As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Angry-Bender’s blog house
DFIR Playbook – Windows Forensics(WIP APR21) - John Walther at Carpe Indicium
Cleaner Office365 logs with Excel and Magnet Custom Artifact Generator - Heather Mahalik at Cellebrite
UFED Fundamentals Matter – You Asked, We Answered - Dexter Morgan at Data Forensics
How to Find Who Deleted Records in SQL Server? Perfect Workarounds - Dr. Neal Krawetz at ‘The Hacker Factor Blog’
Another Bad Example from CAI - Forensafe
- LIFARS Cybersecurity
Collecting and Analyzing NetFlow for Incident Response - Luu Justin
iOS App Forensics — A Closer Look at The MySudo Privacy App - Marco Fontani at Amped
Metadata: So Useful But Not So Reliable - Debojyoti Chakraborty at McAfee Labs
Steps to Discover Hidden Threat from Phishing Email - Mike Brewer at DFW Forensics
Incident Response in the Cloud Part 2 – Azure - Oxygen Forensics
Not so private: extracting data from PrivateSpace - Heather Mahalik, John Bair, Alexis, Brignoni, Stephen Coates, Mike Dickinson, Mattia Epifani, Jessica Hyde, Vladimir Katalov, Scott Koenig, Paul Lorentz, Christophe Poirier, Lee Reiber, Martin Westman, Mike Williamson, Ian Whiffin, and Oleg Skulkin
Six Steps To Successful Mobile Validation - Jorge Díaz at Security Art Work
¿Es importante el registro SID de Windows? - The DFIR Report
Trickbot Brief: Creds and Beacons - Andrew Case at Volatility Labs
Highlighting Research from the Next Generation of Memory Forensics Practitioners
THREAT INTELLIGENCE/HUNTING
- Adam at Hexacorn
- Anastasios Pingios
- Anomali
- Anomali Cyber Watch: HabitsRAT Targeting Linux and Windows Servers, Lazarus Group Targetting South Korean Orgs, Multiple Zero-Days and More
- Anomali Cyber Watch: Microsoft Office SharePoint Servers Targeted with Ransomware, New Commodity Crypto-Stealer and RAT, Linux Backdoor Targeting Users for Years, and More
- Anton Chuvakin
Not the Final Answer on NDR in the Cloud … - Azure Sentinel
- Randy Pargman at Binary Defense
Intruder Tactics: Privilege Escalation - Cloud Security Alliance
Cloud Incident Response Framework - DeTTECT
v1.4.3 - Tim Helming at DomainTools
The Power of DNS OSINT in Detecting Supply Chain Compromises - EclecticIQ
Credentials and Cryptocurrency Are Targets of Recent Exploits - Nick Richard and Dimiter Andonov at Fire Eye Threat Research
The UNC2529 Triple Double: A Trifecta Phishing Campaign - Group-IB
- Hamza Ouadia at Snorlax Security
Detecting Lateral Movement via Service Configuration Manager - InfoSec Write-ups
Blue Team Operations [Part 2]: How To Investigate Malware Incidents as a SOC Analyst - Intrusion Truth
An APT with no name - Leonardo M. Falcon
- Samuel Hassine at Luatix
SEKOIA.IO Threat Intelligence in OpenCTI - Malwar3ninja
Check out @Malwar3Ninja’s tweet - Mehmet Ergene
The Hidden Problem that XDR has to Solve and Why You Should be Careful about XDR - Michael Koczwara
Cobalt Strike Hunting, Red Teams/Threat Actors TTP’s - Microsoft Security
- MITRE Evaluations
- Owen at InSecurity
Detecting Lateral Movement via WinRM Using KQL - Palo Alto Networks
- Sam Scholten And Crista Giering at Proofpoint
BEC Taxonomy: Invoice Fraud - Recorded Future
China’s PLA Unit 61419 Purchasing Foreign Antivirus Products, Likely for Exploitation - Red Alert
SectorB Group’s Threat Landscape in 2020 - Justin Schoenfeld and Aaron Didier at Red Canary
Rclone Wars: Transferring leverage in a ransomware attack - RiskIQ
TrickBot: Get to Know the Malware That Refuses to Be Killed - Sergiu Sechel
Improving the network-based detection of Cobalt Strike C2 servers in the wild while reducing the… - ShadowChasing1
Check out @ShadowChasing1’s tweet - Sophos
- Symantec Enterprise
Multi-Factor Authentication: Headache for Cyber Actors Inspires New Attack Techniques - Tetra Defense
Cause and Effect: SunCrypt Ransomware Analysis - Trend Micro
- Mattias Wåhlén at Truesec
Are The Notorious Cyber Criminals Evil Corp actually Russian Spies? - Corsin Camichel at Vulnerability.CH
Introducing COLT – Compromise to Leak Time - Zach Stanford
Stats from Hunting Cobalt Strike Beacons
UPCOMING EVENTS
- Binalyze
Enterprise Forensics – An introduction to Binalyze AIR & Drone - Cellebrite
- Elan at DFIR Diva
DFIR Related Events for Beginners – May, 2021 - Magnet Forensics
PRESENTATIONS/PODCASTS
- Cache Up with Jessica Hyde
Magnet Forensics Presents: Cache Up – Ep.49 – Jad Saliba & Geoff MacGillivray - Chapin Bryce
This Month In 4n6 – April – 2021 - AhmedS Kasmani
Extract Comrat Malware Dll’s from Powershell Dropper - Black Hills Information Security
- Breaking Badness podcast
84. Take a Payload Off - Bret Witt
- Chewing the FAT
Episode 1 - Cybereason
Malicious Life Podcast: China’s Unrestricted Cyberwarfare Part 1 - Data Rescue Labs
- Digital Forensic Survival Podcast
DFSP # 272 – 4688 - FIRST
2021 FIRST Special Interest Group (SIG) Update Webinars – Thursday May 6 - Gerald Auger at Simply Cyber
- John Hubbard at ‘The Blueprint podcast’
- Lee Reiber’s Forensic Happy Hour
Oxygen Forensics Episode 208 - Magnet Forensics
- Magnet Forensics: Dedicated to Helping Keep Companies and Communities Safe
- Magnet AXIOM 5.0: Our Most Comprehensive and Flexible Version of AXIOM Ever
- Search for Keywords Post-Processing in Magnet AXIOM
- The All-New Media Explorer in Magnet AXIOM 5.0
- Magnet AXIOM Cyber 5.0: Linux Support and Other Great Improvements
- Positivity Blue Team
Lets Talk About Mental Health - Recorded Future
Navigating the Travel Industry with Threat Intelligence - Velocidex Enterprises
MALWARE
- Alex Turing at 360 Netlab
RotaJakiro, the Linux version of the OceanLotus - Apr4h
Manually Unpacking Remcos Malware - Bogdan Vennyk
Zero2Automated — Custom Sample analysis - Chuong Dong
Darkside Ransomware - CISA Analysis Reports
- Caitlin Huey, Andrew Windsor, and Edmund Brumaghin at Cisco’s Talos
Lemon Duck spreads its wings: Actors target Microsoft Exchange servers, incorporate new TTPs - Cofense
- Dylan Barker
Malware Analysis Techniques: Tricks for the triage of adversarial software - GoggleHeadedHacker
Sodinokibi Ransomware Analysis - Igor Skochinsky at Hex Rays
Igor’s tip of the week #38: Hex view - Mahmoud Morsy
- Marco Ramilli
MuddyWater: Binder Project (Part 2) - Nadav Lorber at Morphisec
Revealing the ‘Snip3’ Crypter, a Highly Evasive RAT Loader - NCC Group Research
RM3 – Curiosities of the wildest banking malware - Nikhil Rathor at 0xthreatintel
Unit180 (Lazarus) targets Japan! - Omri Segev Moyal at ProferoSec
Cuba Ransomware Group on a Roll - Proofpoint
New Variant of Buer Loader Written in Rust - Chris Hoff at ReversingLabs
It only takes one line of code to ruin your day - SANS Internet Storm Center
- Mark Lechtik and Giampaolo Dedola at Securelist
Operation TunnelSnake: formerly unknown rootkit used to secretly control networks of regional organizations - David Bisson at Security Intelligence
What is Ghimob Malware? - Monte de Jesus, Fyodor Yarochkin, and Paul Pajares at Trend Micro
New Panda Stealer Targets Cryptocurrency Wallets - Lloyd Macrohon and Rodel Mendrez at Trustwave SpiderLabs
Pingback: Backdoor At The End Of The ICMP Tunnel - Joshua Platt and Jason Reaves at Walmart
BuerLoader Updates - Jon Paterson at Zimperium
Flubot vs. Zimperium - Aniruddha Dolas, Mohd Sadique, and Manohar Ghule at ZScaler
Catching RATs Over Custom Protocols
MISCELLANEOUS
- Andreas Sfakianakis at ‘Tilting at windmills’
ENISA’s Ad-Hoc Working Group on Cyber Threat Landscapes - Berla
iVe 3.2 Feature Spotlight: Enhanced Tag Reports - Cyberwox Academy
- David Stenhouse at Data Mutz
Running a One-Person Business – 5 Things I Have Learned - Df challenge
Digital Forensics Challenge 2021 - Jess Garcia at DS4N6
[BLOG] DS4N6 – The Road So Far – Part I, by Jess Garcia - Olga Koksharova at Elcomsoft
Our Guidelines For The World Password Day - Esentire
Five Common Mistakes to Avoid in Digital Forensics and Incident Response (IR) - Forensic Focus
- LockBoxx
NCCDC 2021 Red Team Review - Magnet Forensics
- Linux Support and Other Great Improvements in Magnet AXIOM Cyber 5.0
- Run Magnet AXIOM Cyber in Microsoft Azure
- The All-New Media Explorer in Magnet AXIOM 5.0
- Search for Keywords Post-Processing in Magnet AXIOM
- Process Evidence up to 50% Faster* with AXIOM and AXIOM Cyber 5.0
- 6 New Linux Artifacts and Why They Matter
- Mary Ellen Kennel at ‘What’s A Mennonite Doing In Manhattan?!’
InfoSec101 CheatSheet - Reddit
Arbitrary code execution found in ExifTool. Make sure to update to 12.24+ - Ryan Campbell at ‘Security Soup’
Weekly News Roundup — April 25 to May 1 - SANS
SOFTWARE UPDATES
- Andrew Oliveau
BeaconHunter - Berla
iVe Software v3.2 Release - Binalyze
IREC Version 2.6.2 - Brian Maloney
SEPparser Released - Cellebrite
Cellebrite Pathfinder v8.6 delivers significant progress towards enterprise readiness, scalability, and process performance improvements. - Eric Zimmerman
ChangeLog - Intaforensics
Lima V2.9: The Birth, Evolution & Futureproofing Of Forensic Case Management - JPCERT
LogonTracer v1.5.3 - mac_apt
20210506 - Magnet Forensics
Magnet AXIOM 5.0: Our Most Comprehensive and Flexible Version of AXIOM Ever - Metaspike
Forensic Email Collector (FEC) Changelog - Mihari
v2.3.1 - MSAB
XRY 9.4.2 - OpenText
Tableau Firmware Update Revision History for 21.2 - Xways
X-Ways Forensics 20.3 Preview 3
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 