malmoeb.bsky.social
@malmoeb.bsky.social
Head of Investigations at InfoGuard AG - dfir.ch
I recently thought about the different pop-ups I receive every day on my Mac, AND how malware does the same to trick people into entering their password.. and I wondered if I could tell a legitimate prompt from a malicious one. I found a good article, depicting exactly this topic:
December 28, 2025 at 9:18 AM
I recently thought about the different pop-ups I receive every day on my Mac, AND how malware does the same to trick people into entering their password.. and I wondered if I could tell a legitimate prompt from a malicious one. I found a good article, depicting exactly this topic:
As last time, the TA brought infected files into the compromised network, helping spread the infection. The file and registry paths have not changed in our case and are still the same as in my old X post.
December 27, 2025 at 8:13 AM
As last time, the TA brought infected files into the compromised network, helping spread the infection. The file and registry paths have not changed in our case and are still the same as in my old X post.
The company, for whatever reason, turned off logging for Logons, as a quick check with auditpol revealed (see image). However, "Logon and Logoff" auditing is enabled by default. [1]
You might want to consider checking your audit policy settings before writing yet another playbook 🤓
You might want to consider checking your audit policy settings before writing yet another playbook 🤓
December 26, 2025 at 1:48 PM
The company, for whatever reason, turned off logging for Logons, as a quick check with auditpol revealed (see image). However, "Logon and Logoff" auditing is enabled by default. [1]
You might want to consider checking your audit policy settings before writing yet another playbook 🤓
You might want to consider checking your audit policy settings before writing yet another playbook 🤓
Adversaries can exploit these files to maintain persistence by injecting malicious code." [1]
Path: C:\ProgramData\cp49s\Lib\sitecustomize[.]py
Content: See the image below.
Path: C:\ProgramData\cp49s\Lib\sitecustomize[.]py
Content: See the image below.
December 25, 2025 at 9:01 AM
Adversaries can exploit these files to maintain persistence by injecting malicious code." [1]
Path: C:\ProgramData\cp49s\Lib\sitecustomize[.]py
Content: See the image below.
Path: C:\ProgramData\cp49s\Lib\sitecustomize[.]py
Content: See the image below.
My team colleague, Yann Malherbe, worked on a case where the attacker used Everything [1] (locate files and folders by name instantly) to search for password files on the beachhead.
December 14, 2025 at 7:18 AM
My team colleague, Yann Malherbe, worked on a case where the attacker used Everything [1] (locate files and folders by name instantly) to search for password files on the beachhead.
The picture below depicts a (malicious) Inbox Rule. I slightly modified this Inbox Rule to protect our customer, but the gist is that it filters incoming mail from a specific bank employee, moves it to the RSS Folder, and marks it as read.
December 13, 2025 at 9:39 AM
The picture below depicts a (malicious) Inbox Rule. I slightly modified this Inbox Rule to protect our customer, but the gist is that it filters incoming mail from a specific bank employee, moves it to the RSS Folder, and marks it as read.
For a new project, I started to dig into older threat reports, like for example, "The ProjectSauron APT" from 2016. [1]
The interesting thing about these old reports is that you see techniques mentioned before that are still used 10 years later.
The interesting thing about these old reports is that you see techniques mentioned before that are still used 10 years later.
December 12, 2025 at 9:15 AM
For a new project, I started to dig into older threat reports, like for example, "The ProjectSauron APT" from 2016. [1]
The interesting thing about these old reports is that you see techniques mentioned before that are still used 10 years later.
The interesting thing about these old reports is that you see techniques mentioned before that are still used 10 years later.
We are familiar with eMClient and axios, so let me introduce Trufflehog, the new kid on the block.
Trufflehog made headlines during the recent "Shai-Hulud" campaign, in which threat actors used it to search for passwords and sensitive information. [1] According to the Trufflehog GitHub page:
Trufflehog made headlines during the recent "Shai-Hulud" campaign, in which threat actors used it to search for passwords and sensitive information. [1] According to the Trufflehog GitHub page:
December 11, 2025 at 6:08 AM
We are familiar with eMClient and axios, so let me introduce Trufflehog, the new kid on the block.
Trufflehog made headlines during the recent "Shai-Hulud" campaign, in which threat actors used it to search for passwords and sensitive information. [1] According to the Trufflehog GitHub page:
Trufflehog made headlines during the recent "Shai-Hulud" campaign, in which threat actors used it to search for passwords and sensitive information. [1] According to the Trufflehog GitHub page:
I was playing around with bincrypter from THC (The Hackers Choice) [1]. The interesting points, as you can see in the screenshot below, are that the binary is encrypted, obfuscated, and 100% in memory. No temporary files, etc.
December 7, 2025 at 10:20 AM
I was playing around with bincrypter from THC (The Hackers Choice) [1]. The interesting points, as you can see in the screenshot below, are that the binary is encrypted, obfuscated, and 100% in memory. No temporary files, etc.
Look at my tweet from February 2022. As simple as putting NG into the country field.
Guess what I found in this week's Business E-Mail Compromise? Successful logins from NG. Oh well..
Guess what I found in this week's Business E-Mail Compromise? Successful logins from NG. Oh well..
November 30, 2025 at 4:47 PM
Look at my tweet from February 2022. As simple as putting NG into the country field.
Guess what I found in this week's Business E-Mail Compromise? Successful logins from NG. Oh well..
Guess what I found in this week's Business E-Mail Compromise? Successful logins from NG. Oh well..
I was reading an older report from CrowdStrike the other day:
"CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]
"CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]
November 25, 2025 at 9:40 AM
I was reading an older report from CrowdStrike the other day:
"CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]
"CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]
A customer sent malware over. The file magic was CART.. What's that? Turns out, something pretty cool.
"This is where CaRT (which stands for Compressed and RC4 Transport) comes in. CaRT is used to store and transfer malware, as well as its metadata.
"This is where CaRT (which stands for Compressed and RC4 Transport) comes in. CaRT is used to store and transfer malware, as well as its metadata.
November 24, 2025 at 3:23 PM
A customer sent malware over. The file magic was CART.. What's that? Turns out, something pretty cool.
"This is where CaRT (which stands for Compressed and RC4 Transport) comes in. CaRT is used to store and transfer malware, as well as its metadata.
"This is where CaRT (which stands for Compressed and RC4 Transport) comes in. CaRT is used to store and transfer malware, as well as its metadata.
I analyzed and recreated (a simpler version) of a PHP backdoor we detected in a recent Incident Response engagement. I used the backdoor to install an RMM agent on the compromised machine; the installed EDR did not raise a single alert.
November 17, 2025 at 8:09 AM
I analyzed and recreated (a simpler version) of a PHP backdoor we detected in a recent Incident Response engagement. I used the backdoor to install an RMM agent on the compromised machine; the installed EDR did not raise a single alert.
I love reading Incident Response reports from my colleagues. This one here from Matthieu Chatelan:
"Note that over 1700 lines (of risky sign-ins) were generated for this user account over the last 3 months.
"Note that over 1700 lines (of risky sign-ins) were generated for this user account over the last 3 months.
November 15, 2025 at 8:33 AM
I love reading Incident Response reports from my colleagues. This one here from Matthieu Chatelan:
"Note that over 1700 lines (of risky sign-ins) were generated for this user account over the last 3 months.
"Note that over 1700 lines (of risky sign-ins) were generated for this user account over the last 3 months.
taskhostw.exe writes a PE file (see the classic TVqQAAMAAAA sequence there) inside the UCPD\DR registry key?
Microsoft implemented a driver-based protection to block changes to http/https and .pdf associations by 3rd party utilities, the so-called UCPD driver (UserChoice Protection Drive).
Microsoft implemented a driver-based protection to block changes to http/https and .pdf associations by 3rd party utilities, the so-called UCPD driver (UserChoice Protection Drive).
November 12, 2025 at 5:33 PM
taskhostw.exe writes a PE file (see the classic TVqQAAMAAAA sequence there) inside the UCPD\DR registry key?
Microsoft implemented a driver-based protection to block changes to http/https and .pdf associations by 3rd party utilities, the so-called UCPD driver (UserChoice Protection Drive).
Microsoft implemented a driver-based protection to block changes to http/https and .pdf associations by 3rd party utilities, the so-called UCPD driver (UserChoice Protection Drive).
This slide also didn't make the cut. Yes, anyone who has spent more than five minutes on a Hack The Box machine will know pspy, but what about my blue-team colleagues?
November 11, 2025 at 7:53 AM
This slide also didn't make the cut. Yes, anyone who has spent more than five minutes on a Hack The Box machine will know pspy, but what about my blue-team colleagues?
The following slide hasn't made it into my "Fantastic cleartext password" talk, however, it's still a good one to share 🤓
"This simple tool logs usernames and passwords from authentication attempts against an OpenSSH server you control.
"This simple tool logs usernames and passwords from authentication attempts against an OpenSSH server you control.
November 10, 2025 at 2:37 PM
The following slide hasn't made it into my "Fantastic cleartext password" talk, however, it's still a good one to share 🤓
"This simple tool logs usernames and passwords from authentication attempts against an OpenSSH server you control.
"This simple tool logs usernames and passwords from authentication attempts against an OpenSSH server you control.
Dropping ngrok in a ZIP file onto disk results in the file being removed and an alert being raised, but installing ngrok via winget works just fine? 🤔🤷♂️
November 2, 2025 at 7:12 PM
Dropping ngrok in a ZIP file onto disk results in the file being removed and an alert being raised, but installing ngrok via winget works just fine? 🤔🤷♂️
This one here is a goodie! A customer called us because they had several incidents where the system time "magically" jumped days, sometimes even months, back and forth (see screenshot). You can imagine the issues inflicted by this behavior. So the question was.. Cyber? Attacker? Misconfiguration?
November 1, 2025 at 12:56 PM
This one here is a goodie! A customer called us because they had several incidents where the system time "magically" jumped days, sometimes even months, back and forth (see screenshot). You can imagine the issues inflicted by this behavior. So the question was.. Cyber? Attacker? Misconfiguration?
Coming back to Maester! Do you know about the awesome Conditional Access What-If tests? [1]
The first image is from the official documentation and shows how easily you can build your own test scenario. The second image shows the results from a tenant where I ran the test.
The first image is from the official documentation and shows how easily you can build your own test scenario. The second image shows the results from a tenant where I ran the test.
October 24, 2025 at 8:22 AM
Coming back to Maester! Do you know about the awesome Conditional Access What-If tests? [1]
The first image is from the official documentation and shows how easily you can build your own test scenario. The second image shows the results from a tenant where I ran the test.
The first image is from the official documentation and shows how easily you can build your own test scenario. The second image shows the results from a tenant where I ran the test.
What is Maester? [1]
Maester is a PowerShell-based test automation framework that helps you stay in control of your Microsoft security configuration. Such a cool tool - test details can be filtered by passed, failed, and skipped. Failed tests come with detailed recommendations on how to do better.
Maester is a PowerShell-based test automation framework that helps you stay in control of your Microsoft security configuration. Such a cool tool - test details can be filtered by passed, failed, and skipped. Failed tests come with detailed recommendations on how to do better.
October 23, 2025 at 6:14 AM
What is Maester? [1]
Maester is a PowerShell-based test automation framework that helps you stay in control of your Microsoft security configuration. Such a cool tool - test details can be filtered by passed, failed, and skipped. Failed tests come with detailed recommendations on how to do better.
Maester is a PowerShell-based test automation framework that helps you stay in control of your Microsoft security configuration. Such a cool tool - test details can be filtered by passed, failed, and skipped. Failed tests come with detailed recommendations on how to do better.
Lately, I’ve talked about (alternative) forensic artifacts where the retention time might be higher than your classical Security Event Logs, or might not be the first artifact to be deleted in an "anti-forensics" operation by a threat actor.
October 21, 2025 at 5:58 AM
Lately, I’ve talked about (alternative) forensic artifacts where the retention time might be higher than your classical Security Event Logs, or might not be the first artifact to be deleted in an "anti-forensics" operation by a threat actor.
In various business email compromise (BEC) cases, we later discovered that although the customer had set up a conditional access (CA) policy to enforce multi-factor authentication, mistakes had been made during the implementation of said policies.
October 20, 2025 at 6:18 AM
In various business email compromise (BEC) cases, we later discovered that although the customer had set up a conditional access (CA) policy to enforce multi-factor authentication, mistakes had been made during the implementation of said policies.
Second story from a recent coffee break with my pentest colleague. During a retest for a client, they discovered the same ESC1 vulnerability they had reported before. Why is that dangerous and also super critical?
October 18, 2025 at 6:46 AM
Second story from a recent coffee break with my pentest colleague. During a retest for a client, they discovered the same ESC1 vulnerability they had reported before. Why is that dangerous and also super critical?
1/ Coffee break with one of our pentesters. He casually mentioned to me, "The last attack simulation was pretty cool. We used gowitness (a website screenshot utility written in Golang, to generate screenshots of web interfaces) to find internal services [1].
October 17, 2025 at 6:45 AM
1/ Coffee break with one of our pentesters. He casually mentioned to me, "The last attack simulation was pretty cool. We used gowitness (a website screenshot utility written in Golang, to generate screenshots of web interfaces) to find internal services [1].