REVERSE SHELL |
| 2024-12-24 | Xavier Mertens | More SSH Fun! |
| 2021-02-01 | Rob VandenBrink | Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers |
REVERSE |
| 2024-12-24/a> | Xavier Mertens | More SSH Fun! |
| 2021-02-01/a> | Rob VandenBrink | Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers |
| 2018-06-29/a> | Remco Verhoef | Crypto community target of MacOS malware |
| 2014-04-13/a> | Kevin Shortt | Reverse Heartbleed Testing |
| 2012-09-14/a> | Lenny Zeltser | Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan |
| 2012-06-04/a> | Lenny Zeltser | Decoding Common XOR Obfuscation in Malicious Code |
| 2010-11-18/a> | Chris Carboni | Stopping the ZeroAccess Rootkit |
| 2010-02-13/a> | Lorna Hutcheson | Network Traffic Analysis in Reverse |
SHELL |
| 2025-03-10/a> | Xavier Mertens | Shellcode Encoded in UUIDs |
| 2025-03-09/a> | Johannes Ullrich | Commonly Probed Webshell URLs |
| 2025-02-19/a> | Xavier Mertens | XWorm Cocktail: A Mix of PE data with PowerShell Code |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2024-12-24/a> | Xavier Mertens | More SSH Fun! |
| 2024-08-19/a> | Xavier Mertens | Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-03-28/a> | Xavier Mertens | From JavaScript to AsyncRAT |
| 2024-02-09/a> | Xavier Mertens | MSIX With Heavily Obfuscated PowerShell Script |
| 2024-01-26/a> | Xavier Mertens | A Batch File With Multiple Payloads |
| 2024-01-12/a> | Xavier Mertens | One File, Two Payloads |
| 2024-01-05/a> | Rob VandenBrink | Netstat, but Better and in PowerShell |
| 2024-01-03/a> | Jan Kopriva | Interesting large and small malspam attachments from 2023 |
| 2023-11-18/a> | Xavier Mertens | Quasar RAT Delivered Through Updated SharpLoader |
| 2023-09-09/a> | Guy Bruneau | ?Anyone get the ASN of the Truck that Hit Me?!?: Creating a PowerShell Function to Make 3rd Party API Calls for Extending Honeypot Information [Guest Diary] |
| 2023-08-03/a> | Jan Kopriva | From small LNK to large malicious BAT file with zero VT score |
| 2023-07-28/a> | Xavier Mertens | ShellCode Hidden with Steganography |
| 2023-06-29/a> | Brad Duncan | GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-09/a> | Xavier Mertens | Undetected PowerShell Backdoor Disguised as a Profile File |
| 2023-05-17/a> | Xavier Mertens | Increase in Malicious RAR SFX files |
| 2023-04-19/a> | Rob VandenBrink | Taking a Bite Out of Password Expiry Helpdesk Calls |
| 2023-03-30/a> | Xavier Mertens | Bypassing PowerShell Strong Obfuscation |
| 2023-03-21/a> | Didier Stevens | String Obfuscation: Character Pair Reversal |
| 2023-03-16/a> | Xavier Mertens | Simple Shellcode Dissection |
| 2023-02-10/a> | Xavier Mertens | Obfuscated Deactivation of Script Block Logging |
| 2023-01-17/a> | Rob VandenBrink | Finding that one GPO Setting in a Pool of Hundreds of GPOs |
| 2023-01-04/a> | Rob VandenBrink | Update to RTRBK - Diff and File Dates in PowerShell |
| 2022-12-28/a> | Rob VandenBrink | Playing with Powershell and JSON (and Amazon and Firewalls) |
| 2022-11-09/a> | Xavier Mertens | Another Script-Based Ransomware |
| 2022-10-31/a> | Rob VandenBrink | NMAP without NMAP - Port Testing and Scanning with PowerShell |
| 2022-10-17/a> | Xavier Mertens | Fileless Powershell Dropper |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-09-14/a> | Xavier Mertens | Easy Process Injection within Python |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-06-25/a> | Xavier Mertens | Malicious Code Passed to PowerShell via the Clipboard |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-06-03/a> | Xavier Mertens | Sandbox Evasion... With Just a Filename! |
| 2022-05-12/a> | Rob VandenBrink | When Get-WebRequest Fails You |
| 2022-04-25/a> | Xavier Mertens | Simple PDF Linking to Malicious Content |
| 2022-03-31/a> | Johannes Ullrich | Spring Vulnerability Update - Exploitation Attempts CVE-2022-22965 |
| 2022-03-30/a> | Johannes Ullrich | Possible new Java Spring Framework Vulnerability (Updated: not a Spring problem) |
| 2022-03-30/a> | Johannes Ullrich | Java Springtime Confusion: What Vulnerability are We Talking About |
| 2022-03-11/a> | Xavier Mertens | Keep an Eye on WebSockets |
| 2022-02-23/a> | Johannes Ullrich | The Rise and Fall of log4shell |
| 2022-01-22/a> | Xavier Mertens | Mixed VBA & Excel4 Macro In a Targeted Excel Sheet |
| 2022-01-20/a> | Xavier Mertens | RedLine Stealer Delivered Through FTP |
| 2022-01-17/a> | Johannes Ullrich | Log4Shell Attacks Getting "Smarter" |
| 2022-01-06/a> | Xavier Mertens | Malicious Python Script Targeting Chinese People |
| 2021-12-23/a> | Johannes Ullrich | log4shell and cloud provider internal meta data services (IMDS) |
| 2021-12-23/a> | Johannes Ullrich | Defending Cloud IMDS Against log4shell (and more) |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-15/a> | Xavier Mertens | Simple but Undetected PowerShell Backdoor |
| 2021-12-14/a> | Johannes Ullrich | Log4j: Getting ready for the long haul (CVE-2021-44228) |
| 2021-12-11/a> | Johannes Ullrich | Log4j / Log4Shell Followup: What we see and how to defend (and how to access our data) |
| 2021-12-10/a> | Xavier Mertens | Python Shellcode Injection From JSON Data |
| 2021-12-10/a> | Bojan Zdrnja | RCE in log4j, Log4Shell, or how things can get bad quickly |
| 2021-12-07/a> | Johannes Ullrich | Webshells, Webshells everywhere! |
| 2021-11-15/a> | Rob VandenBrink | Changing your AD Password Using the Clipboard - Not as Easy as You'd Think! |
| 2021-10-18/a> | Xavier Mertens | Malicious PowerShell Using Client Certificate Authentication |
| 2021-10-01/a> | Xavier Mertens | New Tool to Add to Your LOLBAS List: cvtres.exe |
| 2021-08-20/a> | Xavier Mertens | Waiting for the C2 to Show Up |
| 2021-08-09/a> | Jan Kopriva | ProxyShell - how many Exchange servers are affected and where are they? |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-04-08/a> | Xavier Mertens | Simple Powershell Ransomware Creating a 7Z Archive of your Files |
| 2021-02-12/a> | Xavier Mertens | AgentTesla Dropped Through Automatic Click in Microsoft Help File |
| 2021-02-01/a> | Rob VandenBrink | Taking a Shot at Reverse Shell Attacks, CNC Phone Home and Data Exfil from Servers |
| 2021-01-21/a> | Xavier Mertens | Powershell Dropping a REvil Ransomware |
| 2021-01-18/a> | Didier Stevens | Doc & RTF Malicious Document |
| 2021-01-10/a> | Didier Stevens | Maldoc Analysis With CyberChef |
| 2021-01-09/a> | Didier Stevens | Maldoc Strings Analysis |
| 2020-12-24/a> | Xavier Mertens | Malicious Word Document Delivering an Octopus Backdoor |
| 2020-11-30/a> | Didier Stevens | Decrypting PowerShell Payloads (video) |
| 2020-11-25/a> | Xavier Mertens | Live Patching Windows API Calls Using PowerShell |
| 2020-11-19/a> | Xavier Mertens | PowerShell Dropper Delivering Formbook |
| 2020-11-05/a> | Xavier Mertens | Did You Spot "Invoke-Expression"? |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-23/a> | Xavier Mertens | Malicious Word Document with Dynamic Content |
| 2020-09-11/a> | Rob VandenBrink | What's in Your Clipboard? Pillaging and Protecting the Clipboard |
| 2020-09-02/a> | Xavier Mertens | Python and Risky Windows API Calls |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-20/a> | Rob VandenBrink | Office 365 Mail Forwarding Rules (and other Mail Rules too) |
| 2020-08-06/a> | Xavier Mertens | A Fork of the FTCode Powershell Ransomware |
| 2020-08-03/a> | Xavier Mertens | Powershell Bot with Multiple C2 Protocols |
| 2020-07-27/a> | Didier Stevens | Analyzing Metasploit ASP .NET Payloads |
| 2020-07-19/a> | Guy Bruneau | Scanning Activity for ZeroShell Unauthenticated Access |
| 2020-06-12/a> | Xavier Mertens | Malicious Excel Delivering Fileless Payload |
| 2020-05-15/a> | Rob VandenBrink | Hashes in PowerShell |
| 2020-05-15/a> | Rob VandenBrink | SHA3 Hashes (on Windows) - Where Art Thou? |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-24/a> | Xavier Mertens | Malicious Excel With a Strong Obfuscation and Sandbox Evasion |
| 2020-04-17/a> | Xavier Mertens | Weaponized RTF Document Generator & Mailer in PowerShell |
| 2020-04-10/a> | Xavier Mertens | PowerShell Sample Extracting Payload From SSL |
| 2020-02-28/a> | Xavier Mertens | Show me Your Clipboard Data! |
| 2020-01-23/a> | Xavier Mertens | Complex Obfuscation VS Simple Trick |
| 2019-12-26/a> | Xavier Mertens | Bypassing UAC to Install a Cryptominer |
| 2019-12-09/a> | Didier Stevens | (Lazy) Sunday Maldoc Analysis |
| 2019-10-27/a> | Didier Stevens | Using scdbg to Find Shellcode |
| 2019-10-25/a> | Rob VandenBrink | More on DNS Archeology (with PowerShell) |
| 2019-09-17/a> | Rob VandenBrink | Investigating Gaps in your Windows Event Logs |
| 2019-07-28/a> | Didier Stevens | Video: Analyzing Compressed PowerShell Scripts |
| 2019-07-11/a> | Xavier Mertens | Russian Dolls Malicious Script Delivering Ursnif |
| 2019-07-10/a> | Rob VandenBrink | Dumping File Contents in Hex (in PowerShell) |
| 2019-06-28/a> | Rob VandenBrink | Verifying Running Processes against VirusTotal - Domain-Wide |
| 2019-06-27/a> | Rob VandenBrink | Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell |
| 2019-06-21/a> | Rob VandenBrink | Netstat Local and Remote -new and improved, now with more PowerShell! |
| 2019-06-03/a> | Didier Stevens | Tip: BASE64 Encoded PowerShell Scripts are Recognizable by the Amount of Letter As |
| 2019-05-31/a> | Didier Stevens | Retrieving Second Stage Payload with Ncat |
| 2019-05-30/a> | Didier Stevens | Analyzing First Stage Shellcode |
| 2019-05-28/a> | Didier Stevens | Office Document & BASE64? PowerShell! |
| 2019-04-25/a> | Rob VandenBrink | Service Accounts Redux - Collecting Service Accounts with PowerShell |
| 2019-04-24/a> | Rob VandenBrink | Where have all the Domain Admins gone? Rooting out Unwanted Domain Administrators |
| 2019-04-04/a> | Xavier Mertens | New Waves of Scans Detected by an Old Rule |
| 2019-03-30/a> | Didier Stevens | "404" is not Malware |
| 2019-03-20/a> | Rob VandenBrink | Using AD to find hosts that aren't in AD - fun with the [IPAddress] construct! |
| 2019-03-10/a> | Didier Stevens | Malicious HTA Analysis by a Reader |
| 2019-03-10/a> | Didier Stevens | Quick and Dirty Malicious HTA Analysis |
| 2019-03-05/a> | Rob VandenBrink | Powershell, Active Directory and the Windows Host Firewall |
| 2019-02-21/a> | Xavier Mertens | Simple Powershell Keyloggers are Back |
| 2019-02-17/a> | Didier Stevens | Video: Finding Property Values in Office Documents |
| 2019-02-16/a> | Didier Stevens | Finding Property Values in Office Documents |
| 2019-02-10/a> | Didier Stevens | Video: Maldoc Analysis of the Weekend |
| 2019-02-09/a> | Didier Stevens | Maldoc Analysis of the Weekend |
| 2019-01-24/a> | Brad Duncan | Malspam with Word docs uses macro to run Powershell script and steal system data |
| 2019-01-14/a> | Rob VandenBrink | Microsoft LAPS - Blue Team / Red Team |
| 2019-01-02/a> | Didier Stevens | Maldoc with Nonfunctional Shellcode |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-19/a> | Xavier Mertens | Restricting PowerShell Capabilities with NetSh |
| 2018-12-15/a> | Didier Stevens | De-DOSfuscation Example |
| 2018-12-12/a> | Didier Stevens | Yet Another DOSfuscation Sample |
| 2018-12-03/a> | Didier Stevens | Word maldoc: yet another place to hide a command |
| 2018-11-27/a> | Xavier Mertens | More obfuscated shell scripts: Fake MacOS Flash update |
| 2018-11-26/a> | Xavier Mertens | Obfuscated bash script targeting QNap boxes |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-16/a> | Xavier Mertens | Basic Obfuscation With Permissive Languages |
| 2018-11-06/a> | Xavier Mertens | Malicious Powershell Script Dissection |
| 2018-10-26/a> | Xavier Mertens | Dissecting Malicious Office Documents with Linux |
| 2018-10-22/a> | Xavier Mertens | Malicious Powershell using a Decoy Picture |
| 2018-09-30/a> | Didier Stevens | When DOSfuscation Helps... |
| 2018-09-24/a> | Didier Stevens | Analyzing Encoded Shellcode with scdbg |
| 2018-09-08/a> | Didier Stevens | Video: Using scdbg to analyze shellcode |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-09-03/a> | Didier Stevens | Another quickie: Using scdbg to analyze shellcode |
| 2018-08-31/a> | Jim Clausing | Quickie: Using radare2 to disassemble shellcode |
| 2018-07-30/a> | Didier Stevens | Malicious Word documents using DOSfuscation |
| 2018-07-26/a> | Xavier Mertens | Windows Batch File Deobfuscation |
| 2018-06-19/a> | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
| 2018-06-04/a> | Rob VandenBrink | Digging into Authenticode Certificates |
| 2018-05-19/a> | Xavier Mertens | Malicious Powershell Targeting UK Bank Customers |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-06/a> | Guy Bruneau | Scans Attempting to use PowerShell to Download PHP Script |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-11/a> | Xavier Mertens | Keep An Eye on your Root Certificates |
| 2017-10-31/a> | Xavier Mertens | Some Powershell Malicious Code |
| 2017-09-14/a> | Xavier Mertens | Another webshell, another backdoor! |
| 2017-09-11/a> | Russ McRee | Windows Auditing with WINspect |
| 2017-08-23/a> | Xavier Mertens | Malicious script dropping an executable signed by Avast? |
| 2017-08-20/a> | Didier Stevens | It's Not An Invoice ... |
| 2017-08-01/a> | Rob VandenBrink | Rooting Out Hosts that Support Older Samba Versions |
| 2017-05-12/a> | Xavier Mertens | When Bad Guys are Pwning Bad Guys... |
| 2017-05-03/a> | Bojan Zdrnja | Powershelling with exploits |
| 2017-03-30/a> | Xavier Mertens | Diverting built-in features for the bad |
| 2017-02-28/a> | Xavier Mertens | Analysis of a Simple PHP Backdoor |
| 2017-02-17/a> | Rob VandenBrink | RTRBK - Router / Switch / Firewall Backups in PowerShell (tool drop) |
| 2016-12-02/a> | Rob VandenBrink | Protecting Powershell Credentials (NOT) |
| 2016-11-24/a> | Didier Stevens | Extracting Shellcode From JavaScript |
| 2016-11-23/a> | Tom Webb | Mapping Attack Methodology to Controls |
| 2016-11-18/a> | Didier Stevens | VBA Shellcode and Windows 10 |
| 2016-10-31/a> | Russ McRee | SEC505 DFIR capture script: snapshot.ps1 |
| 2016-07-13/a> | Xavier Mertens | The Power of Web Shells |
| 2016-06-03/a> | Tom Liston | MySQL is YourSQL |
| 2016-04-28/a> | Rob VandenBrink | DNS and DHCP Recon using Powershell |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2016-01-26/a> | Rob VandenBrink | Pentest Time Machine: NMAP + Powershell + whatever tool is next |
| 2016-01-25/a> | Rob VandenBrink | Assessing Remote Certificates with Powershell |
| 2016-01-19/a> | Rob VandenBrink | Powershell and HTTPS ? It Ain?t All Rainbows And Lollipops! (or is it?) |
| 2016-01-06/a> | Russ McRee | toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics |
| 2015-12-14/a> | Russ McRee | AD Security's Unofficial Guide to Mimikatz & Command Reference |
| 2015-12-10/a> | Rob VandenBrink | Uninstalling Problem Applications using Powershell |
| 2015-12-09/a> | Xavier Mertens | Enforcing USB Storage Policy with PowerShell |
| 2015-12-02/a> | Rob VandenBrink | Nessus and Powershell is like Chocolate and Peanut Butter! |
| 2015-08-12/a> | Rob VandenBrink | Windows Service Accounts - Why They're Evil and Why Pentesters Love them! |
| 2015-06-29/a> | Rob VandenBrink | The Powershell Diaries 2 - Software Inventory |
| 2015-06-24/a> | Rob VandenBrink | The Powershell Diaries - Finding Problem User Accounts in AD |
| 2015-03-30/a> | Didier Stevens | YARA Rules For Shellcode |
| 2015-02-03/a> | Johannes Ullrich | Another Network Forensic Tool for the Toolbox - Dshell |
| 2014-10-24/a> | Kevin Liston | Shellshock via SMTP |
| 2014-10-23/a> | Russ McRee | Digest: 23 OCT 2014 |
| 2014-10-06/a> | Johannes Ullrich | Shellshock: More details released about CVE-2014-6277 and CVE-2014-6278. Also: Does Windows have a shellshock problem? |
| 2014-10-01/a> | Russ McRee | Security Onion news: Updated ShellShock detection scripts for Bro |
| 2014-09-29/a> | Johannes Ullrich | Apple Released Update to Fix Shellshock Vulnerability http://support.apple.com/kb/DL1769 |
| 2014-09-25/a> | Johannes Ullrich | Update on CVE-2014-6271: Vulnerability in bash (shellshock) |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2013-10-26/a> | Guy Bruneau | Active Perl/Shellbot Trojan |
| 2013-06-25/a> | Bojan Zdrnja | The race for resources |
| 2013-02-28/a> | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
| 2012-04-25/a> | Daniel Wesemann | Blacole's shell code |
| 2011-11-10/a> | Rob VandenBrink | Stuff I Learned Scripting - - Parsing XML in a One-Liner |
| 2009-10-17/a> | Rick Wanner | Cyber Security Awareness Month - Day 17 - Port 22/SSH |
| 2009-07-05/a> | Bojan Zdrnja | More on ColdFusion hacks |
