As always, thanks to those who give a little back for their support!

FORENSIC ANALYSIS

• Digital Forensics Myanmar
  Window Forensics With EZ-Tools (Part 1+2)
  
  
• diyinfosec
  Why learning a Forensic Artifact matters?
  
  
• Elcomsoft
  • checkm8 Extraction of iPhone 8, 8 Plus and iPhone X
  • iPhone X, DFU mode and checkm8
    
    
• Simon Wong at Expel
  Attack trend alert: AWS-themed credential phishing technique
  
  
• Forensafe
  Investigating User Accounts
  
  
• Lee Whitfield at Forensic 4cast
  Mac Randomization in Windows
  
  
• Forensic-Research
  • [ART100] Digital Forensic Challenge 2019
  • [논문리뷰] IoT 기기 플래시 메모리의 Ext4 파일 시스템을 위한 디지털 포렌식 절차
    
    
• Alex Bilz
  Recovering WIFI SSIDs from Chromium’s Network Persistent State File
  
  
• Joshua I. James at DFIRScience
  • How to extract files from Cellebrite Reader UFDR for ALEAPP or iLEAPP
  • Convert UFDR to DIR
  • DFIR file-system POSIX gotcha – process from archives directly
    
    
• Koen Van Impe
  Integrate DFIR-IRIS, MISP and TimeSketch
  
  
• Melissa at Sketchymoose’s Blog
  Looking at some PwnKit PoCs for Fun
  
  
• Claudio Guarnieri
  A Primer On Android Forensics
  
  
• Oxygen Forensics
  Selective Data Analysis in Oxygen Forensic® Detective
  
  
• J0wir
  Cyberdefenders – DetectLog4j
  
  
• Antonio Sanz at Security Art Work
  • Los peligros de andar por las nubes: DFIR en O365 (I)
  • Los peligros de andar por las nubes : DFIR en O365 (II)
  • Los peligros de andar por las nubes : DFIR en O365 (III)
  • Los peligros de andar por las nubes: DFIR en O365 (IV)
  • Los peligros de andar por las nubes: DFIR en O365 (V)
    

THREAT INTELLIGENCE/HUNTING

• A. Boukar
  Host Header Injection Attacks
  
  
• Adam at Hexacorn
  Analysing NSRL data set for fun and because… curious
  
  
• Aon
  Microsoft 365: Identifying Mailbox Access
  
  
• Ian Schlesinger at AT&T Cybersecurity
  Stories from the SOC – WannaCry malware
  
  
• Avast Threat Labs
  • Avast Q4/21 Threat report
  • Analysis of Attack Against National Games of China Systems
    
    
• Bitdefender
  • Bitdefender Threat Debrief | January 2022
  • The Threat Intelligence Requirement
    
    
• Blackberry
  Threat Spotlight: WhisperGate Wiper Wreaks Havoc in Ukraine
  
  
• Erica Mixon at Blumira
  Why Email Forwarding Is a Security Risk (And How To Detect)
  
  
• Brad Duncan at Malware Traffic Analysis
  • 2022-01-27 – Contact Forms Campaign IcedID (Bokbot) with Cobalt Strike
  • 2022-02-04 – BazarLoader infection with Cobalt Strike
  • 2022-02-01 – Hancitor (Chanitor/MAN1/Moskalvzapoe/TA511) infection with Cobalt Strike
    
    
• Check Point Research
  31st January– Threat Intelligence Report
  
  
• Chris Carlson at Target
  Meet Merry Maker: How Target Protects Against Digital Skimming
  
  
• Cisco’s Talos
  • Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables
  • Arid Viper APT targets Palestine with new wave of politically themed phishing attacks, malware
  • Threat Roundup for January 28 to February 4
    
    
• CrowdStrike
  • CrowdStrike Falcon Proactively Protects Against Wiper Malware as CISA Warns U.S. Companies of Potential Attacks
  • Hunting pwnkit Local Privilege Escalation in Linux (CVE-2021-4034)
    
    
• Daniel Roberson at DMFR Security
  • 100 Days of YARA – Day 43: EfsPotato
  • 100 Days of YARA – Day 44: NirSoft LSA Secrets View
  • 100 Days of YARA – Day 45: Generic NirSoft Tools
  • 100 Days of YARA – Day 46: NirSoft MailPassView
  • 100 Days of YARA – Day 47: Private Keys
  • 100 Days of YARA – Day 48: gscript
  • 100 Days of YARA – Day 49: RC4
    
    
• Kevin Libby at DomainTools
  New Phone, Who Dat?
  
  
• Elastic Security Research
  Sandboxing Antimalware Products for Fun and Profit
  
  
• Esentire
  Remcos RAT
  
  
• ghost$
  Discord Payload Recon
  
  
• Michael Lazic at Gigamon
  Investigating Lateral Movement — WMI and Scheduled Tasks
  
  
• Hacking Articles
  • Linux Privilege Escalation: Polkit (CVE 2021-3560)
  • Domain Persistence: Computer Accounts
    
    
• Jeffrey Appel
  Protect against AzueAD OAuth Consent phishing attempts (Illicit consent attack)
  
  
• Andy Young at Keysight
  Here we BotenaGo Again!
  
  
• Mandiant
  • 1 in 7 Ransomware Extortion Attacks Leak Critical Operational Technology Information
  • Zoom For You — SEO Poisoning to Distribute BATLOADER and Atera Agent
    
    
• Microsoft Security
  • Cyber Signals: Defending against cyber threats with the latest research, insights, and trends
  • ACTINIUM targets Ukrainian organizations
    
    
• Mike at “CyberSec & Ramen”
  Shortcut to Windows Update
  
  
• Amy L. Robertson at MITRE ATT&CK
  ATT&CK 2022 Roadmap
  
  
• Musings of a Rube Goldberg blog machine
  Synapse PE Exports
  
  
• Nasreddine Bencherchali
  Why Hunting For LOLBINs Is One Of The Best Bets
  
  
• Nextron Systems
  Antivirus Event Analysis Cheat Sheet v1.9.0
  
  
• Nik Alleyne at ‘Security Nik’
  • Powershell Empire – Detection with Snort3
  • Powershell Empire – Detection with Zeek
  • Beginning PowerShell Empire – Packet Analysis
  • Beginning Powershell Empire – The Attack in 10 steps
  • Beginning PowerShell Empire – Log Analysis
    
    
• Palo Alto Networks
  Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
  
  
• Penetration Testing Lab
  Domain Escalation – Machine Accounts
  
  
• Pepe Berba
  • Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cron
  • Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configuration
    
    
• Recorded Future
  • A New Cyber Insurance Model: Continuous Control Validation
  • ISO 27002 and Threat Intelligence: The New Security Standard
    
    
• SANS Internet Storm Center
  • YARA’s Console Module, (Sun, Jan 30th)
  • Be careful with RPMSG files, (Mon, Jan 31st)
  • Automation is Nice But Don’t Replace Your Knowledge, (Tue, Feb 1st)
  • Finding elFinder: Who is looking for your files?, (Wed, Feb 2nd)
  • Keeping Track of Your Attack Surface for Cheap, (Thu, Feb 3rd)
  • Power over Ethernet and Thermal Imaging, (Sat, Feb 5th)
    
    
• Security Investigation
  • Web Malware Removal | How to Remove Malware From My Website?
  • Most Common Malware Obfuscation Techniques
  • How You Deal With A Data Breach Crisis Can Determine Everything
  • How to Remove Database Malware from Your Website
    
    
• Pedro Tavares at Segurança Informática
  Taking the bait: The modus operandi of massive social engineering waves impacting banks in Portugal
  
  
• Seongsu Park
  Ransomware Playbook
  
  
• Sophos
  • Log4Shell: How the Attackers’ Faces Have Changed Over Time
  • SolarMarker campaign used novel registry changes to establish persistence
    
    
• Cody Thomas at SpecterOps
  Mythic 2.3 — An Interface Reborn
  
  
• Ben Martin at Sucuri
  WooCommerce Skimmer Uses Fake Fonts and Favicon to Steal CC Details
  
  
• Symantec Enterprise
  • Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
  • Antlion: Chinese APT Uses Custom Backdoor to Target Financial Institutions in Taiwan
    
    
• Tareq Alkhatib
  Finding Inconsistencies In MITRE ATT&CK Data Sources
  
  
• Josh Hopkins at Team Cymru
  Expert Analyst Insight into North Korean ‘Internet Outages’
  
  
• Jean-Francois Maes at TrustedSec
  I’m bringing relaying back: A comprehensive guide on relaying anno 2022
  
  
• Tyson Supasatit at Uptycs
  What is MITRE D3FEND and How Should My Organization Use It?
  
  
• Varonis
  • Using Power Automate for Covert Data Exfiltration in Microsoft 365
  • Ransomware Year in Review 2021
    
    
• Steven Adair and Thomas Lancaster at Volexity
  Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
  

UPCOMING EVENTS

• Belkasoft
  [WEBINAR] Down The Rabbit Hole: Carving and its Implementations in Digital Forensics
  
  
• SANS
  Network Forensics: Tools of the Trade… At Scale and on a Budget
  
  
• Securizame
  NOTICIAS SECURÍZAME – EVENTOS Y FORMACIÓN DE FEBRERO 2022
  

PRESENTATIONS/PODCASTS

• Archan Choudhury at BlackPerl
  Incident Response Training, How to Remove Malware- Day 19, Automate Linux Analysis
  
  
• Black Hat
  Black Hat Europe 2021
  
  
• Black Hills Information Security
  • BHIS | How to Deliver Payloads in an Enterprise Attack with Steve Borosh | 1-Hour
  • Talkin’ About Infosec News – 2/4/2022
    
    
• Breaking Badness
  110. A Sad State of Malwares
  
  
• Chewing the FAT
  Episode 9
  
  
• Cyan Forensics
  Cyan launches new Podcast with Sir Mark Rowley as its first guest
  
  
• CYBERWARCON
  CYBERWARCON 2021
  
  
• Day Cyberwox
  TOP 2 Cybersecurity Certifications for Aspiring Cybersecurity Analysts
  
  
• Detection: Challenging Paradigms
  S2 – Episode 8: Ryan Hausknecht
  
  
• Joshua I. James at DFIRScience
  • Digital Forensic Scientist Reacts: Criminal Minds S01E01 – Extreme Aggressor
  • Log4j vulnerability, supply chain attacks and SBOMs
    
    
• Dump-Guy Trickster
  IDAPro Reversing Delphi MBR Wiper and Infected Bootstrap Code
  
  
• Gerald Auger at Simply Cyber
  My Day to Day Malware Analysis Tool, Intezer Analyze, Overview
  
  
• Hasherezade
  Adding imports list dumped by PE-sieve into IDA (with IFL plugin)
  
  
• Heather and Roxy at Hurricane Labs
  SOC Talk: Malware on USB
  
  
• InfoSec_Bret
  IR – SOC145-103 – Ransomware Detected
  
  
• John Hammond
  Let’s Write Golang
  
  
• Karsten Hahn at Malware Analysis For Hedgehogs
  Demo – Fake Antivirus Alerts in Edge browser notifications
  
  
• Magnet Forensics
  Introducing Magnet AUTOMATE Enterprise
  
  
• NTCore
  .NET BinaryFormatter Encoded Payload Extraction
  
  
• OALabs
  How To Unpack VMProtect 3 (x64) Night Sky Ransomware With VMPDump [Patreon Unlocked]
  
  
• Radware
  Threat Researchers Live: Ep 18
  
  
• Richard Davis at 13Cubed
  Puzzling RDP Cache – Putting the Pieces Together
  
  
• SANS
  • Master the fundamentals with SEC301 Introduction to Cyber Security
  • A Conversation: Brilliant Minds of Cyber
    
    
• Sumuri
  New RECON LAB Add Source Menu
  
  
• This Week In 4n6
  This Month In 4n6 – January – 2022
  
  
• Watson Infosec
  pfSense LAB & Real World Build
  
  
• X-Force
  Analyzing PowerShell Payloads – Part 6
  
  
• Zeek in Action
  • Zeek in Action, Video 11, Using Spicy Driver
  • Zeek In Action, Video 12, zeek2es
    

MALWARE

• 3xp0rt
  Mars Stealer: Oski refactoring
  
  
• Alexandre Borges at ‘Exploit Reversing’
  Malware Analysis Series (MAS) – Article 2
  
  
• Any.Run
  ANY.RUN brings a New Technology for Instant Malware Analysis
  
  
• Cado Security
  CoinStomp Malware Family Targets Asian Cloud Service Providers
  
  
• Changalamaadan
  Practical Malware Analysis Lab Part — I
  
  
• Cyber Geeks
  A detailed analysis of Lazarus APT malware disguised as Notepad++ Shell Extension
  
  
• Cybereason
  • StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations
  • PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage
    
    
• Erik Hjelmvik at Netresec
  PolarProxy in Windows Sandbox
  
  
• Jim Richberg at Fortinet
  Cybercriminals Seek Ransomware Payments and Settlements
  
  
• Igor Skochinsky at Hex Rays
  Igor’s tip of the week #75: Working with unions
  
  
• Yuta Fuchikami at JPCERT/CC
  FAQ: Malware that Targets Mobile Devices and How to Protect Them
  
  
• Kiran Raj at McAfee Labs
  Emotet’s Uncommon Approach of Masking IP Addresses
  
  
• Microsoft Security
  The evolution of a Mac trojan: UpdateAgent’s progression
  
  
• Matt Lewis at NCC Group
  Machine Learning for Static Analysis of Malware – Expansion of Research Scope
  
  
• Sebdraven
  WhisperKill vs WhiteBlackCrypt: un petit soucis de fichiers…
  
  
• Security Intelligence
  • Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data
  • TrickBot Gang Uses Template-Based Metaprogramming in Bazar Malware
    
    
• Security Onion
  • Quick Malware Analysis: Contact Forms Campaign IcedID Bokbot with Cobalt Strike pcap from 2022-01-27
  • Quick Malware Analysis: Hancitor and Cobalt Strike pcap from 2022-02-01
    
    
• Phil Stokes at SentinelOne
  Sneaky Spies and Backdoor RATs | SysJoker and DazzleSpy Malware Target macOS
  
  
• Threat Lab Indonesia
  Phishing and Spam Malware Emotet Analysis
  
  
• Tony Lambert
  • STRRAT Attached to a MSI File
  • njRAT Installed from a MSI
    
    
• Alfredo de Oliveira at Trend Micro
  Cryptojacking Attacks Target Alibaba ECS Instances
  
  
• Joshua Platt, Jonathan Mccay and Jason Reaves at Walmart
  Sugar Ransomware, a new RaaS
  

MISCELLANEOUS

• Andrew Rathbun and Eric Zimmerman at Kroll
  KAPE Quarterly Update – Q4 2021
  
  
• Martino Jerian at Amped
  An Interview With Paul Hopcroft From Nottinghamshire Police, UK
  
  
• Belkasoft
  5 Bloopers of a Digital Forensic Investigator
  
  
• Coveware
  Law enforcement pressure forces ransomware groups to refine tactics in Q4 2021
  
  
• DFIR.Training
  • SESSION 1:    X-Ways Forensics Practitioner’s Guide/2E Online Course
  • X-Ways Forensics Practitioner’s Guide/2E Online Course
  • Surviving and Thriving in DFIR
  • Level Up!
    
    
• Joshua I. James at DFIRScience
  Is there a difference between Digital Forensic Investigation Method and Digital Forensic Technique?
  
  
• Robert M. Lee at Dragos
  What to Expect When Interviewing at Dragos: Lessons Learned for You and Other Employers
  
  
• Robert Graham at Errata Security
  No, a researcher didn’t find Olympics app spying on you
  
  
• Forensic Focus
  • Is More Efficient, Accessible Memory Forensics Possible?
  • Behavioral-Based Forensics and Investigation Approach for Analyzing Attacks on Water Plants Using GANs
  • Passware Kit Forensic T2 Add-on: The First Password Recovery Tool for Macs With T2 Chips
  • JTAG-Based Memory Acquisition Framework
    
    
• Kevin Pagano at Stark 4N6
  Forensics StartMe Updates (2/1/2022)
  
  
• LimaCharlie
  Collect & Monitor Telemetry From Any Source
  
  
• Karen Sprenger at LMG Security
  8 Crucial Incident Response Steps
  
  
• Magnet Forensics
  • DVR Examiner: Forensic Images for DVR Analysis – E01 or DD
  • Evidence Management Software: How to Share Cases Remotely with Magnet REVIEW
  • New Reporting Features in DVR Examiner
    
    
• Carlos Canto at Rapid7
  Velociraptor Version 0.6.3: Dig Deeper With More Speed and Scalability
  
  
• Ryan Campbell at ‘Security Soup’
  Weekly News Roundup — January 30 to February 5
  

SOFTWARE UPDATES

• Amped
  Authenticate Update 23481: Improved Variation of Prediction Footprint Analysis and More
  
  
• Brian Maloney
  OneDriveExplorer
  
  
• DFIRTrack
  v2.4.1
  
  
• Elcomsoft
  Elcomsoft iOS Forensic Toolkit 8.0 beta 4: forensically sound checkm8 extraction of iPhone 8, 8 Plus and iPhone X
  
  
• Eric Zimmerman
  ChangeLog
  
  
• Fernando Mercês
  entropy
  
  
• Foxton Forensics
  Browser History Examiner — Version History – 1.16.7
  
  
• Magnet Forensics
  Introducing Magnet AUTOMATE Enterprise
  
  
• MantaRay Forensics
  2021 Q4 VirusShare Update 01
  
  
• Maxim Suhanov
  dfir_ntfs 1.1.8
  
  
• MISP
  MISP 2.4.153 released with improvements and bugs fixes
  
  
• OSForensics
  V9.1 Build 1009 3rd February 2022
  
  
• radare2
  5.6.0 – codename Miteigi
  
  
• Security Onion
  Security Onion 2.3.100 20220203 Hotfix Now Available!
  
  
• Srum-Dump
  2.4 Kayak
  
  
• Ulf Frisk
  MemProcFS Version 4.7
  

And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!