TWRL - A new variant of Pro-Ocean malware discovered; Phantom malware -
hiding by imitating user activity; A collection of EDR bypass methods; Kobalos
malware targets HPCs; New method for cross-site leaks disclosed; CinaRAT
analysis; Malchive - a collection of malware analysis tools; SerialStudio -
a for visualizing serial data; What2Log - a guide to logging; Hunting using
Sysmon CallTrace; Simple trend analysis and anomaly detectin with SQL; ScareCrow
- a payload generator; ProcDOT - a graph-based visual malware analysis tool;
OpenBullet - a plugin-based web testing framework; Docker Security guide;
Regular Expressions for Editors; and Tamper-evident logs.
TWRL - CISA's Malware Analsyis Report on SUPERNOVE; CheckPoint Research
analyzes the second phase of the SolarWinds breach; Extracting an Emotet payload
from a maldoc; Telegram and WOFF used for communications in phishing campaign;
Abuse of the `finger` command on Windows; CISA's specifications for a
threat hunting platform; How the Emotet module developed by law-enforcement
works to take down Emotet; APT-Hunter tool for Windows logs; Building YARA
rules from a maldoc; LogoKit to build web pages for phishing campaigns;
ThreatConnect and ANY.Run partnership; and PacketSifter for extracting information
from PCAPs.
TWRL - SolarWinds analysis of SUNBURST, TEARDROP, RAINDROP and actions
in O365 and Azure environments; Flaws identified in dnsmasq dubbed DNSspooq;
Analysis of binaries for authorship attribution; vulnerability in Windows NTLM;
Analysis of Shellcode attributed to the Lazurus group; Snort 3 is released;
Emulation rootkits with Speakeasy; Finding subdomains using Subfinder.
TWRL SUMMARY: SolarWinds stories, analysis and alerts; DevSecOps best practices;
malware using WiFi to identify victims; popular malware and C2 frameworks;
Operation Kremlin; Ezuri Golang Crypter; spam bypass tool on the darknet;
the C2 matrix; building a malware analysis lab; a reverse engineering course;
vulnerable malware samples; Panther SIEM; PCAP Monkey analysis tool; eliminating
obsolete protocols; a new cybersecurity bureau; using OSINT for network defense;
the disclose.io project; and books for developers.