Understanding CVE-2020-0688

Hello, Guys! In this blog post we will take an in-depth look at CVE-2020-0688 which is a recently published vulnerability in Microsoft Exchange that allows an authenticated attacker to execute arbitrary code on affected Exchange Servers. The first section of this blog post is meant as a short introduction to...Read more...

WMI Persistence (T1084)

Hello, DFIR Folks! In this blog post we will take a quick look at how threat actors can utilize Windows Management Instrumentation (WMI) Event Consumers to obtain persistence on a compromised windows machine, and how we as Defenders can detect these kind of malicious activities by using PowerShell and the...Read more...

Battlefield Malware Analysis (Part 1)

Hello Folks! In this blog post series named "Battlefield Malware Analysis" we will be investigating different tools and techniques that you as a Malware Analysts / SOC Analyst / Incident Responder / (you name it) can use to make your life easier when dealing with Malware Analysis. The "Battlefield" aspect...Read more...

Hello, visitor! We would love to hear from you. Please feel free to contact us if you need any further information. In order to send us an encrypted E-Mail you can use our PGP key, included at the bottom of this page.

  infodigital-selfdefense.net

  0x957F6F246CCD1E33

or

  Join us at [matrix]