powershell
Analyzing Encrypted RDP Connections
By Anthony Kasza, Corelight Security Researcher Microsoft’s Remote Desktop Protocol (RDP) is used to remotely administer systems within Windows environments. RDP is everywhere Windows is and is useful for conducting remote work ...
WMI 101 for Pentesters
PowerShell has gained popularity with SysAdmins and for good reason. It’s on every Windows machine (and now some Linux machines as well), has capabilities to interact with almost every service on every ...
Automating Directory Services
Automating directory services can be done with APIs and group-based provisioning to IT resources. The post Automating Directory Services appeared first on JumpCloud ...
Ransomware Goes Fileless, Uses Malicious Documents and PowerShell to Encrypt Files
In October 2019, we encountered a phishing campaign delivering a malicious Microsoft Word document that distributed ransomware with a twist. Unlike most ransomware families, such as GandCrab, WannaCry and RobinHood, the malware ...
Emotet: Catch Me If You Can (Part 2 of 3)
Emotet is a highly modular banking Trojan that has a proper decision tree-based algorithm to perform designated tasks. Due to Emotet’s capability to deliver obfuscated payloads and extend its capabilities through self-upgradable ...
MuddyWater Group Using Spam Campaign to Hijack Victims’ Computers
The MuddyWater threat attack group is using a spam campaign to hijack victims’ computers and steal sensitive information. Discovered by Heimdal Security in early April, the campaign begins when malicious actors use ...
Tricks and COMfoolery: How Ursnif Evades Detection
Ursnif is one of the main threats that is effectively evading detection right now (at publication) The dropper uses a COM technique to hide its process parentage WMI is used to bypass ...
Disabling Anti-Malware Scanning
This post follows on from the previous blog post, Preview Pane, looking at the later parts of the kill chain for the same malicious document. Here I will detail a technique for ...
Preview Pain: Malware Triggers in Outlook Preview Without User Opening Word Document
A recent malware sample forwarded to our Threat Intelligence service had some very interesting properties which we think would be useful to share. The sample itself is a Word document which is ...
Super Mario Oddity
A few days ago, I was investigating a sample piece of malware where our static analysis flagged a spreadsheet as containing a Trojan but the behavioural trace showed very little happening. This ...
