montysecurity – Medium

Nov 16

Hunting Sandworm Team’s TTPs

Introduction This post is the result of reviewing the references for Sandworm Team’s MITRE Group page (as of November 2023). Searches are provided in KQL for Defender for Endpoint. A few notes: This does not cover every TTP they use. The focus is on process events. No attribution work was done…

Threat Hunting

6 min read

Threat Hunting

6 min read

Nov 2

From LNK Payload to Infostealer Source Code

Introduction As I have so creatively named this blog post, we are starting with a ZIP/LNK payload and, with some luck, we will end up identifying the infostealer that is being dropped and its source code. Starting with the zip file shown below. Analysis Using the VT link to get the…

Threat Intelligence

4 min read

From LNK Payload to Infostealer Source Code

Threat Intelligence

4 min read

Oct 26

Evasion by Annoyance: When LNK Payloads Are Too Long

Introduction I was analyzing this sample from the Malware Hunter Team and ran into hours of trouble trying to parse the full payload out of the LNK file because it is unusually long. I will go through my troubleshooting process and showcase how I managed to finally pull the whole payload…

Malware

4 min read

Evasion by Annoyance: When LNK Payloads Are Too Long

Malware

4 min read

Oct 19

Analyzing a Multi-Stage LNK Dropper

Introduction LNK files are Windows shortcut files that are common during initial access. The Malware Hunter Team recently tweeted about a sample. …

Malware

5 min read

Malware

5 min read

Aug 5

A Practical Guide to Threat Hunting in Process Data

Introduction This post aims to provide a core set of ideas for threat hunting — particularly in an intel-driven fashion. The intended audiences are detection engineers, threat hunters, and those aspiring to be one of the two. It will also examine the traditional nomenclature of TTPs (Tactics, Techniques, and Procedures) and…

Threat Hunting

10 min read

Threat Hunting

10 min read

Published in

OSINT TEAM

·Jun 29

Hunting via Google Trends

This is an account of how I stumbled across a proxy tool that has seen some (ab)use using Google Trends. In retrospect, I realized that examining Google Trends data could yield insight into popular software for a given region, which then can be hunted for. What is Popular? So, out of curiosity, I…

Osint

3 min read

Osint

3 min read

May 23

Hunting Lazarus Group’s TTPs

Introduction This aims to serve as a repo of procedures attributed to Lazarus Group activity that can immediately be actioned on by threat hunters given the right logs. Along with each TTP is at least one potential way to hunt for the activity. Let me be clear, you can run all…

Cti

5 min read

Cti

5 min read

Dec 18, 2022

Identifying Phishing Pages with Shodan

Methodology In an effort to proactively identify phishing pages on the internet, I took to Shodan and started crafting queries to identify pages targeting Microsoft and Google. As with everything else in security, there is no sliver bullet. …

Threat Intelligence

5 min read

Threat Intelligence

5 min read