pepe berba

TLDR Recent macOS malware commonly abuses AppleScript through osascript or Script Editor.

TLDR The applescript-decompiler is a feature-rich decompiler of run-only AppleScripts.

Intro to hiding compiled Applescripts in resource forks I’ve been collaborating with sysop_host.

TLDR This gives an overview of how .scpt AppleScript are used to creatively deliver macOS malware, such as fake office documents or fake Zoom/Teams updates.

Introduction A friend of mine sent me a link to an article on malicious browser extensions that worked around Google Chrome Manifest V3 and asked if I had or could acquire a sample.

Introduction In this blogpost, we’re discussing a specific persistence technique that I haven’t read anywhere else.

Introduction In this blogpost, we’ll be discussing some scripts that attackers can install or modify that will execute on boot or logon.

Introduction In this blogpost, we’ll discuss how attackers can create services and scheduled tasks for persistence by going through the following techniques: Create or Modify System Process: Systemd Service Scheduled Task/Job: Systemd Timers Scheduled Tas…

Introduction In the previous blog post, we’ve discussed how to setup auditd and sysmon so that we can start hunting for persistence techniques in linux hosts.

Overview of blog series Welcome to this blog series “Hunting for Persistence in Linux”!