Other Investigating WMI Attacks

WMI as an attack vector is not new. It has been used to…

FOR509 Course Update – Introducing Google Workspace, the Multi-Cloud Intrusion Challenge, and more

Other FOR509 Course Update – Introducing Google Workspace, the Multi-Cloud Intrusion Challenge, and more

We are excited to announce that the SANS Institute FOR5…

Other Follina MSDT Zero-Day Q&A

A fascinating Word document was uploaded to a file scan…

Executives and Ransomware Stop, Collaborate, and Listen! Webcast Q&A

Other Executives and Ransomware Stop, Collaborate, and Listen! Webcast Q&A

In this discussion, James Shank of Team Cymru and Ryan …

Other Enterprise Security Tech Q&A

In response to the Kaseya ransomware attack Ryan Chapma…

Other Detecting DLL Hijacking on Windows

Initially identified fifteen years ago, and clearly art…

Defense Spotlight Finding Hidden Windows Services

Other Defense Spotlight Finding Hidden Windows Services

An attacker can make a Window service disappear from vi…

Cyber Kill Chain, MITRE ATT&CK, and Purple Team

Other Cyber Kill Chain, MITRE ATT&CK, and Purple Team

My previous blog focused on shifting mentality from Pen…

A few Ghidra tips for IDA users, part 2 – strings and parameters

Other A few Ghidra tips for IDA users, part 2 – strings and parameters

Just like in IDA, if you know the constants for registr…

A few Ghidra tips for IDA users, part 1 – the decompilerunreachable code

Other A few Ghidra tips for IDA users, part 1 – the decompilerunreachable code

As I continue to explore NSA’s new reversing tool…