Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.
A blog post attempting precise definitions for commonly confused malware analysis terms: static vs dynamic analysis, and heuristic vs deterministic (signature-based) detection. It uses a real YARA rule for PWS:Win32/Frethog.AB and the Mimikatz string 'Mimikatz_OpenInternalConfig()' to illustrate that signatures can be either precise/deterministic or generic/heuristic, and argues the heuristic/deterministic line is often blurry and context-dependent (e.g., LSASS access looking suspicious to a red teamer but normal to a sysadmin).
A blog post building on retooling.io's reverse engineering of Microsoft Defender's WdFilter.sys signature format, explaining how signatures use weighted sub-rules with a score threshold (dominant vs non-dominant matches) and five wildcard opcode types (90 01–90 05) for byte-sequence, placeholder, and regex-like matching, translating each into equivalent YARA rule syntax. It ties these findings back to why certain Avred signature-breaker techniques (like NOP/register wildcarding) fail to evade detection, giving practical insight into how Defender signatures are structured and matched.
Windows DefenderYARAAvred
WdFilter.sys
Malware & RE, Blue Team & Detection· 2024-06-30T08:51:55+00:00
blog.deeb.charticle