Abusing Accessibility Features as a persistence mechanism.
Category: incident response
Malicious LNK Files
Malicious LNK files.
Scheduled Task Persistence
Some notes on finding malicious Scheduled Tasks.
Get-ChildItem Performance
I was writing some PowerShell scripts to scan disks for certain types of malware and realized that Get-ChildItem was kind of slow. I googled around and found this site which demonstrated using robocopy.exe and dir as faster alternatives to Get-ChildItem. Here were the results I had searching for LNK files on my disk using both …
Cron Persistence
All about cron persistence
REVIEW: RED TEAM Operator: Windows Evasion Course by SEKTOR7 Institute
REVIEW: RED TEAM Operator: Windows Evasion Course by SEKTOR7 Institute.
Enumerating Processes with CreateToolhelp32Snapshot
Quick and dirty example of process enumeration using CreateToolhelp32Snapshot
Finding Processes With Suspicious CWD Using procfs
Find malware running from temporary directories using procfs.
Finding Masquerading Processes With procfs
Find masquerading processes using procfs.
Using procfs For Forensics and Incident Response
Using procfs For Forensics and Incident Response.
CTF Triage Data Acquisition
A quick overview of triage data acquisition in the context of attack/defend CTFs.
Accessing Alternate Data Streams on VMDK Images on Linux
Accessing Alternate Data Streams on VMDK Images on Linux.
