Lee has opened up nominations for the 2022 Forensic 4Cast Awards. This means that people can start nominating folks this year!
2022 Forensic 4:cast Awards – Nominations are Open!
As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Bob Rudis
Acoustic: Solving a CyberDefenders PCAP SIP/RTP Challenge with R, Zeek, tshark (& friends) - DFIR Review
Missing SQLite Records Analysis - Forensafe
- InfoSec Write-ups
Wireshark 101 Walkthrough (Tryhackme) - Joshua Hickman at ‘The Binary Hick’
Today, Widgets, & Ignored Apps in iOS - Magnet Forensics
- Marco Fontani at Amped
How Do I Fix the Aspect Ratio of a Video and Avoid Objects Being Stretched? - Khris Tolbert at MaverisLabs
Decrypting SMB3 Traffic with just a PCAP? Absolutely (maybe.) - Mike at ØSecurity
Super Timeline Quick Reference - Sumuri
RECON ITR plus RECON LAB
THREAT INTELLIGENCE/HUNTING
- 360 Threat Intelligence Center
Summary of Kimsuky’s secret stealing activities in the first half of 2021 - Anomali
Anomali Cyber Watch: APT31 Targeting French Home Routers, Multiple Microsoft Vulnerabilities, StrongPity Deploys Android Malware, and More - Anton Chuvakin
How to Make Threat Detection Better? - Antonio Piazza
Acting Red — Seeing Blue - Atomic Matryoshka
Process Injection: Malware Lurking in the Shadows of Legitimate Programs (Part 2) - Azure Sentinel
- Ben Martin at Sucuri
Stylish Magento Card Stealer loads Without Script Tags - Matthew Warner at Blumira
NTLM Relay Attack PetitPotam Targets AD Certificate Services - Check Point Research
26th July – Threat Intelligence Report - Cisco’s Talos
- Cyberint
Agent Tesla Delivers Oski Stealer - Max Heinemeyer at Darktrace
Crypto-botnets moving laterally - Dirk-jan Mollema
NTLM relaying to AD CS – On certificates, printers and a little hippo - DomainTools
- Dragos
The Challenges of Vulnerability Management in OT Environments - EclecticIQ
Recent Articles Highlight Threat Actors’ Propensity for Focused Targeting of Different Victim Groups - Eclypsium
July Firmware Threat Report - Elastic
- Esentire
Tactical Experts Driving Success for Ransomware Gangs - Britton Manahan at Expel
Well that escalated quickly: How a red team went from domain user to kernel memory - Flashpoint
Chatter Indicates BlackMatter as REvil Successor - Jenny Heino at Forcepoint
Forcepoint NGFW MITRE ATT&CK simulation - Joe Slowik at Gigamon
Ghosts on the Wire: Expanding Conceptions of Network Anomalies - Dmitry Volkov at Group-IB
Under the hood. Group-IB Threat Intelligence & Attribution - HP Wolf Security
- Huntress
A Recap of Events and Lessons Learned During the Kaseya VSA Supply Chain Attack - John Hammond
- HackTheBox “Business CTF” – Time – Command Injection
- HackTheBox “Business CTF” – discordvm – Node.js Sandbox Escape
- GraphQL Introspection – HackTheBox “Business CTF” – NoteQL
- JSON Web Keys (JWK & JWT) – “Emergency” – HackTheBox Business CTF
- Laravel CVE / PHP Deserialization – “Larablog” HTB Business CTF
- Roman Dedenok at Kaspersky Lab
Use of Google Apps Script in phishing | Kaspersky official blog - Keysight
- Lawrence Abrams at Bleeping Computer
LockBit ransomware now encrypts Windows domains using group policies - Malwarebytes Labs
Microsoft provides more mitigation instructions for the PetitPotam attack - Thibault Seret at McAfee Labs
Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and *nix Systems? - Mehmet Ergene
Detecting PetitPotam and other Domain Controller Account Takeovers - Microsoft Security
- Nikhil Rathor at 0xthreatintel
Tempering with practicing of information warfare ! - Joshua Miller, Michael Raggi, and Crista Giering at Proofpoint
I Knew You Were Trouble: TA456 Targets Defense Contractor with Alluring Social Media Persona - ReaQta
Understanding PrintNightmare: The importance of having visibility over new attack vectors - Recorded Future
- Red Alert
- Thomas Gardner and Matt Graeber at Red Canary
The adversary’s gift: When one technique opens a Pandora’s box - RiskIQ
- Ryan Hausknecht
Cobalt Strike and Tradecraft - S2W Lab
- Sandor Tokesi at Forensics Exchange
Parameterized Alerts in Azure Sentinel - SANS Internet Storm Center
- Scythe
- Securelist
APT trends report Q2 2021 - Security Investigation
- Ahmed Khlief at Shells.Systems
NinjaC2 V2.1 : New webshell agent , more features and updated AV bypass - Andy Robbins at SpecterOps
Introducing BloodHound Enterprise: Attack Path Management for Everyone - Splunk
Detecting SeriousSAM CVE-2021-36934 With Splunk - Alfredo Oliveira and David Fiser at Trend Micro
Threat Actors Exploit Misconfigured Apache Hadoop YARN - Zach Stanford
Guide to Named Pipes and Hunting for Cobalt Strike Pipes
UPCOMING EVENTS
- Elan at DFIR Diva
DFIR Related Events for Beginners – August, 2021 - Magnet Forensics
August 4 11:00AM ET // Introduction to Magnet AXIOM
PRESENTATIONS/PODCASTS
- AhmedS Kasmani
Analysis of Malware from Kaseya/Revil Supply Chain attack. - Archan Choudhury at BlackPerl
Threat Hunt – MOST Powerful Platform for Hunters – It’s FREE - Black Hills Information Security
- Breaking Badness
92. The Game is Afoot - Bret Witt
DFIR – IcedID Malware Family - Cellebrite
DFIR Mentorship – What does it mean? - Chewing the FAT
Episode 3 - Chris Sienko at the Cyber Work podcast
Tips on entering blue teaming, red teaming or purple teaming | Cyber Work Live - Day Cyberwox
CompTIA Security+ VS CompTIA CySA+ | Do You Need Both? - Digital Forensic Survival Podcast
DFSP # 284 – Fast Triage case study: non-Windows core processes - Gerald Auger at Simply Cyber
- John Hammond
Reverse Engineering Loops – “Syncopation” HackTheBox Business CTF - Justin Tolman at AccessData
FTK Feature Focus – Episode 20 – Upcoming Webinars! - Karsten Hahn at Malware Analysis For Hedgehogs
Malware Theory – Trojan Horse is not a Malware Type - LIFARS Cybersecurity
Hackbits Podcast Episode 1 – Avanan – SOC Burnout - Magnet Forensics
- OALabs
Python3 Tips For Reverse Engineers - Passware
Passware Kit Mobile Demo Video - Positivity Blue Team
Behavioral Engineering - Recorded Future
You’re Not Really Ready for Ransomware - Richard Bejtlich at TaoSecurity
Zeek in Action Videos - SANS Institute
What Your Privacy Officer Is Trying To Tell You…If only you would listen. - SecurityNinja
Blue Team Labs Online Walk Through – Memory Analysis Ransomware - We are OSINTCurio.us
Companion Post to the 2021 SANS Live Stream “Tips for Conducting OSINT Investigations in the EU with GDPR” - WolfCast
WolfCast – Episode 05 – Security In Japan
MALWARE
- 0day in {REA_TEAM}
Reversing With Ida From Scratch (P36) - 360 Total Security
“Netfilter Rootkit II ” Continues to Hold WHQL Signatures - CERT-AGID
In atto campagna di phishing con invito ad aggiornare WebMail Pro - Alexey Bukhteyev and Raman Ladutska at Check Point Research
Time-proven tricks in a new environment: the macOS evolution of Formbook - Andrew Windsor and Chris Neal at Cisco’s Talos
Threat Spotlight: Solarmarker - Ido Kringel at Deep Instinct
PDF as a Weapon of Choice on the Cybersecurity Battlefield - Shunichi Imano and Fred Gutierrez at Fortinet
Wiper Malware Riding the 2021 Tokyo Olympic Games - Howard Oakley at ‘The Eclectic Light Company’
A Short History of Malware Protection in macOS - Igor Skochinsky at Hex Rays
Igor’s tip of the week #50: Execution flow arrows - Dmitry Melikov at InQuest
Espionage Utilizing Mobile Devices - Jan Vojtěšek at Avast Threat Labs
Magnitude Exploit Kit: Still Alive and Kicking - Mahmoud Morsy
- Malwarebytes Labs
- Gustavo Palazolo at Netskope
Netskope Threat Coverage: 2020 Tokyo Olympics Wiper Malware - Palo Alto Networks
- PC’s Xcetra Support
A deeper look at Office documents flat style - ReversingLabs
- Security Onion
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-06-18
- Quick Malware Analysis: malware-traffic-analysis.net pcaps from 2021-06-16
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-06-17
- Quick Malware Analysis: malware-traffic-analysis.net pcaps from 2021-06-15
- Quick Malware Analysis: malware-traffic-analysis.net pcaps from 2021-06-04
- SentinelOne
- Jason Reaves at Walmart
Decrypting BazarLoader strings with a Unicorn - Brett Stone-Gross at ZScaler
DoppelPaymer Continues to Cause Grief Through Rebranding
MISCELLANEOUS
- Andrew Rathbun at AboutDFIR
AboutDFIR Content Update 7/26/2021 - Blaine Davison at Amped
Three Reasons Why You Should Keep Your SMS Plan Up to Date - Belkasoft
Belkasoft DFIR Survey 2021: Your Personal Advisor - Amina Zilic at Binalyze
The Fifth Step to Forensic Readiness: Secure Evidence Repositories & Handling - Joseph Muniz at Cisco
The Modern Security Operation Center - Yacin Nadji at Corelight
Telegram Zeek, you’re my main notice - Oleg Afonin at Elcomsoft
iOS Privacy Protection Tools: Encrypted DNS, iOS 15 Private Relay, Proxy, VPN and TOR - Forensic Focus
- IntaForensics
Ten Steps to Effectively Managing Cases and Investigations within Lima v2.9 - Magnet Forensics
Another Set of Amazing Wins at the 2021 Forensic 4:cast Awards! - Matt Suiche at Comae
Announcing Comae platform V2.0 Closed Beta - McHugh Security
Deploying MISP on DigitalOcean of Vultr Cloud Hosting - Ryan Campbell at ‘Security Soup’
Weekly News Roundup — July 25 to July 31
SOFTWARE UPDATES
- AccessData
Forensic Toolkit (FTK) International version 7.4.2 - Autopsy
autopsy-4.19.0 - Cellebrite
Now available: Cellebrite Physical Analyzer and Cellebrite UFED Cloud v7.47 - CyberChef
v9.29.2 - DFIRTrack
v2.0.0 - DME Forensics
DVR Examiner 3.0.5 is now available! - Eric Zimmerman
ChangeLog - IntelOwl
Dehashed.com search analyzer and other improvements - Magnet Forensics
- MISP
MISP 2.4.147 released (improvements and bug fixes release) - MobilEdit
MOBILedit Forensic Express 7.4.1 released - OpenText
Tableau Firmware Update Revision History for 21.3 - Oxygen Forensics
Oxygen Forensic® Detective v.13.7 - Paraben Corporation
E3 Forensic Platform 3.0 Released - Security Onion
- Xways
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 