There are some whataboutism vibes to Microsoft writing about Mac ransomware, but this is a really good post on various techniques used by ransomware (and malware in general) on macOS https://www.microsoft.com/en-us/security/blog/2023/01/05/unraveling-the-techniques-of-mac-ransomware/

(Edit: this blog post was a little bit too much based on the great work of Patrick Wardle so Microsoft, rightly, took it down.)

Good night tonight. I got a chunk of time to work up a PR to add process memory dumping to UAC.

UAC is my current favorite tool for live collection on Linux and Unix systems. If you do Linux/Unix DFIR you should check it out.

https://github.com/tclahr/uac

#Linux #Unix #DFIR #memory

Google did a very good job on writing detection #yara rules for #cobaltstrike #sliver

official repo: https://github.com/chronicle/GCTI

I merged those rules in two master file rules and sharing it here:

_cobaltstrike_google.yar
_sliver_google.yar

https://drive.proton.me/urls/ZNET79XFTW#Zo8xit75CQyF

#tips of day #reverse: #x64dbg supports Python extensions. You simple need to install : https://github.com/x64dbg/x64dbgpy. Take the precompiled binaries and copy the files in the x64dbg Plugin repository.

Here is an example of script to switch from HTTPS (port 443) to HTTP (port 80) when InternetConnectW() is called. The logic is simple:
- I create a breakpoint on this API,
- I set a callback function
- this function will be called when the API is called
- if the 3rd argument of InternetConnectW() (stored in R8 in x64 arch) is 443, I change it by 80
- finally, the debugged file continues its execution.

Here is a screenshot:

Some newly registered domains seemingly ready for MFA abuse, all with legitimate looking company logos in the login screen.

coinbase-sso[.]com
alorica-sso[.]com
assurant-sso[.]com
blockfi-sso[.]com
cricket-sso[.]com (showing AT&T login screen)
gsuite-sso[.]info
mdm-sso[.]com

#threatintel

nobody:

absolutely nobody:

yubikey: cccjgjgkhcbbcvchfkfhiiuunbtnvgihdfiktncvlhck