Brighten Your Day by Detecting this Emerging Malware Threat — Introduction In this article, we’ll look at DarkGate, a commodity malware loader that has popped up frequently on the ‘threat radar’ lately. …

Detecting a [Re-]emerging Initial Access Method — Introduction In this article we’ll take a close look at the techniques described by Trellix researchers Mathanraj Thangaraju and Sijo Jacob in their recent piece for the Trellix blog entitled Beyond File Search: A Novel Method for Exploiting the “search-ms” URI Protocol Handler. In this post, Thangaraju and Jacob explore a…

Introduction In this article I’ll deviate from my recent focus on threat research and detection engineering to highlight an important skill set: automation. The ability to program the steps of an otherwise time-consuming, repetitive, and/or manual process is a valuable asset in cybersecurity. In my 2+ years in cybersecurity (and my…

Detecting a Red Team (and Threat Actor) Favorite — Introduction and Objectives In this article we’ll take on the mighty Impacket, an open-source Python library for conducting network-based attacks. …

I opened a dozen malicious OneNote files and clicked on every link so you don’t have to — Introduction/Objectives Early in 2023, I started hearing about a new (to me, anyway) type of malware delivery — .one files opened using Microsoft OneNote: As tweets like the one above gradually seeped into my consciousness, I decided to learn more, as I am always curious to know about new techniques…

Introduction In this article I’ll delve into HTML smuggling detection, following the detection engineering process I’ve described over my last two posts. This process includes research, testing, and development of new detection concepts. Unlike my previous posts however, this time we’ll be observing, profiling, and detecting real QakBot malware in the…

Introduction In my last post I shared a straightforward process that I use to sharpen my detection engineering skills using threat intel reports as an inspiration and starting point for researching and detecting real-world attacker techniques. Since then, I’ve heard from several people within and outside of my organization who are…

Introduction In this article, I’ll discuss the importance of a repeatable, easy-to-follow process for detection engineering, and give an example walkthrough of my process based on a recent alert from the Cybersecurity and Infrastructure Security Administration (CISA) regarding Hive ransomware group. This is intended for folks who are fairly new to…

A few months ago I decided to check and see whether there was a Sigma backend for InsightIDR, the cloud-based SIEM from Rapid7. Imagine my shock (😱) when I discovered that none existed! There are Sigma backends for more than a dozen SIEM platforms, including plenty I’d never heard of…