As always, thanks to those who give a little back for their support!
FORENSIC ANALYSIS
- Axelarator
Cloud Recon - Belkasoft
Belkasoft CTF July 2022: Write-up - Carlos at Carlos Cajigas at ‘Mash That Key’
Velociraptor Playground 2022-08-02 - Cloudbrothers
Update to the Hitchhiker’s Guide to Microsoft Defender for Endpoint exclusions - Cyber Triage
What is a Windows OpenSave MRU Artifact? - Yogesh Khatri at DFRWS
DFRWS APAC 2022 Call for participation - Elcomsoft
- Forensafe
Investigating Cisco Webex Meetings - Forensic Focus
Deep dive into ‘METADATA’ - InfoSec Write-ups
- Magnet Forensics
Forensic Analysis of MUICache Files in Windows - Md. Abdullah Al Mamun
35k GitHub Forked Repo With Malware - Mike Cohen at Rapid7
Postprocessing Collections - Muhammed Aygün
- Nashid P
[CTF] UACTF 2022 – Forensics - Nicholas Dubois at Hexordia
Creating a Full File System image from a jailbroken iOS device
THREAT INTELLIGENCE/HUNTING
- Anomali
Anomali Cyber Watch: Velvet Chollima Steals Emails from Browsers, Austrian Mercenary Leverages Zero-Days, China-Sponsored Group Uses CosmicStrand UEFI Firmware Rootkit, and More - Andrew Cormack at APNIC
Incident response lessons from FIRSTCON22 - Ken Towne at AttackIQ
Malware Emulation Attack Graph for SysJoker’s Linux Variant - Blackberry
- BushidoToken
Space Invaders: Cyber Threats That Are Out Of This World - Himaja Motheram at Censys
Finding Hacked Web Servers with Censys Search Data 🔎 - CERT-AGID
Sintesi riepilogativa delle campagne malevole nella settimana del 30 luglio – 05 agosto 2022 - Check Point Research
- Cisco’s Talos
- Reza Rafati at Cyberwarzone
Taking a look at TikTok Phishing pages on URLscan - Cyble
- Ian Thornton-Trump at Cyjax
The Big Myth of Ransomware - Dylan Hinz and Gabriel Few-Wiegratz at Darktrace
Exploring the Dangers of Remote Access Tools - EclecticIQ
- Elastic
Protections Artifacts - Esentire
MD(I)R: Why Investigation is the Invisible ‘I’ in MDR - Kyle Pellett at Expel
A defender’s MITRE ATT&CK cheat sheet for Google Cloud Platform (GCP) - First
TRAFFIC LIGHT PROTOCOL (TLP) – FIRST Standards Definitions and Usage Guidance — Version 2.0 - Aaron Stratton at InfoSec Write-ups
Malware Traffic Analysis Exercise | Burnincandle | IcedID Malware - Roger Kay at INKY
Phishers Bounce Lures Off Unprotected Snapchat, Amex Sites - Institute for Security + Technology
Ransomware Task Force Releases Blueprint for Ransomware Defense - Intel471
Why cybercriminals are flocking to Telegram - Ryan Robinson at Intezer
Detection Rules for Lightning Framework (and How to Make Them With Osquery) - Lina Lau at Inversecos
Detecting Linux Anti-Forensics: Timestomping - Malwarebytes Labs
Ransomware review: July 2022 - Mandiant
- MDSec
- Microsoft
Azure Threat Research Matrix - Microsoft Security
Microsoft Defender Experts for Hunting proactively hunts threats - Nasreddine Bencherchali
Behind The Detection — Schtasks - Michael Mathews at NCC Group
Top of the Pops: Three common ransomware entry techniques - NSFOCUS Threat Intelligence
Analysis of APT32 Organization’s Attack Activities on my country’s Guanji Units - Dan O’Day at Palo Alto Networks
Today’s Cyberthreats: Ransomware, BEC Continue to Disrupt - Brad Duncan at Palo Alto Networks
Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware - pat_h/to/file
Commandline Cloaking 2 – Tetragon and Nim - John Wilson at PhishLabs
The “I’s” Have It: How BEC Scammers Validate New Targets with Blank Emails - Harshal Tupsamudre at Qualys
Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor - Jake Baines at Rapid7
QNAP Poisoned XML Command Injection (Silently Patched) - Recorded Future
- Thomas Gardner at Red Canary
How process streams can help you detect Linux threats - Joseph Edwards at ReversingLabs
GwisinLocker ransomware targets South Korean industrial and pharma firms - SANS Internet Storm Center
- Alexander Gutnikov, Oleg Kupreev, and Yaroslav Shmelev at Securelist
DDoS attacks in Q2 2022 - Security Investigation
- Pedro Tavares at Segurança Informática
How to build a hook syscall detector - Aleksandar Milenkoski and Jim Walter at SentinelLabs
Who Needs Macros? | Threat Actors Pivot to Abusing Explorer and Other LOLBins via Windows Shortcuts - Michael Kavka at Silicon Shecky
Defender, KQL and Lockbit - SOC Fortress
SOCFortress Attack Simulator - Ax Sharma at Sonatype
Ransomware in PyPI: Sonatype Spots ‘Requests’ Typosquats - Yusuf Polat at Sophos
Genesis Brings Polish to Stolen-Credential Marketplaces - Jared Atkinson at SpecterOps
On Detection: Tactical to Functional - Tanium
New Report Reveals Commodity Malware Surpasses Ransomware: Cyber Threat Intelligence Roundup - Tareq Alkhatib
How To Objectively Measure A Detection Rule’s Strength - Trustwave SpiderLabs
The Price Cybercriminals Charge for Stolen Data - Vicente Díaz at VirusTotal
Deception at a scale - Xorhex
YARA – Following FALLCHILL’s E8 Call
UPCOMING EVENTS
- CCL Solutions
Webinar: SPEKTOR Ultra and MOBILedit - Cellebrite
Cellebrite UFED Cloud: Private and Public Extractions Pt. 2 - Elan at DFIR Diva
DFIR & Cybersecurity Events are Back! - Magnet Forensics
- PhishLabs
- SANS Cloud Security
Free, Virtual, Half-Day, Multi-Lingual SANS 2022 Cloud Security Exchange - Security heroes wear blue capes
How to conduct a forensic investigation of a compromised employee workstation
PRESENTATIONS/PODCASTS
- Archan Choudhury at BlackPerl
Threat Hunting Tutorial- Day 11, Hunting Process Creation with Splunk - Arsenal Recon
Arsenal Image Mounter v3.9.217 – DPAPI Bypass – Magnet CTF 2020 - AttackIQ
How to Test Your Defenses Against Personalized Top 10 MITRE ATT&CK Techniques - Black Hills Information Security
- Heather Mahalik at Cellebrite
- How To Get the Most from The Cellebrite Community Portal – Part 1
- How to Vote for Cellebrite in the Forensic 4:cast Awards
- How to Use the New File System View in Physical Analyzer Ultra
- How to Create a New Lab Submission in Cellebrite Guardian – Part 2
- How to Create a New Lab Submission in Cellebrite Guardian – Part 1
- How To Use The Open Advanced Feature In Cellebrite Physical Analyzer
- Check Point Research
Check Point’s 2022 Mid-Year Cyber Attack Trends report - Cloud Security Podcast by Google
EP77 Operational Realities of SOAR: Automate and/or Enrich, Playbooks, Magic - Cybereason
Malicious Life Podcast: Andrew Ginter – A 40-Year-Old Backdoor - Detections by SpectreOps
Episode 25: Mehmet Ergene - Digital Forensic Survival Podcast
DFSP # 337 – ResponderCon - D3pak
Threat Intelligence - Forensic Focus
Knock, Knock, Log: Threat Analysis, Detection & Mitigation of Covert Channels in Syslog Using Port Scans as Cover - InfoSec_Bret
DFIR – Investigate Web Attack - John Hubbard at ‘The Blueprint podcast’
Corissa Koopmans and Mark Morowczynski: Azure AD Threat Detection and Logging - Magnet Forensics
Putting Your DFIR Lab in the Cloud: Lessons Learned - MISP
Past MISP-related events - NTCore
Blitz 37 Seconds XLS Malware Payload Extraction - NVISO Belgium
Ear to the Ground – How to Find Digital Risks Before They Become Threats - OALabs
Vulnerable Antivirus Driver Used by Ransomware – We Reverse Engineer How!!? - Richard Davis at 13Cubed
MemProcFS – This Changes Everything - SANS Institute
The R Word: Retelling the Recent Rise and Resurgence of Resilient Ransomware-as-a-Service Operators - The Defender’s Advantage Podcast
Frontline Stories: Shields Up, Mandiant - The Ransomware Files
Dr. Ransomware, Part 2 - Uptycs
osquery@scale Best Of: Cloud Security
MALWARE
- ASEC
- Word File Provided as External Link When Replying to Attacker’s Email (Kimsuky)
- Malicious CHM Being Distributed to Korean Universities
- ASEC Weekly Malware Statistics (July 18th, 2022 – July 24th, 2022)
- Phishing Email Disguised as Korean Web Portal Page (Daum)
- AppleSeed Being Distributed to Maintenance Company of Military Bases
- Attackers Profiting from Proxyware
- ASEC Weekly Malware Statistics (July 25th, 2022 – July 31st, 2022)
- Gwisin Ransomware Targeting Korean Companies
- Erik Pistelli at Cerbero
Video: Blitz XLS Malware Payload Extraction - Giulian Guran at Certitude
Bypass phishing detections with Google Translate - Anandeshwar Unnikrishnan at CloudSEK
Technical Analysis of Bumblebee Malware Loader - Daji and Suqitian at 360 Netlab
A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information - Joseph Moronwi at Digital Investigator
- Flashpoint
- Fortinet
- Hex Rays
- Aaron Stratton at InfoSec Write-ups
Analyzing a Remcos RAT Infection - Karlo Licudine at AccidentalRebel
Talking about Mitre’s Malware Behavior Catalog - Malwarebytes Labs
Woody RAT: A new feature-rich malware spotted in the wild - Gustavo Palazolo at Netskope
Ousaban: LATAM Banking Malware Abusing Cloud Services - Oliver Bachtik at NVISO Labs
Finding hooks with windbg - petikvx
- Trend Micro
- Joshua Platt and Jason Reaves at Walmart
IcedID leverages PrivateLoader - Richard Melick at Zimperium
4 Common types of Malware and What’s the Difference (Trojan, Spyware, Viruses, Ransomware) - ZScaler
MISCELLANEOUS
- Adam at Hexacorn
- Any.Run
Expert Q&A: Renzon Cruz, Unit 42 on How to Get into Cybersecurity - Atomic Matryoshka
CRTP Course and Exam Review - Brett Shavers at DFIR.Training
Drowning in an ocean of DFIR resources - Joe Slowik at Gigamon
Revisiting the Idea of the “False Positive” - Grayshift
Introducing Reveal by Grayshift, the Industry’s First Cloud-Native Mobile Device Forensic Analysis Solution, and Powerful New Features in GrayKey - Hal Pomeranz
Getting Started Career Advice - IntaForensics
- Kevin Pagano at Stark 4N6
Forensics StartMe Updates (8/1/2022) - Bill Cozens at Malwarebytes Labs
Ransomware protection with Malwarebytes EDR: Your FAQs, answered! - Ashwin Radhakrishnan at MITRE-Engenuity
Community Advisory Board and Vendor Council + Updates for ATT&CK® Evaluations Enterprise — Turla - Oxygen Forensics
macOS Extraction of User Data and Credentials with Oxygen Forensic® KeyScout - Kevin Gee at Red Canary
No place like home: Meet your new Red Canary dashboard - Nuris Rodriguez at ADF
How Digital Forensics Services Can Help You - SANS
- John Doyle at SANS
Mapping SANS FOR578 Coverage to the Mandiant CTI Core Competencies Framework - Michael Evert at Sucuri
7 Tips to Clean & Maintain Your Website - Telsy
The TrickBot malware - VTO Labs
VTO’s IoT & Drone Forensics courses are now international!
SOFTWARE UPDATES
- Brim
Version 0.31.0 - CRU
Download WriteBlocking Validation Utility - Elcomsoft
Elcomsoft System Recovery 8.30 recovers PIN-protected Windows accounts, supports LUKS2 encryption - Eric Zimmerman
ChangeLog - Federico Lagrasta
PersistenceSniper v1.0 - Hex Rays
IDA 8.0 released - Nextron Systems
THOR TechPreview 10.7.3 Features - Open Source DFIR
Plaso 20220724 released - OpenText
Enabling collaboration in digital forensic investigations - OSForensics
V10.0 Build 1002 5th August 2022 - Paraben Corporation
E3 Forensic Platform Version 3.3 with new Remote Cloud Collector - radare2
5.7.6 - SpecterOps
Introducing BloodHound 4.2 — The Azure Refactor - Stratosphere IPS
New Slips version 0.9.3 is here! - Ulf Frisk
MemProcFS Version 5.0 - Xways
- Yamato Security
Hayabusa v1.4.3 🦅
And that’s all for the week! If you think I’ve missed something, or want me to cover something specifically hit me up through the contact page or on the social pipes!
This Week In 4n6 