Author Archives: Unknown

I posted to LinkedIn recently (see figure 1), sharing the value I’d continued to derive from Events Ripper, a tool I’d written largely for my own use some time ago.Fig. 1: LinkedIn postFrom the comments to this and other LinkedIn posts regarding Events… Continue reading What is "Events Ripper"?→

Is “fileless” malware really fileless?Now, don’t get me wrong…I get what those who use this term are trying to say; that is, the actual malware itself, the malicious code, does not exist as a file on the local hard drive. However, for the uninitiated… Continue reading The Myth of "Fileless" Malware→

Rapid7 recently shared a fascinating post regarding the Kimsuky threat actor group making changes in their playbooks, specifically in their apparent shift to the use of .chm/”compiled HTML Help” files. In the post, the team does a great job of sharing … Continue reading A Look At Threat Intel Through The Lens Of Kimsuky→

I ran across an interesting LinkedIn post recently, “interesting” in the sense that it addressed something I hadn’t seen a great deal of reporting on; that is, ransomware threat actors dropping multiple RaaS variants within a single compromised organiz… Continue reading Threat Actors Dropping Multiple Ransomware Variants→

I was listening to a couple of fascinating interviews on the Uptycs Cybersecurity Standup podcast recently, and I have to tell you, there were some pretty insightful comments from the speakers.The first one I listened to was Becky Gaylord talking about… Continue reading Uptycs Cybersecurity Standup→

Investigative ScenarioChris Sanders posted another investigative scenario on Tues, 12 Mar, and this one, I thought, was interesting (see the image to the right).First off, you can find the scenario posted on X/Twitter, and here on LinkedIn.Now, let’s g… Continue reading Investigative Scenario, 2024-03-12→

I was doing some research recently regarding what’s new to Windows 11, and ran across an interesting artifact, which seems to be referred to as “PCA”. I found a couple of interesting references regarding this artifact, such as this one from Sygnia, and… Continue reading PCAParse→

It’s been almost a year, but this Elastic Security write-up on the r77 rootkit popped up on my radar recently, so I thought it would be useful to do a walk-through of how someone with my background would mine open reporting such as this for actionable … Continue reading A Look At Threat Intel, Through The Lens Of The r77 Rootkit→

There’re a lot of discussions out there on social media regarding how to get started or improve yourself or set yourself apart in cybersecurity, and lot of the advice centers around doing things yourself; setting up a home lab, using various tools, etc… Continue reading Lists of Images→

There’s been a good bit of discussion in the cybersecurity community regarding “EDR bypasses”, and most of these discussions have been centered around technical means a threat actor can use to “bypass” EDR. Many of these discussions do not seem to take… Continue reading EDRSilencer→