This blog post will cover the Cobalt Strike DLL stager's anatomy, design choices and highlight ways to reduce both log footprint and time-to-shellcode.

I have been looking at several samples of Cobalt Strike beacons used in malware attacks. Although work is still ongoing, I already want to share my findings. Cobalt Strike beacons communicating ove…

Deep Dive Into Windows PE Format - GetProcAddress Spoofing - Malware researchers - Beware of GetProcAddress spoofing via manipulation of PE format in memory.

IBM’s new Kestrel open-source programming language allows threat hunters to perform cyber reasoning and threat discovery much faster and easier than before.

At Microsoft, we continuously collaborate with customers and the InfoSec community to learn more about the latest adversary tradecraft so that we can improve our detection strategies across all our security services. To help the broader security community…

This video shows how Cobalt Strike and Hancitor C2 traffic can be detected using CapLoader. Your browser does not support the video tag. I bet youre going: 😱 OMG hes analyzing Windows malware on a Windows PC!!! Relax, I know what Im doing. I have also taken…

Explore lateral movement from Azure AD to on-prem AD using Microsoft Endpoint Manager. Learn how hybrid devices can be exploited for cross-domain attacks.

It’s been known that some built-in commands in Cobalt Strike are major op-sec no-no’s, but why are they bad? The goal of this post isn’t to teach you “good” op-sec, as I feel that is a bit subjecti…

Welcome to the McAfee Blog, where we share posts about security solutions and products to keep you and your connected family safe online.

YARA rules are used to classify and identify malware samples by creating descriptions of malware families based on textual or binary patterns.

The holy grail for defenders is being able to detect /stop every attack before / when it happens and to know exactly the how’s no matter the techniques or tools. Unfortunately, we’re still far from…

This is a more technical post to exemplify how my workflow goes when designing and implementing a new detection while serving as follow-up…

Posted by James Forshaw, Project ZeroRecently I've been delving into the inner workings...

I did promise that I'd put out a blog post on how the Windows RPC filter works. Now that I released my more general blog post on the Windo...

The Deimos implant was first reported in 2020 and has been in active development; employing advanced analysis countermeasures to frustrate analysis. This post details the campaign TTPs through the malware indicators.