My colleague @mgreen27 published velociraptor-skills, a set of reusable AI skills for DFIR with Velociraptor. These skills guide artifact selection, collection, hunting, analysis, and context management. They use a shared Python harness, vraptor, through a command-line interface rather than an MCP server or individual AI tools. The goal of using a separate harness is to optimize token use, control performance, and standardize the format of generated analysis notes. Read the full blog post here: labs.infoguard.ch/posts/ai_a…

In a recent ISC SANS Diary, @xme 🇧🇪 discussed a malicious ZIP archive that led to Remcos, a pretty common RAT. As Xavier noted, "Most of the files used in this infection path remain undetected by most AVs." [1] PowerShell, AppData, Dynamic DNS, and Run Key as a persistence mechanism. Four of the eight areas I covered in my first blog post, N-IOCs to Rule Them All [2]. The information presented remains relevant, and finding such infections is not as hard as it sounds, even if they might bypass AV rules and signatures. [1] isc.sans.edu/diary/From+a+VH… [2] dfir.ch/posts/n-iocs/

We recently analyzed an interesting piece of malware that utilizes the legitimate JavaScript runtime, Deno. The malware was used as a first-stage implant after the user was tricked into downloading and running the malware. Read the full article here: labs.infoguard.ch/posts/anat…

Here’s another IG Labs post. After my teammate Evgen published his research on ViperTunnel last week, my other teammate, @schnee_FLO_cke, published a blog post today on BravoX, a ransomware-as-a-service (RaaS) provider. Well done - such a great team! :) labs.infoguard.ch/posts/brav…

My teammate Evgen has written a really interesting blog post about VIPERTUNNEL. He’s also presented his research at various BSides conferences this year. 💪 We have an opening on our Incident Response Team for anyone interested in working with such talented colleagues. Although our team is English-speaking, we are specifically looking for a German-speaking analyst for this position (C2 level is a must; the job is based in the DACH region). 📷

"Reverse Evidence", Log clearing, Anti-Forensics. VoidLink – A Stealthy, Cloud-Native Linux Malware Framework discovered by Check Point this week - is equipped with techniques to delete or manipulate logs and traces, making it harder for Incident Response teams or security software to find forensic evidence. I will be teaching my new course, Anti-Forensics (and Anti-Anti-Forensics) Techniques for Incident Responders, in Belgium this April at the BruCON Training (Spring Training 22-23 April), presenting a wide range of anti-forensic techniques and how to analyze your way around them. Sign up to learn more about how to defeat modern threats 🤓 Here is the link to the training: brucon.org/training-details/…

Calling out for help. We have proof that a threat actor exfiltrated data to a Microsoft Azure Blob, thanks to detailed logs in the *.log files written by azcopy, for example: C:\Users\compromised_user\.azcopy\1323eb6d-2624-834e-45e0-218454b383be.log We see the blob name where the data was exfiltrated to, and exactly which files the threat actor copied, thanks to the excessive logging. We reached out to our Microsoft contacts for a takedown of the blob (and, with it, a takedown of the stolen data), and the answer was, disillusioning, to say the least. Microsoft is sending us down a Kafka-esque road, with the chances of a takedown slim to non-existent. Is that really the best they can do? Who from Microsoft is reading this message and could potentially speed up our case?

Two of my teammates published artifacts on the Velociraptor Exchange this week 💪 @Mirwitch released several VHDX artifacts, as described in his detailed blog post. [1] @mgreen27 continues rocking here at InfoGuard by publishing the Windows.Detection.HyperV artifact, designed to “scope suspicious Hyper-V worker processes and activity on Windows workstations.” [2] Well done! 👏 Thank you both 🥇 [1] labs.infoguard.ch/posts/auto… [2] docs.velociraptor.app/exchan…

My colleague @p0w1_ keeps on finding flaws and vulnerabilities in EDRs, as if it were a stroll in the park 😂 well done - keep up the pace!

Yesterday, I presented "Anti-Forensic" techniques for Windows and Linux at the Troopers conference in Heidelberg. This morning at breakfast, I was approached by an attendee and asked if I had looked at the zapper tool from The Hacker's Choice. [1] I said no, but of course, my interest was piqued 🕵 The tool's description on GitHub states: A Linux tool to hide from 'ps'. And that's exactly what it does very well. As in the example from GitHub, I have started a tmux session in my lab, and based solely on the ps output, it is not possible to determine whether tmux is running. However, /proc to the rescue 🥳. The exe link in one of the (malmoeb) /proc process folders points to tmux, and this way, we could find out relatively quickly what is running behind the process, even if we don't have the command line from the process available. My team colleague, @hackerkartellet, and I have talked intensively about /proc, available on YouTube. [2] [1] github.com/hackerschoice/zap… [2] youtube.com/watch?v=eeYptKew…