As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- 4Discovery
The Forged PDF - ADEO Cyber Security Services
Chupacabra Digital Forensic Training Set 2022 by ADEO DFIR Team - Angry-Bender’s blog house
- Yulia Samoteykina at Atola
RAID imaging made easy with Atola TaskForce - Cellebrite
The Small Agency Guide to Modernizing Investigations - Dan Maunz at Cisco
Cisco StarOS Forensic Guide Published - Forensafe
Investigating Timezone Information - Kevin Pagano at Stark 4N6
Check Marks the Spot – Google Tasks from Takeout - Kyle Song
Blog #34: How to Decrypt Spycam Full Disk Encryption - Magnet Forensics
Collecting Google Drive Activity in Magnet AXIOM Cyber - Lauren Podber and Stef Rand at Red Canary
Raspberry Robin gets the worm early
THREAT INTELLIGENCE/HUNTING
- Ahmed Musaad
Stream Okta Logs To Your Log Collector - Francis Guibernau and Jackson Wells at AttackIQ
Attack Graph Response to UNC1151 Continued Targeting of Ukraine - Avast Threat Labs
Avast Q1/2022 Threat Report - Marshall Jones at AWS Security
How to use new Amazon GuardDuty EKS Protection findings - Blackberry
- BleepingComputer
- Brad Duncan at Malware Traffic Analysis
2022-05-03 – Contact Forms campaign –> Bumblebee –> Cobalt Strike - BushidoToken
Gamer Cheater Hacker Spy - CERT Ukraine
- Масове розповсюдження шкідливої програми JesterStealer з використанням тематики хімічної атаки (CERT-UA#4625)
- Cyberattack by the APT28 group using CredoMap_v2 malware (CERT-UA#4622)
- Кібератака групи APT28 із застосуванням шкідливої програми CredoMap_v2 (CERT-UA#4622)
- Mass distribution of JesterStealer malware exploiting the topic of chemical attack (CERT-UA#4625)
- CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 30 aprile – 06 maggio 2022 - Check Point Research
2nd May – Threat Intelligence Report - Cisco
Detecting Targeted Attacks on Public Cloud Services with Cisco Secure Cloud Analytics - Cisco’s Talos
- Cofense
- Sven Defatsch at Compass Security
BloodHound Inner Workings & Limitations – Part 1: User Rights Enumeration Through SAMR & GPOLocalGroup - Richard Bejtlich at Corelight
Network evidence for defensible disclosure - Coveware
Ransomware Threat Actors Pivot from Big Game to Big Shame Hunting - CrowdStrike
- Cybereason
- Cyberknow
Update 13. 2022 Russia-Ukraine war — Cyber group tracker. May 1. - Cyble
Water and Wastewater treatment facilities vulnerable to Cyber Attacks - Cyborg Security
Cyber Threat Hunting – What Is It, Really? - Ivan Righi at Digital Shadows
ALPHV: The First Rust-Based Ransomware - DomainTools
A Sticky Situation Part 1: The Pervasive Nature of Credit Card Skimmers - Dosxuz
Poor Man’s Threat Hunting - Abdulrahman H. Alamri at Dragos
Dragos ICS/OT Ransomware Analysis: Q1 2022 - EclecticIQ
The Analyst Prompt #08: EclecticIQ Data Show Emotet Gained Momentum in Recent Months - Esentire
AsyncRAT Activity - F-secure
Scheduled Task Tampering - Formobile
Mobile Forensics – The File Format Handbook - Axelle Apvrille at Fortinet
Warning: GRIM and Magnus Android Botnets are Underground - Gemini Advisory
Russian Invasion of Ukraine and Sanctions Portend Rise in Card Fraud - Billy Leonard at Google Threat Analysis Group
Update on cyber activity in Eastern Europe - Hardik Manocha at Fourcore
The Curious Case Of Mavinject.Exe - Dray Agha at Huntress
What Is Defense Evasion? - InfoSec Write-ups
The ABCs of Kerberoasting - Intel471
Cybercrime loves company: Conti cooperated with other ransomware gangs - Jeffrey Appel
Detect and block Credential Dumps with Defender for Endpoint & Attack Surface Reduction - Kevin Beaumont at DoublePulsar
BPFDoor — an active Chinese global surveillance tool - Malwarebytes Labs
- Mandiant
- Michael Matthews and Nikolaos Pantazopoulos at NCC Group
North Korea’s Lazarus: their initial access trade-craft using social media and social engineering - Paolo Passeri at Netskope
Cloud Threats Memo: What We Can Learn From the Top 15 Routinely Exploited Threats of 2021 - Daniel Russell at ParaFlare
BlackCat Detection Development, file exclusion of *.exe in Microsoft Defender Endpoint - Phil Keeble at Nettitude Labs
- PhishLabs
Why BitB Attacks are Concerning - Nathan Sportsman at Praetorian
Computer Account Relaying Vulnerabilities Part 2 - Kelsey Merriman And Pim Trouerbach at Proofpoint
This isn’t Optimus Prime’s Bumblebee but it’s Still Transforming - Swapnil Ahirrao at Qualys
Ransomware Insights from the FBI’s 2021 Internet Crime Report - Recorded Future
- Red Alert
Monthly Threat Actor Group Intelligence Report, March 2022 (KOR) - RiskIQ
RiskIQ Threat Intelligence Roundup: Phishing, Botnets, and Hijacked Infrastructure - Ryan Hausknecht
Azure Virtual Machine Execution Techniques - Sandfly Security
Security Monitoring for Threats on Embedded Linux - SANS Internet Storm Center
- Detecting VSTO Office Files With ExifTool, (Mon, May 2nd)
- Some Honeypot Updates, (Tue, May 3rd)
- Finding the Real “Last Patched” Day (Interim Version), (Tue, May 3rd)
- Password-protected Excel spreadsheet pushes Remcos RAT, (Thu, May 5th)
- What is the simplest malware in the world?, (Fri, May 6th)
- Phishing PDF Received in my ISC Mailbox, (Sat, May 7th)
- Tim Schulz and Christopher Peacock at Scythe
SCYTHE Presents: Adaptive Emulation (Part 2): Execution Methods - Denis Legezo at Securelist
A new secret stash for “fileless” malware - Dominik Sowinski at Security Intelligence
The Growing Danger of Data Exfiltration by Third-Party Web Scripts - Security Investigation
- Rajan Sanhotra at Sophos
Getting started with threat hunting: five steps to support successful outcomes - Splunk
CI/CD Detection Engineering: Dockerizing for Scale, Part 4 - Sucuri
- Sysdig
- Joshua Picolet at Team Cymru
Sliver Case Study: Assessing Common Offensive Security Tools - Trellix
Trellix Threat Labs Research Report: April 2022 - Uptycs
Vulnerable Docker Installations Are A Playhouse for Malware Attacks - Rob Sobers at Varonis
Bad Rabbit Ransomware - Roger Park at VMware Security
Infographic – Exposing Malware in Linux-Based Multi-Cloud Environments
UPCOMING EVENTS
- Cybereason
- Greynoise
GreyNoise 101 - Hacker Valley Blue
Hacker Valley Studio – Beyond Gold with Simone Biles - Magnet Forensics
- SANS
- Doug Burks at Security Onion
Security Onion Conference 2022 Save the Date and CFP
PRESENTATIONS/PODCASTS
- Archan Choudhury at BlackPerl
Threat Hunting Tutorial- Day 6, APT39 Hunting using Splunk - Arman Gungor at Metaspike
Email Forensics Workshop 2022 CTF Solution - BlueMonkey 4n6
Magnet Virtual Summit Capture The Flag 2022 – Egg Hunt! - Brakeing Down Security Podcast
Mick Douglas on threat intel, customer worries about being hacked, and more - Breaking Badness
119. A Steaming Cup of Malicious Javascript - Heather Mahalik at Cellebrite
- Check Point Research
Inside Russia’s Biggest Ransomware Operation - Cloud Security Podcast by Google
EP63 State of Autonomic Security Operations: Are There Sharks in Your SOC with Robert Herjavec - Countercraft
What is MITRE Engage and How to Use It | Founder Chat - Cybereason
Malicious Life Podcast: Operation Sundevil and the Birth of the EFF - Day Cyberwox
- Digital Forensic Survival Podcast
DFSP # 324 – Malware Triage Part 1 - InfoSec_Bret
CyberDefenders – GetPDF - Justin Tolman at AccessData
- Magnet Forensics
- SANS Cloud Security
Building a Cloud Security Roadmap in 2022 - SANS Institute
- New2Cyber Catch-22: Getting Experience When You Have No Experience
- Why I’m Encouraged to BARF at Work
- You’ve Got This: Success Stories Panel
- Taking the Plunge: Advice from People Who Literally Wrote the Book on Cybersecurity Careers Panel
- Analysis 101 for the Incident Responder
- Don’t Get Popped: Vulnerability Management Do’s and Don’ts
- Sumuri
- The Defender’s Advantage Podcast
Threat Trends: UNC3524 – Eye Spy on Your Email - The Ransomware Files
Ryuk’s Rampage - WeLiveSecurity
MALWARE
- Alexandre Borges at ‘Exploit Reversing’
Malware Analysis Series (MAS) – Article 3 - Fernando Martinez at AT&T Cybersecurity
Analysis on recent wiper attacks: examples and how wiper malware works - ASEC
- Avertium
An In-Depth Look at Ragnar Locker Ransomware - Cluster25
The strange link between a destructive malware and a ransomware-gang linked custom loader: IsaacWiper vs Vatet - Cyble
- Elastic
Deep dive on the BLISTER loader - Gergely Revay at Fortinet
Unpacking Python Executables on Windows and Linux - Drew Schmitt at GuidePoint Security
How to Peel a PowerShell Onion: A Bloodhound Case Study - Patrick Schläpfer at HP Wolf Security
Tips for Automating IOC Extraction from GootLoader, a Changing JavaScript Malware - Igor Skochinsky at Hex Rays
Igor’s tip of the week #88: Character operand type and stack strings - Barak Aharoni at InfoSec Write-ups
Shellcode Analysis - Mahmoud Morsy
- Malvuln
- Ransom CTBLocker – Code Execution Vulnerability PoC
- Trojan Ransom LockerGoga – Code Execution Vulnerability
- Trojan Ransom.Cerber – Code Execution Vulnerability
- Trojan-Ransom.CryptoWall – Code Execution Vulnerability
- Ransom Petya Code – Execution Vulnerability
- Trojan Ransom Radamant – Code Execution Vulnerability
- Ransom Cryakl – Code Execution Vulnerability
- Trojan CryptoLocker – Code Execution Vulnerability
- Ransomware Conti – Code Execution Vulnerability
- Ransom Satana – Code Execution Vulnerability
- McAfee Labs
- Natalie Zargarov at Minerva Labs
- Muhammad Hasan Ali
MS Word to drop Remcos - Gustavo Palazolo at Netskope
Emotet: New Delivery Mechanism to Bypass VBA Protection - OALABS Research
- Chris Navarrete, Durgesh Sangvikar, Yu Fu, Yanhui Jia and Siddhart Shibiraj
Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding - Pete Cowman at Hatching
SAML Release and Family Updates - Igor Golovin at Securelist
Mobile subscription Trojans and their little tricks - Security Onion
- Quick Malware Analysis: Hancitor with Cobalt Strike and Mars Stealer pcap from 2022-03-21
- Quick Malware Analysis: MetaStealer pcap from 2022-04-06
- Quick Malware Analysis: Qakbot, Cobalt Strike, and VNC pcap from 2022-03-16
- Quick Malware Analysis: Contact Forms Campaign, Bumblebee, and Cobalt Strike pcap from 2022-05-03
- Quick Malware Analysis: Trickbot pcap from 2020-05-28
- Joey Chen and Amitai Ben Shushan Ehrlich at SentinelLabs
Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad - Andreas Klopsch at Sophos
Attacking Emotet’s Control Flow Flattening - Trend Micro
- Nathan Noll at TrustedSec
ELFLoader: Another In Memory Loader Post - VMRay
VMRay Analyzer 4.5 Feature Highlight – Malware Configuration Extraction - Yoroi
Yoroi ha scoperto una serie di attacchi che stanno infettando le aziende manifatturiere italiane con finti documenti Microsoft Office ed Excel attraverso la botnet Dridex - Javier Vicente and Brett Stone-Gross at ZScaler
Analysis of BlackByte Ransomware’s Go-Based Variants - Claroty
Fundamental Building Blocks for Secure Operations and Critical Infrastructure - Salvation DATA
MISCELLANEOUS
- Alican Kiraz
Incident Response Part 3.1: Containment |EN - Emi Polito at Amped
The Answers To Your Amped FIVE Questions - Atropos4n6
My 2022 Forensic 4cast (@4cast) nominations - Cassie Doemel at AboutDFIR
AboutDFIR Site Content Update 5/7/22 - CrowdStrike
Start Logging Everything: Humio Community Edition Series - Cyberwox Academy
Intro to Threat Detection with YARA - Darkdefender
Writing : Getting Started - Doug Metz at Baker Street Forensics
Play it Again Sam – A Recap of MUS 2022 - Oleg Afonin at Elcomsoft
Identifying the iPhone Model - Forensic Focus
- How to Quickly Acquire and Analyze Media Data Evidence at the Crime Scene
- FTK Imager 100 One-Day Course From Exterro
- Digital Forensics Challenge 2022 (DFC 2022)
- Magnet Forensics Acquires Cybersecurity Software Firm Comae Technologies
- Exterro Enhances DFIR Automation with Major Upgrades to FTK Connect
- Kevin Pagano at Stark 4N6
Forensics StartMe Updates (5/1/2022) - Magnet Forensics
- Vasu Jakkal at Microsoft Security
Microsoft launches Defender for Business to help protect small and medium businesses - Morphisec
MITRE ATT&CK Evaluation: Reading Between the Lines - MSAB
MSAB part of new European standard for mobile forensics - lightkunyagami
Security Blue Team: More Than Just a Cyber Defender Company, But Also a Mental Health Defender - Raj Munusamy at OpenText
The growing need for digital forensic investigators - Oxygen Forensics
- Brittany Roberts at ADF
ADF Supported Web Browsers ft. Chromium Based Browsers - Ryan Campbell at ‘Security Soup’
- SANS
- Mohammed Hussein at The Leahy Center for Digital Forensics & Cybersecurity
Mohammed Hussein: Building a Cyber Range
SOFTWARE UPDATES
- AccessData
Forensic Tools 7.5.2 - Apache
Tika – Release 2.4.0 – 04/23/2022 - c3rb3ru5
Binlex v1.1.1-rc1 - Erik Pistelli at Cerbero
MalwareBazaar Intelligence - Didier Stevens
- Grayshift
Grayshift Accelerates GrayKey Innovation for Android Devices and Enhances Market Leadership in Mobile Device Digital Forensics - Hashlookup
hashlookup-forensic-analyser version 1.0 released - IntelOwl
v3.4.0 - Magnet Forensics
- Metaspike
Forensic Email Collector (FEC) Changelog – v3.70.1.8 - Ninoseki
Mihari v4.5.2 - Paraben Corporation
E3 Forensic Platform Version 3.2 Released - Sandfly Security
Sandfly 3.3 – Reporting, SSO, Veracode Certified, Suspicious IP Detection and More - Semantics21
LASERi updates
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 