I’ll be presenting at #GrrCON this year about some weird pdf detection ideas I’ve been messing with. Swing by and tell me your file format

People love people who use ms paint.

We don’t need AI for shitty art

Cooking up signatures

Idk about y’all but I don’t plan on giving RU ops a free pass into our customer networks just because some ding dong says they aren’t a threat

If anything I might just wanna burn them with more prejudice out of spite for both regimes

QR codes can be tricky just because the benign and malicious ones can be very similar. But you can use something like halogen to help generate the yara rules for testing it out. github.com/target/halogen

Check this episode out to hear about image lures and how we can detect them

www.virustotal.com/gui/file/f2a...

Also expecting to see indiandefenceforces[.]link soon

Haven’t seen PDFs for this yet but a new domain popped: defenceindia[.]link

departmentofdefence[.]link 🧐

Yara rule to match concatenated zip files. I like this one (biased) because of how we are able to avoid matching nested zip files.

More info: x.com/threatinsigh...

#yara github.com/EmergingThre...