| Tweetovi |
| Decalage proslijedio/la je tweet | ||
|
Joshua Saxe
@joshua_saxe
|
4. velj |
|
1/ Some thoughts on the way ML gets talked about in security: Most security problems are not machine learning problems. Like encryption, dual-factor authentication, taint analysis, or hand-crafted IOCs, machine learning is just one of many security tools.
|
||
|
||
|
Decalage
@decalage2
|
10 h |
|
Have you seen many AV engines triggering false positives on legit VBA macros? Most of the time I see the opposite, many malicious macros are not detected.
In this specific case maybe the actual code is benign, but running native code from VBA is definitely bad practice!
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
John Lambert
@JohnLaTwC
|
15 h |
|
If you wondered why AV has false positives, take a look at this excel file:
1. Runs code automatically on opening
2. Uses native APIs that manipulate memory
3. Instantiates a COM object defined in a text string in a macro
Benign.
virustotal.com/gui/file/f08d2… pic.twitter.com/oOZIVw9gAS
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
DirectoryRanger
@DirectoryRanger
|
22 h |
|
#Windows Red Team Cheat Sheet
morph3sec.com/2019/07/16/Win…
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
NVISO Labs
@NVISO_Labs
|
4. velj |
|
New blog post: The return of the spoof part 2: Command line spoofing | by @Jean_Maes_1994
blog.nviso.eu/2020/02/04/the… pic.twitter.com/giwQbuohG4
|
||
|
|
||
|
|
Decalage
@decalage2
|
4. velj |
|
Well, "shell" alone is suspicious enough, I don't think a complex signature is needed. ;-)
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
|
John Lambert
@JohnLaTwC
|
4. velj |
|
If you study maldocs you know the Shell() function. Did you know about Interaction$.Shell@()?
This malware does:
🔗virustotal.com/gui/file/88173…
Interesting to see how just calling Interaction$.Shell drops the detection rate:
1⃣virustotal.com/gui/file/20eac…
2⃣virustotal.com/gui/file/95c00… pic.twitter.com/dEG9jJwGqL
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
|
Joshua Saxe
@joshua_saxe
|
29. sij |
|
1\ I've written a little compiler to ship ML models as standalone Yara rules, and done proof of concept detectors for Macho-O, RTF files, and powershell scripts. So far I have decision trees, random forests, and logistic regression (LR) working. github.com/inv-ds-researc… pic.twitter.com/sfuXEkHeNO
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
Michele Spagnuolo
@mikispag
|
1. velj |
|
This abomination is the regex for validating IPv6 addresses: ihateregex.io/expr/ipv6 pic.twitter.com/odoSJGZLUt
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
SANS ISC
@sans_isc
|
3. velj |
|
Analysis of a triple-encrypted AZORult downloader i5c.us/3b2v4Jc pic.twitter.com/WawmyF13e1
|
||
|
|
||
|
|
Decalage
@decalage2
|
2. velj |
|
EDR behavioral detection is the last layer of defence before malware can actually run. So yes, it's a bit late.
When a document with macro reaches the EDR, it means that none of the other layers before that managed to detect it (e.g. AV engine in the email gateway or local AV)
|
||
|
|
||
|
|
Decalage
@decalage2
|
1. velj |
|
Sure, however this is behavioral detection once the macro has started running, when MS Office spawns Powershell.
It would be better if AV engines could actually detect malicious XLM macros before they run.
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
Alexandre Dulaunoy
@adulau
|
25. sij |
|
Threat Bus: a real-time pub/sub broker to get intelligence/indicators from @MISPProject and feed your @Zeekurity in real-time & get sightings from your NIDS to MISP. A clever way to connect efficiently open source security tools. Thanks to @tenzir_company github.com/tenzir/threatb… pic.twitter.com/vn25bMPix8
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
Josh Stroschein
@jstrosch
|
30. sij |
|
Interested in learning how to debug macros or learn more about the structure of user forms? In my latest video, I show you how to use the Office IDE to debug a recent #emotet #maldoc youtu.be/xcRPhm5iRdo pic.twitter.com/ALBIp7wq2Q
|
||
|
|
||
|
|
Decalage
@decalage2
|
30. sij |
|
BTW this trick seems to be undetected by most antivirus engines for now (see VT): pic.twitter.com/Ya5SMja2MW
|
||
|
|
||
|
|
Decalage
@decalage2
|
30. sij |
|
This is not DDE, but an Excel 4 macro (aka XLM).
Here the trick is that the xls contains both a benign VBA macro, and a malicious XLM macro.
XLM parsing has been added to olevba last year, by integrating the excellent biff_plugin developed by @DidierStevens, thanks Didier!
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
|
John Lambert
@JohnLaTwC
|
30. sij |
|
Malware that just quits? I think there's more to the formula in this maldoc. #oletools reveals all cc/ @decalage2
🔗virustotal.com/gui/file/f0bfb… pic.twitter.com/g9vITlJL5j
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
ATT&CK
@MITREattack
|
20. pro |
|
The present everyone has been asking for is here! We are excited to announce the beta release of TRAM, a tool to aid in mapping reports to ATT&CK. You can find our latest blog with all the details at medium.com/mitre-attack/a… and the source code at github.com/mitre-attack/t…. pic.twitter.com/8XwpgV2eCx
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
marc ochsenmeier
@ochsenmeier
|
29. sij |
|
#Malware that hides commands in Metadata of Office Documents #DFIR
research.checkpoint.com/2019/rancor-th… pic.twitter.com/Zc9WOIAezA
|
||
|
|
||
| Decalage proslijedio/la je tweet | ||
|
Red Canary
@redcanaryco
|
28. sij |
|
From the folks that brought you Atomic Red Team, Chain Reactor is a new open source framework for composing executables that simulate adversary behaviors and techniques on Linux endpoints. redcanary.com/blog/chain-rea… pic.twitter.com/fkOISDk9YK
|
||
|
|
||