dfir.ch

Zsh Sessions In a previous blog post (Today I Learned - Zsh History Timestamps), we discussed how Zsh records commands entered in the shell along with a timestamp, provided that the session remains open.

Introduction While working my way through the excellent “Linux Attack, Detection and Live Forensics” course from Defensive Security, I read the following line: If you are looking for a simple way how to hide your process from the process list, then the bi…

Introduction Fox_threatintel tweeted recently about an open directory on 91.215.85.18:9380/.

Zsh Timestamps In Zsh, which serves as the default shell for Kali, Gentoo, and macOS (replacing Bash in macOS Catalina), among others, the shell session retains the command history with timestamps in memory.

Insider Threat?

Introduction A client contacted us following an alert triggered by their Network Detection and Response sensor (NDR), which flagged suspicious network behavior originating from a server within their internal network.

Introduction On a recent incident response case, a customer contacted us regarding their EDR detecting a crypto miner on a Linux endpoint.

Seven Sins #1: Lack of patch management #2: Lack of MFA #3: Ignoring or misinterpreting AV alerts #4: Insufficient AD hardening #5: No in-depth analysis after a (security) incident #6: Direct access to the Internet #7: Lack of an EDR 10 AD Commandments #2:

Introduction In a recent investigation conducted by my colleague, Giuseppe Paternicola, it was discovered that the initial entry point that ultimately led to the deployment of the Abyss ransomware was a compromised SonicWall Secure Mobile Access (SonicWall

Introduction A huge thanks to the Invictus-IR team for proofreading this blog post 🙏 Recently, I posted a tweet regarding an unpatched TeamCity server that an attacker exploited to deploy a CoinMiner.

How it started Figure 1: An unhandled exception occurred in w3wp.exe The customer contacted us regarding sporadic crashes of the IIS worker process (w3wp.exe).

Background A customer contacted us reporting that an attacker had deleted several AWS S3 buckets (before allegedly downloading the data).

Introduction Craig Rowland, Founder and CEO of Sandfly Security, delivered a presentation titled Evasive Linux Malware at the Oslo Cold Incident Response Conference last year (Slides here, Presentation here), dissecting the notorious BPFDoor malware.

Introduction Recorded Future writes in their Adversary Infrastructure Report 2023: The top 5 malware families we detected this year are AsyncRAT, Quasar RAT, PlugX, ShadowPad, and DarkComet.

Persistence Techniques Get-Variable.exe Windows Silent Process Exit Word Templates PowerShell profile SSH Backdoor on Windows MPLog Microsoft Protection Log (MPLog) Find WebShells with the MPLog Yet another example of why the MPLog is awesome PowerShell M…

Anomalous tokens eM Client Hunting Shadow Admins Sign-Ins from Nigeria Operating Systems Risk Detections Shady ASNs UnifiedAuditLogIngestionEnabled “Set-MailboxJunkEmailConfiguration” Circumvented MFA Malicious Inbox rules Blocked Senders and Domains

#1: Passwords in GPO’s Original Tweet #2: Weak Password Policies Original Tweet #3: Non-admin Users can add up to 10 Computer(s) to a Domain Original Tweet) #4: Dangerous Privileges Original Tweet #6: Log Interactively on to the Domain Controllers Original

Introduction We analyzed the top ten malware families in Switzerland (according to govcert.ch) during the period April - December 2022 to find patterns and overlaps in the forensic artifacts that a successful infection leaves on an endpoint.

Remote Access Trojans (RATs) AsyncRAT AsyncRAT, Part 2 Quasar Rat Remote Monitoring and Management (RMM) action1 DWservice Remote Monitoring & Management (RMM) Splashtop User Agents User-Agent analysis User-Agents, Part 2 User-Agents, Part 3 SystemBC Powe…

Abstract The Swiss GovCERT published monthly statistics on the most common malware families in Switzerland.

Abstract Stephan Berger, Head of Investigations at InfoGuard, will share insights from recent InfoGuard CSIRT security incidents and present the seven biggest security failures of companies that still open the door to attackers far too often.

Abstract Figure 1: Ransomware in Switzerland and around the World Youtube Video