Hunting down Threat Infrastructure (1)

In this two article series, I am going to explain how to spot anomalous activity in proxies and DNS queries coming out of your network. Additionally, I am also explaining how to recognize suspicious threat infrastructure, what elements you need to pay attention to, how this infrastructure behaves, what are the challenges for the defender and…

The ultimate targeted attack: Malvertisements

I am very surprised to see the title of this video, it should have included malvertising in it however if someone would have asked me about malvertising I would have undoubtedly answered ‘Elias Manousos’. Him and RiskIQ are today the pioneers in the field of external threat surface. The number of views demonstrate how low…

Malware forensics field guide for Windows Systems

All good books deserve a reference and this one is one of them. Malware forensics field guide for Windows systems.   The book is very easy to read and mainly practical. It goes from describing the general IR process to advance subjects such as memory forensics, live and dead analysis of windows systems and malware…

The evil side of DNS

Detection on this phase of the kill chain is not extremely complex, however from a business perspective it is critical for the organization to find this activity. An attacker who has progressed his attack to the C&C phase may be a dangerous and impactful threat for the business. Whether your organization is part of botnet…

All you ever wanted to know about malvertising

I just decided in the last minute that I am not going to write this article you are reading. Instead I am going to copy the links to 2 different video presentations and I am going to leave you with the real experts in this area. Both presentations are by RiskIQ personnel. If you are…

Malware Intelligence (white paper)

Reading though the news some days ago I found an interesting white paper related to malware intelligence and public sandboxes in internet such as Virustotal, Malwr, Threat track and some others. In the past, I  wondered if someone in these organizations was looking at millions of submissions that happen every day, with the aim to…

Bypassing Perimeter Security and Malware Evasion (3)

This will be the final post in which I am presenting one of the many infection and evasion techniques used by criminals today. In this article which I hope is shorter than the previous ones, https://samuelalonsog.wordpress.com/2015/08/14/bypassing-perimeter-security-and-malware-evasion-1/ and https://samuelalonsog.wordpress.com/2015/08/24/bypassing-perimeter-security-and-malware-evasion-2/ I presume you are currently competent with pcap analysis and Wireshark as the main aim of this…

Android Malware Analysis (white papers)

Are you currently interested or doing android malware analysis? then these white papers are a must read for you. These white papers will not discuss current tools and techniques but the current attack vectors for Android apps and therefore what you need to look for when analysing your apk’s. Dissecting Android Malware: Characterization and Evolution…

Bypassing Perimeter Security and Malware Evasion (1)

I could have titled this article in many ways such as perimeter disintegration, endpoint security visibility still a problem or even exploit kit. The reality is that all of them are part of a bigger problem and it is how criminals are bypassing the security perimeter and getting inside the networks where organization´s most precious…