#malware-analysis
21 resources
Results
- abusing-dpapi-for-credential-access
After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.
- abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or…
- analyzing-apt-group-with-mitre-navigator
When investigating security incidents that require analyzing apt group with mitre navigator - When building detection rules or threat…
- analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence,…
- analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses…
- analyzing-certificate-transparency-for-phishing
When investigating security incidents that require analyzing certificate transparency for phishing - When building detection rules or…
- analyzing-cobalt-strike-beacon-configuration
When investigating security incidents that require analyzing cobalt strike beacon configuration - When building detection rules or threat…
- analyzing-command-and-control-communication
Reverse engineering a malware sample has revealed network communication that needs protocol analysis - Building network-level detection…
- analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata…
- analyzing-dns-logs-for-exfiltration
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query…
- analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC…
- analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g.
- analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass…
- analyzing-linux-elf-malware
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure —…
- analyzing-linux-kernel-rootkits
When investigating security incidents that require analyzing linux kernel rootkits - When building detection rules or threat hunting…
- analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file…
- analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects.
- analyzing-malicious-url-with-urlscan
When investigating security incidents that require analyzing malicious url with urlscan - When building detection rules or threat hunting…
- analyzing-malware-behavior-with-cuckoo-sandbox
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and…
- analyzing-malware-family-relationships-with-malpedia
Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat…
- writing-a-malware-analysis-report
You have completed static, dynamic, or reverse-engineering analysis and need to communicate findings to responders, detection engineers,…
