dfir.ch

feed🛡️ Securitydfir.ch ↗

52 posts in the catalog

Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.

dfir.chwriteup

Modern Authentication, Legacy Problems

Field note from an incident response case in a hybrid on-premises Exchange environment where Hybrid Modern Authentication and Entra MFA were enforced, yet 66,610 EWS requests from a Thunderbird user-agent authenticated with NTLM. OWA also accepted forms-based authentication directly. It shows how to find these paths in Exchange HttpProxy logs, check virtual directories and authentication policies, and block legacy authentication.

Microsoft ExchangeMicrosoft Entra IDOAuth+3

NTLMHybrid Modern AuthenticationExchange Web Services+5

Blue Team & Detection, Identity & Access· 2026-11-01T06:58:20+00:00

dfir.chwriteup

Abusing Linux fanotify for Anti-Forensics

Abusing Linux fanotify for anti-forensics: a privileged userspace process can use the fanotify API to deny other processes the right to open an otherwise normal file. Reads fail with EPERM even for root, while name, ownership, timestamps and permissions look ordinary, so a scanner that cannot open a file may report no detections without inspecting it. Defenders can find malicious fanotify groups and marks via /proc/<pid>/fdinfo, or acquire at the filesystem level instead of opening the pathname.

Linuxfanotify

InfoGuard Labsanti-forensics

Blue Team & Detection, Offensive Security· 2026-10-24T17:58:20+00:00

dfir.chwriteup

Field Notes: Reconstructing an Attacker’s Workflow

Field note from dfir.ch on PowerShell scripts an attacker left on disk during an incident: a file-watching command runner using Invoke-Expression, a fake Windows credential prompt that validates passwords via Start-Process and logs them in cleartext, AD computer enumeration with WMI access testing, and SMB share discovery via NetShareEnum. It notes where script labels overstate what they prove and lists hunting strings for Event IDs 4104, 4103, 4688 and Sysmon 1.

PowerShellActive DirectoryWMI+2

TerminalFixClickFixMicrosoft+7

Blue Team & Detection, Offensive Security· 2026-10-22T17:58:20+00:00

dfir.chwriteup

Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow

DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.

Microsoft IntuneNode.jsEthereum+3

EtherRATEtherHidingAtos Threat Research Center+4

Blue Team & Detection, Threat Intel, Malware & RE· 2026-10-13T23:58:20+00:00

dfir.chwriteup

Today I learned: Python's .start Files as a Persistence Mechanism

Explains PEP 829's new .start files in Python 3.15, which let a package register package.module:callable entries in site-packages that execute automatically every time an interpreter starts, before any user code runs. The author walks through a reproducible lab showing code execution via a .start file, contrasts it with the older executable-import .pth file technique it replaces, and gives forensic hunting commands (using python -S to avoid triggering the mechanism during investigation) to locate and audit .start files on disk.

Python

PEP 829

Blue Team & Detection, Offensive Security· 2026-10-04T14:04:20+00:00

dfir.chwriteup

Field Notes: Reconstructing the Attacker's LSASS Dump

DFIR.ch field notes on an incident where attackers used Ricardo J. Ruiz's TrickDump tool to dump LSASS without creating a conventional minidump file, instead leaving lock.json, shock.json, barrel.json and a ZIP of randomly-named memory-region chunks. The authors reconstructed the dump with TrickDump's create_dump.py and parsed it with pypykatz, confirming the attacker actually recovered reusable Kerberos credential material rather than just detecting that LSASS was touched. Includes hunting guidance (Sysmon EID 10 process-access telemetry, SeDebugPrivilege enablement, multi-binary workflows) and notes TrickDump fails against LSASS protected by PPL.

WindowsMimikatzKerberos+1

TrickDumpRicardo J. RuizPPL

Blue Team & Detection· 2026-09-30T23:58:20+00:00

dfir.chwriteup

Living Inside the Shell: zsh Modules on macOS

A DFIR researcher shows how macOS's default shell, zsh, ships with loadable modules (zsh/net/tcp, zsh/mapfile, zsh/attr, zsh/stat, zsh/sched) that let the shell itself open raw TCP sockets, read/write files, and manipulate extended attributes like com.apple.quarantine without spawning curl, xattr, rm, or nc. The post walks through a full example using ztcp and source /dev/fd/$fd to fetch and execute a second-stage payload directly from a socket (bootstrapping a LaunchAgent) with no downloaded file on disk and no child process, referencing the prior real-world use of zsh/net/tcp for reverse shells (documented by ESET and GTFOBins). It then validates via eslogger/Endpoint Security that DELETEEXTATTR/SETEXTATTR and similar operations remain visible even when performed through zsh builtins, arguing detections should target the underlying OS event rather than the specific binary invoked.

zshmacOS

ClickFixESETGTFOBins

Blue Team & Detection, Offensive Security· 2026-09-16T17:58:20+00:00

dfir.chwriteup

Field Notes: From AV Alert to Impacket

A DFIR field notes post describing how an analyst pivoted from a Microsoft Defender "Behavior:Win32/RegDump.SA" alert (flagged on svchost.exe running as SYSTEM) to identify Impacket's secretsdump.py activity. MFT analysis revealed a leftover temp file (ASOWCIKI.tmp) matching Impacket's RemoteOperations naming pattern (8 random ASCII chars + .tmp) for a partially-saved SAM registry hive, and the post explains why svchost.exe appears in telemetry due to the Remote Registry service being abused over MS-RRP/winreg via SMB. It also cross-references a similar Huntress case (April 2026) that additionally observed SCM Event ID 7040 (Remote Registry service enabled) as a corroborating artifact.

ImpacketMicrosoft DefenderHuntress+1

Behavior:Win32/RegDump.SAsecretsdump.pyMS-RRP+3

Blue Team & Detection· 2026-09-11T04:04:20+00:00

dfir.chwriteup

Field Notes: NSSM - the Non-Sucking Service Manager

A DFIR field notes post describing how attackers abuse NSSM (Non-Sucking Service Manager) to run tools like ngrok as a Windows service, hiding the real executable behind the legitimate nssm.exe ImagePath. It walks through hunting techniques: checking Event ID 7045 service-installation logs, inspecting the service's registry Parameters subkey to reveal the true application/arguments, and confirming via live process command-line analysis (Process Explorer, Velociraptor's Windows.System.Pslist), illustrated with a second real case where nssm.exe was wrapping a "komari-agent" implant.

WindowsVelociraptorngrok

komari-agentEvent ID 7045

Blue Team & Detection· 2026-07-27T04:04:20+00:00

dfir.chwriteup

Fantastic clear-text passwords and where to collect them (Part 2 - Windows)

A DFIR.ch deep-dive on stealthier alternatives to LSASS dumping for harvesting Windows cleartext credentials, covering WDigest re-enablement, PowerShell ConsoleHost_history.txt, AD user-attribute leaks, Group Policy Preferences (GPP) cPassword, and rogue Security Support Provider (SSP), Password Filter DLL, and Network Provider DLL registration. Each technique is illustrated with real incident-response case data (registry commands, malicious DLL names like kerberos_sp.dll and mimilib.dll, and exfiltrated log paths), paired with Sysmon Event ID 13/11 detection guidance and hardening recommendations (disabling custom SSPs, Protected Event Logging).

WindowsPowerShellActive Directory+3

CVE-2023-36036ProjectSauronRaccoon Stealer+3

Offensive Security, Blue Team & Detection· 2026-06-28T23:03:20+00:00

dfir.charticle

Fantastic clear-text passwords and where to collect them (Part 1 - Linux)

A DFIR-focused post cataloging real-world Linux clear-text credential harvesting techniques observed in incident response, including a case where a plaintext Java Keystore password in root's bash history led to full Azure tenant compromise via Siemens OpenScape/Exchange integration. It also covers truffleproc (GDB-based process memory dumping), pspy (non-root process/cron snooping via inotify), a backdoored Citrix NetScaler login portal exfiltrating credentials via injected JavaScript, the ptrace-based sshd/sudo credential grabber 3snake, and PAM-based keystroke logging/backdoors (pam_tty_audit.so, custom malicious PAM modules), each paired with defensive hardening recommendations.

LinuxGDBSSH+3

Citrix NetScalerptraceLD_PRELOAD+6

Blue Team & Detection, Offensive Security· 2026-06-21T23:03:20+00:00

dfir.chwriteup

Anatomy of a Deno-Based Proxy & RAT

InfoGuard LABS DFIR analysis of an intrusion that combined mailbombing and Microsoft Teams IT-support impersonation to deliver a modular Deno-based RAT and network proxy. The malware splits functionality across four JavaScript files (app.js, back.js, helper.js, webui.js) that abuse Deno's permission model, use string-array-shifting obfuscation, communicate C2 over a CloudFront-fronted WebSocket, and expose loopback HTTP services for command execution (127.0.0.1:10021) and TCP tunneling/pivoting (127.0.0.1:10022). The post details persistence via the HKCU Run key, Teams impersonation telemetry (TeamsImpersonationDetected), and provides KQL hunting queries for Deno execution flags, CloudFront C2 traffic, and registry persistence.

DenoWindowsMicrosoft Teams+3

TeamsImpersonationDetectedd2cff16eusb8mg.cloudfront.netmailbombing

Malware & RE, Blue Team & Detection· 2026-06-15T08:03:20+00:00

dfir.chwriteup

Dissection of a PHP Backdoor leveraging php-win.exe

DFIR.ch details an incident response case where a PHP backdoor was executed via the GUI-mode php-win.exe (avoiding a visible console window) from a scheduled task named ClockLauncher. The malware stages its second-stage payload by parsing a utm_source parameter from a cutt.ly-shortened URL's redirect headers, double base64-decoding it, and eval()-ing the fetched code; the authors reproduce the technique in a lab and show it, plus a follow-on Bluetrait RMM agent install, went completely undetected by a tested EDR product.

PHPWindowscurl+2

ClockLauncherClockSystemServicecutt.ly

Blue Team & Detection, Malware & RE· 2025-11-16T14:04:20+00:00

dfir.chwriteup

Today I learned: binfmt_misc

A DFIR.ch researcher revisits and reproduces the 2019 SentinelOne Shadow SUID technique using the Linux binfmt_misc kernel feature: by registering a handler with the C (credentials) flag matched against a SUID binary magic bytes (chfn), an attacker-controlled interpreter dropped in /dev/shm inherits root privileges without ever setting the SUID bit itself. The post includes a full working PoC, notes the technique is absent from MITRE ATT&CK and Elastic Linux persistence detection series, and closes with input from Elastic researcher Ruben Groenewoud on why existing SUID/SGID detection rules fail to catch it because chfn is never actually executed, it is a proxy execution.

Linux kernelLinuxMITRE ATT&CK

Shadow SUIDSentinelOneRuben Groenewoud+2

Offensive Security, Blue Team & Detection· 2025-10-30T02:04:20+00:00

dfir.chwriteup

Linux Capabilities Revisited

A DFIR.ch technical walkthrough of Linux POSIX capabilities: how to weaponize cap_setuid on a binary like /usr/bin/python3.12 with setcap to create a stealthy root-spawning backdoor without touching SUID bits, then how defenders can hunt for these via getcap -r, /proc status Cap* fields, LinPEAS, and an Elastic detection rule that flags setcap process execution. It also explains where capabilities live on disk (the security.capability extended attribute on the inode) and how to inspect/remove them with getfattr and setcap -r.

LinuxLinux kernelPython+1

setcapgetcapcap_setuid+1

Offensive Security, Blue Team & Detection· 2025-05-16T01:04:20+00:00

dfir.chwriteup

Today I Learned - Protected Symlinks

A DFIR.ch blog post explaining the Linux kernel's protected_symlinks (fs.protected_symlinks) TOCTOU mitigation, then demonstrating a bypass: symlinks placed inside a subdirectory of /tmp (which doesn't inherit the sticky bit) are still followed across privilege boundaries. The author walks through reproducing CVE-2023-33865, a symlink vulnerability in RenderDoc's /tmp/RenderDoc log directory, showing how a local attacker can get an arbitrary file written with another user's privileges despite protected_symlinks being enabled, and traces the exact kernel source-code condition responsible.

Linux kernelSudo

CVE-2023-33865RenderDoc

Offensive Security· 2025-02-24T02:04:20+00:00

dfir.chwriteup

macOS Extended Attributes: Case Study

A DFIR.ch case study walks through macOS extended attributes (EAs) using xattr, ls, and mdfind to inspect metadata like com.apple.quarantine and com.apple.metadata:kMDItemWhereFroms on a downloaded Webex.dmg file. It shows how incident responders can query the LSQuarantineEvent SQLite database (~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV*) to recover download URLs and timestamps for forensic investigations, references a Velociraptor hunt (MacOS.System.QuarantineEvents) for automated parsing, and demonstrates removing the quarantine attribute with xattr -d to bypass Gatekeeper's download warning.

macOSSQLiteVelociraptor

Aurora

Blue Team & Detection· 2025-02-15T10:04:20+00:00

dfir.chwriteup

Tear Down The Castle - Part 2

Part 2 of a DFIR.ch series analyzing 250 PingCastle audit reports from real incident response and compromise assessment engagements, mapping findings to concrete AD attack techniques. It covers dangerous GPO-assigned privileges (e.g. SeLoadDriverPrivilege enabling BYOVD), Kerberoasting exposure in 95/250 domains, weak DES Kerberos encryption in 103/250, delegable admin accounts in 232/250, Print Spooler abuse chained with unconstrained delegation for DCSync (140/250), and lingering CVE-2021-34527 (PrintNightmare) and MS17-010 exposure on obsolete domain controllers.

Active DirectoryPingCastleKerberos+1

CVE-2021-34527PrintNightmareMS17-010+3

Offensive Security, Identity & Access· 2025-01-30T09:04:20+00:00

dfir.chwriteup

Oh my .. ! - Suspicious network traffic detected including Ransomware

A DFIR consultant walks through two Microsoft Defender for Endpoint high-severity "Ransomware" alerts that turned out to be benign inbound TCP SYN scans (ConnectionAttempt, not InboundConnectionAccepted) from an IP Microsoft had classified as malicious. The post shares KQL queries against DeviceNetworkEvents to identify internet-facing devices (via RemoteIPType and InboundInternetScanInspected), explains the difference between ConnectionAttempt and InboundConnectionAccepted ActionTypes, and stresses correlating with DeviceLogonEvents before concluding an alert is a false positive.

Windows DefenderKQLSysmon+1

Olaf HartongEDR Internals From a Defenders Perspective

Blue Team & Detection· 2025-01-22T10:04:20+00:00

dfir.chwriteup

Tear Down The Castle - Part 1

DFIR.ch analyzed 250 PingCastle audit reports collected from real incident response and compromise assessment engagements to quantify common Active Directory misconfigurations, mapping each finding to The Ten AD Commandments. It covers ADCS certificate template abuse (ENROLLEE_SUPPLIES_SUBJECT, referencing SpecterOps Certify tool and the Certified Pre-Owned research), Kerberoastable and over-privileged service accounts, weak or non-expiring passwords, missing LAPS and PowerShell script block logging, and unrestricted MachineAccountQuota, each with concrete affected-domain statistics from real-world cases.

Active DirectoryKerberosMimikatz+3

APT29SpecterOPSCertify+2

Offensive Security, Blue Team & Detection· 2025-01-19T02:04:20+00:00

dfir.chwriteup

Analysis of Python's .pth files as a persistence mechanism

dfir.ch dissects a Linux persistence technique first spotted by Volexity in a backdoor (update.py) that drops a malicious .pth file into Python's site-packages/dist-packages directories; because Python executes any line in a .pth file starting with 'import', the attacker gets code execution every time any process on the box imports a module. The author reproduces the technique end-to-end, building a base64-encoded netcat bind-shell payload embedded in a .pth file across multiple site-packages locations (including user-site under /root/.local), and discusses detection gaps (most DFIR tooling doesn't check .pth files) plus a related PYTHONPATH-hijacking technique from Itzik Kotler's SafeBreach talk.

PythonLinux

VolexityItzik KotlerSafeBreach

Offensive Security, Blue Team & Detection· 2025-01-14T01:04:20+00:00

dfir.chwriteup

Today I Learned - setfacl

A DFIR.ch blog post demonstrating how a root-level attacker can use setfacl to grant a low-privileged Linux user write access to /etc/passwd, then edit that user's UID to 0 for a stealthy root backdoor that bypasses traditional chmod-based permission checks. It also covers detection via an Elastic query for anomalous setfacl process execution and recommends running LinPEAS regularly and minimizing the acl package on sensitive systems.

LinuxElasticsearch

Offensive Security, Blue Team & Detection· 2024-12-17T06:04:20+00:00

dfir.chwriteup

Shell Script Compiler (shc)

A DFIR.ch analysis of shc (Shell Script Compiler), an open-source tool noted by Microsoft as being used by threat actors to compile shell-based backdoors into obfuscated, encrypted binaries. The post breaks down shc's anti-debugging technique — calling ptrace(PTRACE_TRACEME) so the binary self-kills if already traced by strace — and shows it can be bypassed by attaching a tracer after execution. It also demonstrates that despite the obfuscation, forensic artifacts such as process listings and /proc/<pid>/cmdline still expose the original decrypted command.

shcstrace

PTRACE_TRACEMESIGKILLanti-debugging

Malware & RE, Blue Team & Detection· 2024-12-11T12:04:20+00:00

dfir.chwriteup

Reptile's Custom Kernel-Module Launcher

A deep-dive analysis of the Reptile Linux rootkit's custom kernel-module launcher, which replaces insmod with a direct init_module syscall to load an XOR/rotate-encrypted kernel object compiled with a random per-build key. The author walks through the Makefile encryption step, the do_decrypt/custom_rol32 obfuscation routine, and the raw syscall macro that bypasses standard command-line loading, then shows why insmod-based detections (like a common Elastic rule) miss it and how auditd_manager rules watching init_module/finit_module syscalls (Elastic's Kernel Driver Load rule) can still catch it.

Linux kernelLinux

UNC3886ReptileMandiant

Malware & RE, Blue Team & Detection· 2024-11-10T12:04:20+00:00

dfir.chwriteup

bedevil: Dynamic Linker Patching

A deep technical analysis of the bedevil (bdvl) LD_PRELOAD rootkit's "dynamic linker patching" feature, which the threat actor Muddled Libra used against VMware vCenter servers. Instead of writing to /etc/ld.so.preload directly, bedevil binary-patches the system's ld.so dynamic linker files in place to point at a randomly-named preload path, evading common ld.so.preload/LD_PRELOAD detection checks. The post walks through bedevil's setup.py and ldpatch.h/patch.c source, then demonstrates investigation techniques — strace on the linker's initial access() call, rpm -V glibc/debsums integrity checks, and using statically linked find/strings/cp binaries to bypass the rootkit's hooked syscalls — and briefly notes the OrBit rootkit as a similar case.

Linux

Muddled Librabedevilbdvl+2

Blue Team & Detection, Malware & RE, Threat Intel· 2024-10-19T09:03:20+00:00

dfir.chwriteup

Microsoft Defender XDR's Deception Technology

A DFIR investigation into mysterious domain admin accounts (e.g. "amol.paulson") appearing across an organization's devices, traced back to Microsoft Defender XDR's built-in deception capability, which auto-generates decoy accounts and hosts as lures. The post details how to identify a decoy-account login via local (not network) authentication preceded by a specific PowerShell script execution, and decodes the base64 JSON descriptor blob (containing DetectionKeys, LureDeploymentContext, UserRid, etc.) that reveals which decoy account triggered the alert — useful so defenders don't mistake this feature for an intrusion.

Microsoft Defender XDRPowerShellActive Directory

Blue Team & Detection· 2024-10-10T08:04:20+00:00

dfir.chwriteup

tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)

A DFIR.ch blog post examining how the threat actor TeamTNT abuses tmate (instant terminal sharing tool) as a Linux backdoor after compromising servers, referencing prior TeamTNT reporting from Intezer, ASEC, and Aqua. The author demonstrates tmate installation/usage and walks through forensic artifacts left behind — process listings, apt logs, unattended-upgrades-dpkg.log, /proc/net/unix socket entries, and lsof output showing outgoing SSH connections to tmate's infrastructure — to help defenders and threat hunters detect active or past tmate-based backdoors.

tmateSSHsystemd+1

TeamTNT

Blue Team & Detection, Offensive Security· 2024-10-06T03:04:20+00:00

dfir.chwriteup

EDR: The Great Escape - RomHack Training Review

A DFIR consultant's detailed review of "EDR: The Great Escape," a RomHack training by RETooling's Silvio and Antonio, covering modern EDR/AV internals and evasion across four modules: minifilter driver whitelist/altitude bugs, hooking/unhooking (including VEH syscall triggering), ELAM and PPL, ETW muting via EtwUnregister, ROP-only process injection, kernel notify-routine/object-callback bypass (as implemented in EDRSandBlast), vulnerable driver exploitation for token theft, stack-spoofing techniques (Ekko, gargoyle, SilentMoonwalk, CallStackMasker, DeathSleep), local privilege escalation, memory-scanner evasion (vs moneta, pe-sieve), and .NET IL/JIT-hooking obfuscation (R2R stomping, MassLogger-style tricks). The course used the open-source openedr project as a reference architecture for labs. Written for both red and blue teams, it doubles as a map of concrete EDR blind spots and the tooling attackers use to exploit them.

WindowsWindows Defender.NET+1

EDRSandBlastopenedrDeathSleep+13

Offensive Security, Blue Team & Detection, Learning· 2024-09-30T09:04:20+00:00

dfir.chwriteup

Today I Learned - NSG Flow Log

A short DFIR.ch "Today I Learned" post walking through enabling Azure NSG Flow Logs (v2), storing them in a Storage Account, and parsing the flowTuple JSON schema (timestamp, src/dst IP/port, protocol, direction, allow/deny, flow state B/C/E). It highlights use cases like detecting RDP brute-force attempts and integrating logs into Sentinel/Splunk/ELK for network monitoring and incident response.

AzureAzure MonitorMicrosoft Sentinel+2

DefaultRule_AllowInternetOutBoundDefaultRule_DenyAllInBoundUserRule_RDP

Cloud & Infra, Blue Team & Detection· 2024-09-21T03:04:20+00:00

dfir.chwriteup

ScriptBlock Smuggling

A DFIR.ch lab writeup that tests BC-Security's ScriptBlock Smuggling technique, which abuses PowerShell's ScriptBlockAst to make malicious code execute while a spoofed benign-looking script gets written to the Script Block log (Event 4104), bypassing AMSI without reflection or memory patching. The author shows that while the 4104 log is indeed spoofed, PowerShell Module Logging (Event 4103) still captures the real executed code, and Windows Defender/AMSI flagged the test payload as Trojan:PowerShell/ScriptSmug.A, meaning defenders retain multiple detection opportunities. It also references an AtomicRedTeam test for the technique and notes in-the-wild adoption to deliver Vidar-Stealer.

PowerShellWindows DefenderSplunk

BC-SecurityVidar-StealerAtomicRedTeam+1

Blue Team & Detection, Offensive Security· 2024-09-13T03:04:20+00:00

dfir.chwriteup

Botnet Fenix

DFIR.ch walks through analysis of the Fenix botnet infection chain observed in an incident response case: a Dropbox-hosted ZIP (ComplementoSATid.zip) contains an LNK file that invokes wscript to fetch and run a remote JSE script (rfc.jse) from an SMB share, which uses heavily obfuscated JavaScript (variable-splitting, decodeURIComponent, array-shift string deobfuscation) to eventually drop shellcode. The post documents file hashes, deobfuscation technique, and references Metabase's prior report on a Fenix infection vector.

wscriptJScript

Fenix botnetComplementoSATid.zipComplementoSATid.lnk+1

Malware & RE· 2024-08-22T10:04:20+00:00

dfir.chwriteup

Today I Learned - WebDAV Cache

dfir.ch analyzes a malicious LNK file (schedule.lnk) served from an open directory that downloads a next-stage payload (Erlianaw.exe) over WebDAV via rundll32.exe and davclnt.dll. The post highlights a lesser-known DFIR artifact: WebDAV file transfers cache a copy of the retrieved executable in C:\Windows\...\AppData\Local\Temp\TfsStore\Tfs_DAV\{GUID}.exe, which can be matched against VirusTotal hashes to recover the delivered payload even without the original download, and references CVE-2024-21412 regarding companion .url files that can reveal the source URL.

WebDAVSysmonVirusTotal+1

CVE-2024-21412

Blue Team & Detection, Malware & RE· 2024-08-08T23:04:20+00:00

dfir.chwriteup

Abusing the “search-ms” URI protocol handler

A DFIR analysis by dfir.ch dissecting a real-world phishing campaign that abuses the Windows "search-ms" URI protocol handler embedded in an HTML attachment ("Booking_Confirmation.html") to trigger a WebDAV connection via rundll32/davclnt.dll, present a spoofed Explorer search result, and lure the victim into executing an LNK file. The LNK launches a headless conhost.exe pulling an obfuscated batch script (new.bat) over a trycloudflare.com tunnel, which drops a decoy PDF, downloads a full Python interpreter (FTSP.zip) and additional scripts, and ultimately performs shellcode injection. The post also documents Sysmon process-create telemetry and the HKCU WordWheelQuery registry key as forensic artifacts of the search-ms query.

WindowsPowerShellSysmon+3

WordWheelQuerydavclnt.dll

Blue Team & Detection, Offensive Security· 2024-08-04T03:04:20+00:00

dfir.chwriteup

Tainted Kernels

A DFIR-focused walkthrough on Linux kernel taint flags, explaining how loading out-of-tree or unsigned kernel modules (e.g. via insmod) marks the kernel as tainted, and how to investigate this using dmesg, /proc/sys/kernel/tainted, the kernel-chktaint script, /proc/modules, lsmod, modinfo, journalctl, and /proc/kallsyms. The author demonstrates the process with a custom test module (dfir.ko) and notes the practical limits of tracing a tainting module back to its origin, recommending bash history, filesystem searches for .ko files, and auditd as complementary artifacts.

Linux kernelLinux

Blue Team & Detection· 2024-07-12T03:04:20+00:00

dfir.chwriteup

Today I Learned - kernel.modules_disabled

A short DFIR.ch "Today I Learned" post walks through the Linux kernel.modules_disabled sysctl, which once set to 1 irreversibly (until reboot) blocks all loading/unloading of kernel modules. The author builds and inserts a minimal test LKM (dfir.ko) with insmod/rmmod, then demonstrates that enabling the setting blocks further module load/unload attempts, framing it as a hardening measure against LKM rootkits like REPTILE seen in Mandiant's UNC3886 espionage report.

Linux kernelLinux

REPTILEUNC3886Mandiant

Blue Team & Detection, Cloud & Infra· 2024-07-10T01:04:20+00:00

dfir.chwriteup

Systemd Path Activation - Poor Man's File Integrity

A DFIR.ch blog post demonstrates using systemd path units (PathChanged=) to monitor sensitive files like ~/.ssh/authorized_keys and trigger a linked service unit that runs a canary token check via canarytokens.com when the file is modified. It's presented as a low-cost, EDR-free way to detect unauthorized SSH key tampering or other critical file changes on Linux servers, including full unit file examples and systemctl setup/testing steps.

systemd

canarytokens.com

Blue Team & Detection· 2024-06-22T03:04:20+00:00

dfir.chwriteup

From Dangerous PHP Functions to Webshell Hunting

A DFIR practitioner deploys four PHP webshells (popen-based, proc_open-based, p0wny-shell, and Weevely) on a test web server, then tests whether common webshell YARA rulesets (nsacyber, Florian Roth's Thor rules) can detect them via Velociraptor hunts. The rules only catch p0wny-shell due to its many code-execution keywords, missing the simpler popen/proc_open shells and Weevely entirely, exposing brittleness in signature-based webshell detection. The author proposes a semi-automatic approach combining Velociraptor/DetectRaptor with manual review, web-log frequency analysis, and UAC-generated bodyfile/mactime timelines to hunt webshells more reliably.

PHPYARAVelociraptor+3

Florian RothnsacyberDetectRaptor+4

Blue Team & Detection, Offensive Security· 2024-06-17T07:04:20+00:00

dfir.chwriteup

Today I Learned - Instrument ClamAV to extract AutoIT scripts

DFIR.ch shows how to abuse ClamAV's scanning temp-file behavior (clamscan --leave-temps --tempdir=) to extract embedded AutoIT scripts from a compiled .exe, using SimpleLapsGui.exe (flagged by multiple AV vendors) as the example. The recovered autoit.001 script and PowerShell payload are validated against output from the dedicated Python tool autoit-ripper, giving analysts two independent, Windows-binary-free methods for automating AutoIT script extraction during malware/PUA triage.

ClamAVAutoITPowerShell+1

SimpleLAPS-GUIUniversal AutoIT Extractor and De-obfuscatorautoit-ripper

Malware & RE· 2024-06-09T02:04:20+00:00

dfir.chwriteup

Today I Learned - Zsh Sessions (even more Timestamps)

A short DFIR technical note explaining zsh's ~/.zsh_sessions directory, where each terminal session gets a paired .session/.history file (or a live .historynew tracked by $HISTFILE) keyed by TERM_SESSION_ID. The .session file contains a restored-session timestamp, giving investigators a way to recover executed commands and narrow down execution timeframes even when an attacker has deleted the main .zsh_history file.

zshmacOS

Blue Team & Detection· 2024-05-26T07:04:20+00:00

dfir.chwriteup

The 'Invisibility Cloak' - Slash-Proc Magic

A DFIR researcher tests and explains a Linux anti-forensics technique — bind-mounting an empty directory over /proc/[pid] (and its fd subfolder) to hide a running process from ps — using a Sliver beacon as the test payload. The post traces via strace how ps reads /proc/[pid]/stat, status, and cmdline to build its output, then documents forensic tells that survive the hiding trick: writable/non-standard permissions on the process's /proc entry, a suspicious mount entry in /proc/mounts, an empty fd directory, and the still-visible C2 connection in netstat, nf_conntrack, and /proc/net/tcp.

SliverLinuxLinux kernel

Timb-machineSandfly

Blue Team & Detection, Offensive Security· 2024-05-16T08:40:20+00:00

dfir.chwriteup

Removing Traces of RMM Tools

A DFIR researcher analyzes a PowerShell "cleaner" script discovered in an open directory (flagged by Fox_threatintel) and uploaded to VirusTotal, which threat actors use to erase traces of legitimate RMM tools like Atera and Splashtop after gaining access to a victim machine. The script sets the SystemComponent registry flag to hide the software from Apps & Features, deletes Start Menu/ProgramData installer folders (also targeting AnyDesk), and renames the Splashtop Windows Firewall rule to masquerade as a "Cast to Device" service. The author tests the script on a live machine and shows the anti-forensic tricks are shallow — toggling SystemComponent back to 0 restores visibility and other forensic artifacts still reveal the software.

PowerShellWindowsAtera+3

Fox_threatintel91.215.85.18

Blue Team & Detection, Malware & RE· 2024-05-10T07:26:20+00:00

dfir.chwriteup

Today I Learned - Zsh History Timestamps

A short DFIR 'Today I Learned' post explaining that Zsh keeps in-session command history with timestamps accessible via `fc -lf` or `fc -li 100`, unlike the on-disk ~/.zsh_history file which loses per-command timestamps after reboot. The author recommends analysts capture this during live response and suggests configuring HISTTIMEFORMAT permanently to preserve timestamps for future investigations. Relevant to incident responders working on macOS (default shell since Catalina), Kali Linux, and Gentoo systems.

zshmacOSKali Linux

Blue Team & Detection· 2024-05-07T17:58:20+00:00

dfir.chwriteup

Canarytokens: Catching Insider Threats (and Threat Actors?)

A DFIR consultant describes using Canarytokens.com to investigate two real incidents: an Excel-based canarytoken embedded via an external OOXML image reference to determine whether a company's customer data was being leaked by an insider or a compromised web server, and a "whoami" registry canarytoken that fired during an incident response engagement because Cobalt Strike's Elevate Kit ran the uac-schtasks technique (Invoke-EnvBypass from the Empire project), which internally calls whoami. The post walks through the OOXML/XLSX external-relationship mechanics that trigger the Excel canarytoken and notes canarytokens' value and limits as a supplement to, not a replacement for, EDR.

CanarytokensCobalt StrikeEmpire+2

Elevate KitInvoke-EnvBypassImage File Execution Options+1

Blue Team & Detection· 2024-05-06T07:15:20+00:00

dfir.chwriteup

Today I Learned - Device Discovery

dfir.ch documents an incident response investigation where an NDR sensor flagged a suspicious internal port scan. The analyst used EDR telemetry to identify the responsible PowerShell script (hash-verified, Microsoft-signed) invoking Defender for Endpoint's Device Discovery feature (Scan-UdpTcpPorts, Scan-Vnc, Scan-WinRm, etc.), decoding its base64 ScannerArgs to reveal target IPs, MACs, and the CVEs it probes for (CVE-2021-44228, CVE-2022-22965). The scan turned out to be benign legitimate network discovery from Defender for Endpoint, explaining why it triggered an NDR false positive.

PowerShellMicrosoft Defender XDREDR

CVE-2021-44228CVE-2022-22965

Blue Team & Detection· 2024-04-27T06:04:20+00:00

dfir.chwriteup

Sysrv Infection (Linux Edition)

DFIR case study reversing a Sysrv botnet crypto-mining ELF binary (VirusTotal sample 41hs1z) found on a Linux endpoint, covering the initial ldr.sh loader script, Go binary reversing in Ghidra (using Max Kersten's GhidraScripts to recover strings/function names obscured by Go compilation), and dynamic analysis via strace showing the process masquerading as kthreaddk, establishing cron-based persistence at randomized paths, using a localhost TCP mutex port, and writing an XMRig-style config.json pointing to C2 194.38.23.2:8080. It also documents the malware's WordPress exploit (matched to Exploit-DB code) and hardcoded brute-force credential lists used for propagation.

GhidraVirusTotalLinux+3

Sysrvkthreaddk194.38.23.2

Malware & RE, Blue Team & Detection· 2024-04-14T13:04:20+00:00

dfir.chwriteup

MicroSocks: Convenient access through a compromised SonicWall SMA

DFIR investigation by a researcher into a SonicWall SMA compromise where the threat actor exploited CVE-2021-20039 (authenticated command injection) to drop the previously-known wafxSummary web shell, then months later placed a second binary, wafySummary, identified as the open-source MicroSocks SOCKS5 proxy. The attacker used MicroSocks to tunnel RDP traffic into the internal network, avoiding further malware deployment and detection for nearly 11 months before deploying Abyss ransomware. Includes reproduction steps confirming the binary's SOCKS proxy functionality and its VirusTotal PUA detection.

SonicWallMicroSocksVirusTotal+3

CVE-2021-20039Abyss ransomwarewafxSummary+2

Threat Intel, Blue Team & Detection· 2024-03-30T06:15:20+00:00

dfir.chwriteup

Azure Batch Misused for Crypto Mining

dfir.ch documents an incident where an attacker with a compromised (non-MFA) Azure admin account created Azure Batch accounts, requested a Microsoft Support quota increase to unlock compute, and used a Batch pool StartTask to pull a Docker container (ubtssl/webappx) running the xm coin miner against a mining pool. The post walks through Azure Batch internals (accounts, pools, StartTask, quotas), shows the actual Activity Log JSON and malicious bash/Docker config, and recommends MFA, risky sign-in monitoring, and anomaly alerting as mitigations.

AzureDockerMicrosoft Entra ID

ubtssl/webappxxm miner

Cloud & Infra, Blue Team & Detection· 2024-03-15T05:04:20+00:00

dfir.chwriteup

Two in a row - You mitigated wrong (Kentico CMS RCE)

A DFIR consultant details two investigations (five months apart) into a compromised IIS/Kentico CMS server. Attackers exploited a Kentico Staging SyncServer .NET deserialization RCE (via a public exploit and a Metasploit module using the WindowsIdentity gadget chain) to plant a rewrite-rule redirect to Vietnamese black-hat SEO content, then later returned with a malicious IIS native module (HTTPCacheLog.dll) that hooked BeginRequest to execute commands from HTTP cookies, plus multiple .ashx webshells and PrintNotifyPotato.exe for privilege escalation. The piece walks through using Chainsaw, Sysmon, PowerShell logs, and Velociraptor/YARA hunts to trace the intrusion and lists file-hash IOCs.

IISMetasploitSysmon+5

PrintNotifyPotatoDotNetDeserializationWindowsIdentity gadget chain+3

Blue Team & Detection, AppSec· 2024-03-06T18:04:20+00:00

dfir.chwriteup

AWS Ransomware

A DFIR case study of an AWS S3 extortion incident where an attacker deleted a customer's buckets after reconnaissance (GetSendQuota, ListBuckets, GetBucketVersioning, etc.) and left a Bitcoin ransom note bundled with a Linux 'recovery' binary. Analysis with strace and Ghidra reveals the recovery tool is a complete fake: it never contacts AWS or the network, instead sleeping via clock_nanosleep and fabricating account/bucket details from a bundled aws.txt file to pressure the victim into paying. The post also shares specific CloudTrail event names defenders should monitor to detect similar pre-deletion recon activity.

AWSVirusTotalGhidra+1

Invictus-IRELF Digest

Cloud & Infra, Malware & RE, Blue Team & Detection· 2024-02-21T03:04:20+00:00

dfir.chwriteup

[s|l]trace - Linux Malware Analysis

A hands-on DFIR walkthrough analyzing the BPFDoor Linux backdoor purely through strace syscall tracing, without static/dynamic disassembly. The author compiles BPFDoor from a leaked Pastebin source, traces execution with strace -ff, and correlates observed syscalls (self-copy to /dev/shm/kdmtmpflush, timestomping, --init respawn, PID file check at /var/run/haldrund.pid) with prior analysis from Sandfly Security's Craig Rowland, producing usable IOCs for detection/hunting.

strace

BPFDoorCraig RowlandSandfly Security

Malware & RE, Blue Team & Detection· 2024-02-01T06:04:20+00:00

dfir.chwriteup

Hunting AsyncRAT & QuasarRAT

A DFIR blog post detailing detection and hunting techniques for AsyncRAT and QuasarRAT, two prevalent open-source RATs. It covers default C2 ports (6606, 7707, 8808), mutex naming conventions ("AsyncMutex_"), persistence mechanisms (Scheduled Tasks vs Run keys), dropped plugin DLLs (e.g., Recovery.dll, LimeLogger keylogger), and demonstrates hunting these artifacts with Velociraptor's Mutants-Hunt and MTF-Hunt, plus pulling IOCs from ThreatFox via API.

AsyncRATQuasarRATVelociraptor+1

AsyncMutex_

Blue Team & Detection· 2024-01-15T14:04:20+00:00

dfir.chwriteup

N-IOCs to Rule Them All

A FIRST Conference 2023 research writeup analyzing ten top malware families active in Switzerland (Nanocore RAT, Ave Maria RAT, QakBot, 404 Keylogger, Loki Password Stealer, Remcos RAT, etc.) to find eight common post-infection forensic artifacts: Windows Defender exclusion creation (event 5007), PowerShell Script Block logging, scheduled task creation (events 4698-4702), Run key persistence, Startup folder drops, AppData file writes, Dynamic DNS resolutions, and high-port/IP-only network connections. Each artifact is mapped to specific detection methods using Sysmon event IDs, Windows event logs, and Velociraptor hunts (TaskScheduler, DNSCache), giving SOC analysts and IR teams concrete, low-cost threat-hunting queries applicable beyond the specific samples studied.

VelociraptorSysmonWindows Defender+2

Nanocore RATAve Maria RATQakBot+4

Blue Team & Detection· 2023-12-31T17:13:36+00:00