On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters
Recent work has investigated the use of hardware performance counters (HPCs) for the detection of malware running on a syste…
WannaCry Ransomware Threat: What We Know So Far
The WannaCry ransomware worm is unprecedented for two reasons. First, it’s a ransomware worm. Second, it appears to be…
WannaCry Ransomware – Incident Response Playbook
This response plan includes steps to contain the threat, hunt for existing infections, and remediation. Following is a list …
Investigating the Cyber Breach: The Digital Forensics Guide for the Network Engineer
Cisco Press has announced a new book by Joseph Muniz and Aamir Lakhani entitled “Investigating the Cyber Breach: The D…
The new version of Mandiant Redline supports Windows 10
Redline version 1.20 introduces support for collection from and analysis of Window 10 systems and is already available for d…
Basic Dynamic Analysis of a Malicious VBScript
For a long time one of the most common sources of ransomware and other malware have been spear phishing emails. Such emails …
How to Find Data Hidden at the End of an OLE File
Philippe Lagadec has published a blog post on how to find data hidden at the end of an OLE file. You will learn about Micros…
APT29 Domain Fronting With TOR
Matthew Dunwoody from FireEye has published a research on how Russian nation-state attackers APT29 employing domain fronting…
FAME – open-source malware analysis framework
FAME is an open source malware analysis platform that is meant to facilitate analysis of malware-related files, leveraging a…
Is Fileless Malware Really Fileless?
Travis Smith has published a post about fileless malware on The State of Security. He notes that this type of malware isn…
