A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

Monitors and reports key system activity via the Windows event log.

Sysmon v9.0 is now available, and now permits AND or OR statements across rules. This is interesting and I believe might help some of the…

KSQL can be used in numerous real-time security detection and alerting tasks. One example of this is against the lateral movement technique. By taking data from a tool such as Sysmon and streaming it into Kafka for processing in KSQL, you can rapidly det…

In August of 2018, DarkMatter released a report entitled “In the Trails of WINDSHIFT APT”, which unveiled a threat actor with TTPs very similar to those of Bahamut. Subsequently, two additional articles (here and here) were released by Objective-See which…

Hack, loot, pivot, and pwn

Tips on how to manage a security operations center (SOC) to be more responsive, effective, and collaborative.

How an anomalous space led to fingerprinting Summary On the 2nd of January 2019 Cobalt Strike version 3.13 was released, which contained a fix for an “extraneous space”. This uncommon w…

by Heige of KnownSec 404 Team 2019/2/27

A technical analysis of Linux.Greedy.Antd, a cryptominer employed by Pacha Group to compromise third party Linux servers. The malware was undetected by all leading engines, demonstrating the sophistication of this threat.

Recently I was playing with VirusTotal Intelligence and while testing some dynamic behavior queries I stumbled upon this strange PE binary (MD5: …

In November 2018 the Chafer threat group targeted a Turkish government entity reusing infrastructure that they used in campaigns reported earlier in 2018. Unit 42 has observed Chafer activity since 2016, however, Chafer has been active since at least 2015.…

Blog about computer security, malware and reverse engineering.

New tactics from PINCHY SPIDER affiliates indicate a shift toward GandCrab ransomware in targeted, low-volume/high-return “big game hunting” attacks.

In this post, we will try to analyse some of the known noisy windows events and see if there are any hidden opportunities or details we are...

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.