cause and Effect: WastedLocker Ransomware Analysis
THREAT INTELLIGENCE/HUNTING
- Adam at Hexacorn
- Azure Sentinel
- Brad Duncan at Malware Traffic Analysis
2020-11-20 – TA551 (Shathak) Word docs with Japanese template push IcedID - BushidoToken
Analysis of the threats targeting Point of Sale systems - Corelight
- Dragos
November Dragos Knowledge Pack: The Latest Industrial Threat and Device Data - David Blanton at Expel
Introducing a mind map for AWS investigations - Riccardo Ancarani at F-secure
Detecting Cobalt Strike Default Modules via Named Pipe Analysis - Antonis Terefos and Anne Postma at Fox-IT
TA505: A Brief History Of Their Time - Vijay at Hacking Articles
AlienVault: Threat Hunting/Network Analysis - Intel 471
Ransomware-as-a-service: The pandemic within a pandemic - Jorge Orchilles at Scythe
SCYTHE Presents: #ThreatThursday – Bersek Bear - Olaf Hartong at Falcon Force
FalconFriday - Keith Mccammon at Red Canary
Breaking down the modern security operations center - RiskIQ
A New Grelos Skimmer Reflects the Depth and Murkiness of the Magecart Ecosystem - John Althouse at Salesforce Engineering
Easily Identify Malicious Servers on the Internet with JARM - Katie Nickels at SANS
SANS Threat Analysis Rundown Recap: The Return of UNC1878 - Securelist
Advanced Threat predictions for 2021 - G Data
Criminal Activities in Times of a Global Pandemic - Andrew Brandt at Sophos
Sophos’ 2021 threat report highlights a path forward - Cesar Anjos at Sucuri
Evasive Maneuvers in Data Stealing Gateways - Threat Hunting SE
- Vicente Díaz at VirusTotal
Why is similarity so relevant when investigating attacks
UPCOMING EVENTS
- Belkasoft
Learn Belkasoft X with Belkasoft’s CEO - Cellebrite
- Magnet Forensics
November 23 12:00PM GMT: Demo: Investigating with Magnet AXIOM - Red Siege Information Security
SiegeCast: Unpacking the Packet - Techno Security & Digital Forensics Conference Myrtle Beach
Call for papers
PRESENTATIONS/PODCASTS
- Cache Up with Jessica Hyde
Magnet Forensics Presents: Cache Up – Ep.25 – Brian Moran - Kevin Ripa at SANS
- Andreas Sfakianakis at ‘Tilting at windmills’
SANS CTI Summit 2020 Video Recording - Basis Technology
- Black Hills Information Security – YouTube
BHIS | Talkin’ Bout News 2020-11-19 - Breaking Badness podcast
67. A Pain in the RaaS - Cellebrite
- Chris Sienko at the Cyber Work podcast
Influencing security mindsets and culture - DFIR.Science
- Digital Forensic Survival Podcast
DFSP # 248 – Searchsploit - Lee Reiber’s Forensic Happy Hour
Oxygen Forensics Episode 135 - Richard Davis at 13Cubed
Plaso and WSL 2 – The WSL Adventures Continue… - SANS
- External Threat Hunters are Red Teamers | 2020 Threat hunting & Incident Response Summit
- Threat Hunting and the Platypus – Why Information Modeling is Essential, yet Challenging
- Started from the Bottom: Exploiting Data Sources to Uncover ATT&CK Behaviors
- Becoming a CISO: Leading Transformation
- SANS Cyber Security Foundations Course
- Virus Bulletin
MALWARE
- 360 Netlab
- Victor Vrabie at Bitdefender Labs
A Detailed Timeline of a Chinese APT Espionage Attack Targeting South Eastern Asian Government Institutions - Cisco’s Talos
- Cybereason
- Didier Stevens
Decrypting With translate.py - Andrew Oliveau, Alyssa Rahman, and Brett Hawkins at Fire Eye Threat Research
Purgalicious VBA: Macro Obfuscation With VBA Purging - Igor Skochinsky at Hex Rays
Igor’s tip of the week #16: Cross-references - Shusei Tomonaga at JPCERT/CC
ELF_PLEAD – Linux Malware Used by BlackTech - Kate at 360 Total Security
360 File-less Attack Protection Intercepts the Banker Trojan BBtok Active in Mexico - Malwarebytes Labs
Malsmoke operators abandon exploit kits in favor of social engineering scheme - Daniel Smith at Radware
- Robert Simmons at ReversingLabs
PoorWeb – Hitching a Ride on Hangul - SANS Internet Storm Center
- Jim Walter at SentinelLabs
Ranzy Ransomware | Better Encryption Among New Features of ThunderX Derivative - Scutum
- Jessica Ellis at The PhishLabs Blog
Ransomware Groups Break Promises, Leak Data Anyway - Abraham Camba, Bren Matthew Ebriega, and Gilbert Sison at Trend Micro
Weaponizing Open Source Software for Targeted Attacks - VMRay
Malware Analysis Spotlight: AZORult Delivered by GuLoader - Anton Cherepanov and Peter Kálnai at WeLiveSecurity
Lazarus supply‑chain attack in South Korea - Wrongbaud
Introduction to Reverse Engineering with Ghidra: A Four Session Course
MISCELLANEOUS
- Andrew Rathbun at AboutDFIR
- Agari
- Andrea Fortuna at ‘So Long, and Thanks for All the Fish’
FAMA: Forensic Analysis For Mobile Apps - Brett Shavers at DFIR Training
Which way to DFIR Street? - Cellebrite
- Chris Sanders
Dissertation – Subject Application - Jimmy Schroering at DME Forensics
User Interface Testing - Elan at DFIR Diva
My Experience With Recon Infosec’s NDR Training - Elcomsoft
- Dennis Goodlett at Hurricane Labs
R2con 2020 Review - Aleksandar Milenkoski at Insinuator
Microsoft Office Telemetry: Report Release - Magnet Forensics
- Marco Fontani at Amped
A Short Guide to Choosing the Right Export Format For Your Images and Videos: Part 1 - Rhea Jethvani at Project Cyber
Ransomware Attacks & Their Impact on a COVID-19 World–By Teen Project Cyber Writer Rhea Jethvani - Richard Frawley at ADF
- Ryan Campbell at ‘Security Soup’
Weekly News Roundup — November 8 to November 14 - SANS
- Kelsey Segrue at TrustedSec
An Update On Non-Aggressive Reporting - Volatility Labs
The 2020 Volatility Plugin Contest results are in!
SOFTWARE UPDATES
- Adam at Hexacorn
DeXRAY 2.25 update - Belkasoft
Belkasoft X is released! - Brian Kellogg
Reg Hunter - Didier Stevens
Update: oledump.py Version 0.0.55 - Eric Zimmerman
ChangeLog - Magnet Forensics
Support the Latest iOS and Android Devices with Magnet AXIOM 4.7 & Magnet AXIOM Cyber 4.7 - Passware
What’s New video on Passware Kit Forensic 2020 v4 release - Sandfly Security
Sandfly 2.8.0 – Agentless Active Attack Response for Linux - Security Onion
Security Onion 2.3.10 now available! - Andy Robbins at SpecterOps
Introducing BloodHound 4.0: The Azure Update - TheHive Project
It’s not Patch Friday… TheHive 4.0.2 released - Timesketch
20201120 - Xways
X-Ways Forensics 20.1 Beta 1c
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 