As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Belkasoft
How to acquire data from an Android device using APK downgrade method - Forensafe
Investigating Signal with ArtiFast Signal - Kevin Pagano at Stark 4N6
May I Ask Who’s Calling – Google Call Screen - Matt Lombana at Praetorian
How to improve your Incident Response (IR) with Live Response - Security Onion
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-05-26
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-08-05
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-05-24
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-08-10
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-05-24 IcedID
- Quick Malware Analysis: malware-traffic-analysis.net pcap from 2021-05-21 Qakbot
- Seif Shalaby at 0xSh3rl0ck
Africa DFIR CTF Week 2 - Syed Hasan
Forensic Analysis of an LNK File
THREAT INTELLIGENCE/HUNTING
- Hannah Cartier at Active Countermeasures
Malware of the Day – Malware Techniques: Discovery and Information Gathering - Adam Svoboda
Sleeping with a Mask On (Cobalt Strike) - Alex Teixeira
The role of ‘Novelty’ and ‘Behaviour’ in Computer Forensics & Detection Engineering - Anomali
Anomali Cyber Watch: GIGABYTE Hit By RansomEXX Ransomware, Seniors’ Data Exposed, FatalRat Analysis, and More - Brian Kerns and Vedran Tomljanovic at AT&T Cybersecurity
Stories from the SOC – Sodinokibi Ransomware (REvil / BlueCrab) - Azure Sentinel
- David Kennedy at Binary Defense
Commodity vs Behavioral Detections - Brad Duncan at Malware Traffic Analysis
- Bryan Murphy at CyberArk
Living Off the Land Ransomware Attacks: A Step-By-Step Plan for Playing Defense - BushidoToken
The Lazarus Heist: Where Are They Now? - Joseph Barsness at Censys
It’s Raining Buckets: The Importance of Cloud Storage Configurations - CERT NZ
How ransomware happens and how to stop it - Check Point Research
- Ben Nahorney at Cisco
Threat Protection: The REvil Ransomware - Cisco’s Talos
- Cobalt Strike Research and Development
- Cyberint
- CyberWatch
Comparing Chinese APTs in Software Supply Chain Attacks - Kelsey LaBelle at DomainTools
Valuable Datasets to Analyze Network Infrastructure | Part 1 - EclecticIQ
REvil and Darkside Successor Launches Operations as United States Establishes Joint Cyber Defense Collaborative - Haran Kumar at Elastic
Establish robust threat intelligence with Elastic Security - Fire Eye Threat Research
UNC215: Spotlight on a Chinese Espionage Campaign in Israel - Flashpoint
REvil Master Key for Kaseya Attack Posted to XSS - Val Saengphaibul at Fortinet
The Affiliate’s Cookbook – A Firsthand Peek into the Operations and Tradecraft of Conti - Gianni Castaldi at Kusto King
Searching and finding data - Dmitry Volkov at Group-IB
Under the hood. Group-IB Threat Intelligence & Attribution. Part 2 - Divyanshu Shukla at InfoSec Write-ups
GCP Inspector | Auditing Publicly Exposed GCP Bucket - Jumpsec Labs
Running Once, Running Twice, Pwned! Windows Registry Run Keys - Luis Francisco Monge Martinez
Hunting threats with Pandas — $MFT Analysis - Michael Koczwara
Conti Ransomware Group Cobalt Strike C2 Analysis & RDP Persistence - Netskope
New Phishing Attacks Exploiting OAuth Authentication Flows (Part 2) - ReaQta
A New Era of Ransomware and its Affiliates: LockBit 2.0 - Red Alert
SectorA05 PDF Malware disguised as a Northeast Asia Economic Association Executive Course - Laura Brosnan at Red Canary
5 ways to reduce SOC analyst burnout - SANS Internet Storm Center
- ProxyShell – how many Exchange servers are affected and where are they?, (Mon, Aug 9th)
- TA551 (Shathak) continues pushing BazarLoader, infections lead to Cobalt Strike, (Wed, Aug 11th)
- Example of Danabot distributed through malspam, (Fri, Aug 13th)
- Scanning for Microsoft Exchange eDiscovery, (Fri, Aug 13th)
- Security Investigation
- SentinelOne
What Is A Malware File Signature (And How Does It Work)? - Symantec Enterprise
Affiliates Unlocked: Gangs Switch Between Different Ransomware Families - Claire Tills at Tenable
One Year Later: What Can We Learn from Zerologon? - Tyranid’s Lair
How to secure a Windows RPC Server, and how not to. - Vicente Díaz at VirusTotal
A Sneak Peek into VT Alerts - Vitali Kremez at Advanced Intelligence
Secret “Backdoor” Behind Conti Ransomware Operation: Introducing Atera Agent
UPCOMING EVENTS
- Acelab
Meet ACE Lab and the PC-3000 at FT-Day 2021, Germany! - Ashley Hernandez at Cellebrite
Remote Mobile Collections for Corporate Investigations - Exterro
Masters of Digital Forensics Course # 1: Imaging—The Easy Part! Or is it? Mastering Collection & Acquisition - Magnet Forensics
- Seventh Annual Industrial Control System Security (ICSS) Workshop
Call for Submissions
PRESENTATIONS/PODCASTS
- Archan Choudhury at BlackPerl
Threat Intelligence Tools, Automate Intelligence Gathering, Twitter & Power Automate - Black Hills Information Security
- Bret Witt
DFIR – REvil Ransomware - Cisco’s Talos
Talos Takes Ep. #64: Back 2 Skool edition - Didier Stevens
- Digital Forensic Survival Podcast
DFSP # 286 – Lateral MM Fast Triage 2 [5145] - Eric and Mark at ‘Forensics and Beer’
Imaging a Hard Drive - Gerald Auger at Simply Cyber
- Justin Tolman at AccessData
FTK Feature Focus – Episode 22 – Saving Registry Viewer Common Areas - LetsDefend
Simple demo of Incident Responder module - Matt Danner at Monolith Forensics
- OALabs
Leaked Conti Ransomware Playbook – Red Team Reacts - Recorded Future
Understanding Ransomware - Richard Frawley at ADF
How to Build a Digital Forensic Triage Process that Works Field to Lab - SANS Institute
Why Level Up with SANS SEC401? - SecurityNinja
Blue Team Labs Online Walk Through – Log Analysis Privilege Escalation - Trend Micro
Optimize Your Incident Response Planning with the MITRE Framework - Watson Infosec
Ransomware Threat Hunting - WolfCast
WolfCast – Episode 06 – Recruitment – Jobba The Hunt
MALWARE
- Martin Chlumecký at Avast Threat Labs
DirtyMoe: Rootkit Driver - Igor Skochinsky at Hex Rays
Igor’s tip of the week #52: Special attributes - Giancarlo Lezama at Intezer
Fast Insights for a Microsoft-Signed Netfilter Rootkit - Johannes Bader
A BazarLoader DGA that Breaks Down in the Summer - Pieter Arntz
Phishing campaign goes old school, dusts off Morse code - McAfee Labs
- Microsoft Security
Attackers use Morse code, other encryption methods in evasive phishing campaign - Palo Alto Networks
- Phil Stokes at SentinelLabs
Massive New AdLoad Campaign Goes Entirely Undetected By Apple’s XProtect - Sophos
- Trend Micro
- Zuzana Hromcová at WeLiveSecurity
IISerpent: Malware‑driven SEO fraud as a service - Aazim Yaswant at Zimperium
FlyTrap Android Malware Compromises Thousands of Facebook Accounts
MISCELLANEOUS
- Andrew Rathbun at AboutDFIR
AboutDFIR Content Update 8/8/2021 - Binalyze
- Cellebrite
- Dr. Brian Carrier at Cyber Triage
Cyber Triage Gives Back to Autopsy - Dr. Ali Hadi at ‘Binary Zone’
Prevent Windows Reboots on Expired VMs - Dr. Neal Krawetz at ‘The Hacker Factor Blog’
One Bad Apple - Dr. Tristan Jenkinson at ‘The eDiscovery Channel’
The Apple CSAM Scanning Discussion – Part One - Lesley Carhart at Dragos
5 Costly Mistakes in Cyber Incident Response Preparation - Faith Opiyo at CyberSecFaith
Building my Home Lab part 3: deploying the core infrastructure (hypervisor,firewall and router) - Forensic Focus
- Identifying Crypto API Usages In Android Apps Using A Static Analysis Framework
- Big Game Hunting From A Forensic Point Of View
- Amazing Opportunity – USA And Canada Channel Partners – Work With UK Leading Digital Forensics Company
- Warren Kruse, Vice President of Cyber Investigations, Consilio
- A Novel Adversarial Example Detection Method For Malicious PDFs Using Multiple Mutated Classifiers
- Register For Webinar: Binalyze AIR v1.8.0 Release Highlights
- Joshua Smith, Training Instructor, Oxygen Forensics
- Advanced Forensic Recovery And Analysis Of MySQL Data In Deleted State
- Howard Oakley at ‘The Eclectic Light Company’
How Apple intends checking images for CSAM - Nicole Fishbein at Intezer
Guide to Digital Forensics Incident Response in the Cloud - LockBoxx
Approaches to Threat Modeling – With The Hunt for Red Apples - Magnet Forensics
Demystifying Cloud Investigations - Marco Fontani at Amped
How Can I Crop a Video or Image in Amped Replay? - Microsoft Security Response Center
Point and Print Default Behavior Change - Chuck Dodson at OpenText
A day in the life of evidence: Part 1 - Patrick J. Siewert at ‘Pro Digital Forensic Consulting’
Apple’s New CSAM Detection Policy Analysis - Whitney Champion, Kelley Wilds, Eric Capuano, Brian Greunke, and Matt Bromiley at Recon InfoSec
OpenSOC @ DEF CON 29 - SANS
- Kaya Overholtzer at ‘The Leahy Center for Digital Forensics & Cybersecurity’
The End: DFIR - Michael Hale Ligh at Volatility Labs
The 9th Annual Volatility Plugin Contest!
SOFTWARE UPDATES
- Cellebrite
Now Available: Cellebrite UFED and Cellebrite Responder 7.47 - CyberChef
v9.31.0 - Eric Zimmerman
ChangeLog - ExifTool
ExifTool 12.30 (production release) - Mihari
v3.5.0 - MISP
MISP 2.4.148 released (summer time release) - Regipy
Additional registry plugins - Sigma
sigmatools 0.20 - Xways
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 