MEGAsync forensics can be leveraged to identify exfiltrated files, additional victims and, subsequently, perform attribution.
MEGAsync Forensics and Intrusion Attribution
Category: Respond
From Evidence to Advantage: Leveraging Incident Response Artifacts for Red Team Engagements
What is this blog post about? This blog post is about why incident responder artifacts not only play a role on the defensive but also offensive side of cyber security. We are gonna look at some of the usually collected evidences and how they can be valuable to us as red team operators. We will … Continue reading From Evidence to Advantage: Leveraging Incident Response Artifacts for Red Team Engagements
Hunting for Remote Management Tools
In today's digital landscape, Remote Management and Monitoring (RMM) tools have become indispensable for organizations seeking to streamline IT operations, enhance productivity, and ensure seamless remote support. However, within our threat hunting and incident response engagements we often see that these tools, while beneficial, can also pose significant security risks if not properly managed. This … Continue reading Hunting for Remote Management Tools
Covert TLS n-day backdoors: SparkCockpit & SparkTar
This report documents two covert TLS-based backdoors identified by NVISO: SparkCockpit & SparkTar. Both backdoors employ selective interception of TLS communication towards the legitimate Ivanti server applications.
XOR Known-Plaintext Attacks
In this blog post, we show in detail how a known-plaintext attack on XOR encoding works, and automate it with custom tools to decrypt and extract the configuration of a Cobalt Strike beacon. If you are not interested in the theory, just in the tools, go straight to the conclusion 🙂 . A known-plaintext attack … Continue reading XOR Known-Plaintext Attacks
The SOC Toolbox: Analyzing AutoHotKey compiled executables
A quick post on how to extract AutoHotKey scripts from an AutoHotKey script compiled executable.