Hunting down Threat Infrastructure (1)

In this two article series, I am going to explain how to spot anomalous activity in proxies and DNS queries coming out of your network. Additionally, I am also explaining how to recognize suspicious threat infrastructure, what elements you need to pay attention to, how this infrastructure behaves, what are the challenges for the defender and…

Bypassing Perimeter Security and Malware Evasion (3)

This will be the final post in which I am presenting one of the many infection and evasion techniques used by criminals today. In this article which I hope is shorter than the previous ones, https://samuelalonsog.wordpress.com/2015/08/14/bypassing-perimeter-security-and-malware-evasion-1/ and https://samuelalonsog.wordpress.com/2015/08/24/bypassing-perimeter-security-and-malware-evasion-2/ I presume you are currently competent with pcap analysis and Wireshark as the main aim of this…

Bypassing Perimeter Security and Malware Evasion (2)

This post is a continuation of Bypassing Perimeter Security and Malware Evasion (1) As discussed before the best way to understand how drived by downloads technique work to bypass modern cyberdefenses is with a network traffic analysis exercise. The get a full understanding of the technique we will have to look for answers to some…

Bypassing Perimeter Security and Malware Evasion (1)

I could have titled this article in many ways such as perimeter disintegration, endpoint security visibility still a problem or even exploit kit. The reality is that all of them are part of a bigger problem and it is how criminals are bypassing the security perimeter and getting inside the networks where organization´s most precious…