Forensicating one of compromised hosts during our recent incident response activities we have found some interesting artifacts in SQM data. Let’s start from what SQM is. First of all, it’s an acronym for Software Quality Metrics. It used to be named Service Quality Monitoring and became an operating system component since Windows Vista. It is used to collect and send …

Ransomware is still one of the most common types of malware deployed during cyberattacks. Some hackers use it to extort ransom from their victims, while others — the more sophisticated ones — use it to cover their traces in the networks they compromise for very different purposes. Although in most cases such attacks are relatively straightforward, even big companies regularly …

Igor Mikhailov is a digital forensic analyst of the digital forensic laboratory at Group-IB and the picture below shows how one of his business cards looked like. These are hardware keys of forensic tools that the digital forensic analyst used conducting forensic examinations. The cost only of these products exceeds tens of thousands of dollars and there are other free …

Researchers became aware of the activities of the RTM group in December 2015. Since then, phishing emails distributing the trojan have been sent to potential victims with admirable persistence. From September to December 2018 the RTM group sent out more than 11,000 malicious emails. The cybercriminals, however, are not going to stop there, as evidenced by the new malicious campaigns …

As was promised, we continue our Using MITRE ATT&CK for Forensics series. This time we are going to discuss another persistence mechanism that isn’t so common in-the-wild. It’s Image File Execution Options (or IFEO) injection, persistence technique with ID T1183. So, what are IFEO? These options enable a developer to attach a debugger to an application. What is more, IFEO …

First of all, I would like to thank all of those who liked and retweeted the previous article from this series, BITS Jobs (T1197). I’m planning to continue working on this series and publish a post a week. This week I’m going to write about a persistence mechanism that became quite popular recently – WMI Event Subscription (T1084). I think …

If you are doing incident response, you must know what MITRE ATT&CK is. As it’s a great guide to threat actors tactics and techniques, I thought it’s a good idea to look at it from a forensic perspective. The ATT&CK can definitelly help digital forensic analysts to find evil both during traditional host-based forensic activities and more incident response related …

On Marth 24th Telegram released a new version of their messenger, and introduced a new feature – ability “to delete any message you have sent or received from both sides in any private chat”. According to Telegram’s official website, “the messages will disappear for both you and the other person – without leaving a trace.” Sounds pretty interesting, right? Let’s …

Recently I’m becoming more and more interested in cyber threat intelligence. I even started preparing for GCTI certification. CTI uses models and chains, you may have heard about the Diamond Model and Cyber Kill-Chain. Incident response has its own lifecycle – from preparation and identification to recovery and lessons learnt. Digital forensics has a certain process as well: collection, examination, …

New Sunday – new Funday! This week’s Sunday Funday presented the following challenge to solve: What are all the methods of execution you can find that are not recorded in the Amcache hive? All testing have been done on Windows 10 (Version 1803, OS Build 17134.523). For testing I used netscan.exe (x64), it’s available here, it was renamed according to …