h1-ctf: Grinch Networks compromised!

Grinch Networks compromised! For fast triage/validation and inspired by @manoelt in other CTF, I made a bash script to find and print all the 12 flags of this CTF. The script uses curl, wget, google-chrome headless for flag 2, unzip, grep and sed. If any of these commands is missing, the script...

SitRep - Extensible, Configurable Host Triage

SitRep is intended to provide a lightweight, extensible host triage alternative. Checks are loaded dynamically at runtime from stand-alone files. This allows operators to quickly modify existing checks, or add new checks as required. Checks are grouped by category and can be marked as OpSec...

VMware Carbon Black First to Block Hidden Malicious Commands in Obfuscated Scripts

For a long time now, our Threat Analysts have flagged the growing threat of script-based attacks, especially from Microsoft PowerShell and Windows Management Interface script commands, and their ability to escape notice in many antivirus solutions. Increasingly, these types of attacks have become...

capa: Automatically Identify Malware Capabilities

capa is the FLARE team’s newest open-source tool for analyzing malicious programs. Our tool provides a framework for the community to encode, recognize, and share behaviors that we’ve seen in malware. Regardless of your background, when you use capa, you invoke decades of cumulative reverse...

Analyzing Dark Crystal RAT, a C# Backdoor

The FireEye Mandiant Threat Intelligence Team helps protect our customers by tracking cyber attackers and the malware they use. The FLARE Team helps augment our threat intelligence by reverse engineering malware samples. Recently, FLARE worked on a new C variant of Dark Crystal RAT DCRat that the...

AMA Recap: Top 10 Tips to Secure Your Remote Workforce

This is part of our ongoing conversation about the worldwide challenges of working remotely. To stay up-to-date on the latest insights, refer to our live page for COVID-19: Cybersecurity Community Resources. As organizations around the world transition to remote work en masse, cybersecurity...

Razer: SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id Parameter

The tester discovered a SQL injection vulnerability that allowed the potential extraction of sensitive user information from the Razer Gold Thailand database. Razer thanks the tester for his PoC as well as working with the Triage and dev teams to clarify the issue and get it fixed...

AutoMacTC - Automated Mac Forensic Triage Collector

This is a modular forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable for analysis. The output may provide valuable insights for incident response in a macOS environment. Automactc can be run against a live...

A proactive approach to more secure code

What if we could eliminate an entire class of vulnerabilities before they ever happened? Since 2004, the Microsoft Security Response Centre MSRC has triaged every reported Microsoft security vulnerability. From all that triage one astonishing fact sticks out: as Matt Miller discussed in his 2019...

Partner Perspectives: Accelerated Alert Handling from Syncurity and Carbon Black

JP Bourget is the Founder and CSO of Syncurity. One of the key Security Orchestration, Automation and Response SOAR use cases I see every day is alert handling. As more and more organizations adopt EDR solutions, like those offered by Carbon Black, Syncurity IR-Flow is able to speed up the alert...

Xori - An Automation-Ready Disassembly And Static Analysis Library For PE32, 32+ And Shellcode

Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data. Acknowledgements: Xori wouldn't exist without inspiration and ideas from the open source community. We are indebted to the work of the Capstone engine and...

Partner Perspectives: ThreatConnect and Carbon Black: Incorporating Threat Intel for Quicker Incident Response

Megan Horner is the Director of Product Marketing for ThreatConnect. When it comes to incident response, there’s typically a focus on three main stages: investigation, containment, and remediation. Moving from one stage to the next as efficiently as possible is critical to expediting response...

Pftriage - Python Tool And Library To Help Analyze Files During Malware Triage And Analysis

pftriage is a tool to help analyze files during malware triage. It allows an analyst to quickly view and extract properties of a file to help during the triage process. The tool also has an analyze function which can detect common malicious indicators used by malware. Dependencies pefile filemagi...

Partner Perspectives: More Effective Threat Hunting with ThreatConnect and Carbon Black

Megan Horner is the Director of Product Marketing for ThreatConnect. You’ll hear a lot in cybersecurity - and in technology in general - about the necessity of integrations. The more security solutions can communicate back and forth with what they find “in the wild” and how it compares to what’s...

Malwoverview - Tool To Perform An Initial And Quick Triage On Either A Directory Containing Malware Samples Or A Specific Malware Sample

Malwoverview.py is a simple tool to perform an initial and quick triage on a directory containing malware samples not zipped. This tool aims to : 1. Determining similar executable malware samples PE/PE+ according to the import table imphash and group them by different colors pay attention to the...

No Data is an Island: One Infosec Pro’s Experience As a Consumer Involved in a Data Breach

British Airways BA was hit by a major breach that resulted in a loss of customer records. I was notified promptly by BA. I thought their public response was timely. By the way, this breach was announced while I was about to board a BA flight to Heathrow. My credit card was used to purchase my...

SANS THIR Summit Wrap Up – “We Have 15 Minutes”

Heading back to San Diego before I get on another flight 30 hours later. Lots of people say "what are you crazy? Why do that?"…to which I say: "we cannot achieve any mission without sacrifice." Going to events like the SANS Threat Hunting IR summit remind just how many dedicated people we have on...

Ed: Physical Laptop Takeover

At 6:16PM of August 11th of 2018, during H1-702, right before the sand storm beat the shit out of the rooftop party, we managed to perform a critical attack on Ed's infrastructure. F332214 Report Summary During our analysis and reconnaissance of how Ed program worked during the h1-702 event, we...

Partner Perspectives: Security Orchestration as a Catalyst for Proactive Incident Response

Meny Har is the VP of Product for Siemplify. Benjamin Franklin famously advised the fire-threatened residents of Philadelphia, “An ounce of prevention is worth a pound of cure.” And while being proactive may have been effective for fire prevention, the approach does not translate into the impendi...

Collecting & Hunting For IOCs With Gusto and Style: rastrea2r

Ever wanted to turn your AV console into an Incident Response & Threat Hunting machine? Rastrea2r pronounced “rastreador” – hunter- in Spanish is a multi-platform open source tool that allows incident responders and SOC analysts to triage suspect systems and hunt for Indicators of Compromise IOCs...