Published in Digital Forensics·PinnedAnalysing Encoded Powershell and ShellcodeBase64 encoded PowerShell commands can often be a quick win for the identification of suspicious activity. Recently, I've come across some notable samples, which after a bit of digging, provide valuable insight into attacker activities and new IOCs. This article initially looks at a Base64 encoded PowerShell which looks like…Shellcode5 min readShellcode5 min read
Published in Malware Analysis·Jan 2, 2022Lab 6 — C Code Constructs in AssemblySolutions for Lab 6 within Practical Malware Analysis. Following on from Lab 5 — IDA Pro, we get more comfortable looking at assembly, using IDA Pro, and recognising common C code constructs such as if statements, for and while loops, switches and structs, in order to gain an understanding of a program’s functionality. Lab 6 builds upon each…Malware11 min readMalware11 min read
Published in Malware Analysis·Dec 29, 2021Lab 5 — IDA ProSolutions for Lab 5 within Practical Malware Analysis. IDA Pro IDA Pro, an Interactive Disassembler, is a disassembler for computer programs that generates assembly language source code from an executable or a program. …Malware11 min readMalware11 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 30, 2021BTLO — Phishy-v1BTLO (blueteamlabs.online) You have been sent a phishing link — It is your task to investigate this website and find out everything you can about the site, the actor responsible, and perform threat intelligence work on the operator(s) of the phishing site. Phishy V1 requires the use of the Web…Btlo4 min readBtlo4 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 30, 2021BTLO —Malicious PowerShell AnalysisBTLO (blueteamlabs.online) Recently the networks of a large company named GothamLegend were compromised after an employee opened a phishing email containing malware. The damage caused was critical and resulted in business-wide disruption. GothamLegend had to reach out to a third-party incident response team to assist with the investigation. You are…Btlo4 min readBtlo4 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 30, 2021BTLO — Network Analysis — Web ShellBTLO (blueteamlabs.online) The SOC received an alert in their SIEM for ‘Local to Local Port Scanning’ where an internal private IP began scanning another internal system. Can you investigate and determine if this activity is malicious or not? You have been provided a PCAP, investigate using any tools you wish. …Wireshark4 min readWireshark4 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 30, 2021BTLO — PEAKPeak (blueteamlabs.online) Dwight works as a web developer at Mountain Top Solutions, Chicago. He reports unusual activity originating from the private network 10.x.x.x in the logs on the application development server. Dwight also added that the server should only be accessed directly from the console or from his laptop via…Elk5 min readElk5 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 2, 2021BTLO — PretiumBTLO (blueteamlabs.online) The Security Operations Center at Defense Superior are monitoring a customer’s email gateway and network traffic (Crimeson LLC). One of the SOC team identified some anomalous traffic from Josh Morrison’s workstation, who works as a Junior Financial Controller. When contacted Josh mentioned he received an email from an…Pcap6 min readPcap6 min read
Published in Blue Team Labs Online — Walkthroughs·Apr 2, 2021BTLO — CountdownBTLO (blueteamlabs.online) NYC Police received information that a gang of attackers has entered the city and are planning to detonate an explosive device. Law enforcement have begun investigating all leads to determine whether this is true or a hoax. Persons of interest were taken into custody, and one additional suspect…Btlo5 min readBtlo5 min read
Published in Digital Forensics·Nov 17, 2020Shellbags AnalysisAnalysis of Shellbags is extremely useful method of determining what file or folder actions have been taken on a host by a specific user. — What are Shellbags? Shellbags are set of registry keys which contain details about a user’s viewed folder; such as its size, position, and icon. This means that all directory traversal is tracked and maintained in the registry. The shellbags provide timestamps, contextual information, and show the access of directories and other resources, potentially…Digital Forensics3 min readDigital Forensics3 min read
