pict

PICT - 感染后收集工具包 这套脚本旨在从被认为已感染的终端收集各类数据，以协助应急响应流程。这些数据不应被视为完整的取证数据收集，但确实捕获了大量有用的取证信息。 如需真正的取证数据，您应实际捕获完整的内存转储并对整个驱动器进行镜像。这不在本工具包的范围内。 使用方法 脚本必须在运行中的系统上执行，而非镜像或其他取证数据存储库。它严格来说并不 要求 root 权限才能运行，但若无 root 权限，将无法收集大部分预期数据。 数据将以两种形式收集。第一种是汇总文件，包含 shell 命令输出、从数据库提取的数据等。例如，browser 模块会输出一个...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - What The Code Tells Us

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us By McAfee Labs · October 2, 2019 Episode 1: What the Code Tells Us McAfee’s Advanced Threat Research team ATR observed a new ransomware family in the wild, dubbed Sodinokibi or REvil, at the end of April 201...

A New Paradigm For Cyber Threat Hunting

It's no secret that expecting security controls to block every infection vector is unrealistic. For most organizations, the chances are very high that threats have already penetrated their defenses and are lurking in their network. Pinpointing such threats quickly is essential, but traditional...

A New Paradigm For Cyber Threat Hunting

It's no secret that expecting security controls to block every infection vector is unrealistic. For most organizations, the chances are very high that threats have already penetrated their defenses and are lurking in their network. Pinpointing such threats quickly is essential, but traditional...