SSLVPN Honeypots: Fortigate Findings & Musings
Examining patterns observed in operating and collecting data from an SSLVPN honeypot sitting behind a Finch proxy.
Blog
Research and analysis
Field notes on malware, threat tradecraft, detection engineering, and practical defensive workflows.
-
-
Digging Tunnels - Hunting Adversarial Cloudflared Instances
Ransomware affiliates have long since abused Cloudflared tunnels to maintain persistent access to compromised environments. These tunnels can be utilized as a strong indicator of compromise when examined at-scale.
-
The Big List of Malware Analysis Tools
A continually evolving knowledgebase of things I've found pertinent as a threat and security operations analyst, specifically focusing on malware analysis.
-
Chainsaw Hunt & Rules
Chainsaw's hunt feature, along with Chainsaw's rule engine, is an excellent way to hunt for evil at scale and create reusable, maintainable queries for rapid triage. We will apply this to both simulated red team engagements and real world compromises to detect lateral movement, Impacket, and even ASP.NET compromises.
-
Chainsaw Search
A brief introduction to Chainsaw's search feature and the document tagging engine, Tau, that WithSecure released in the most recent major Chainsaw update. We will discuss and demystify some of the nuance of Tau's query behavior, and apply these to hands on examples of simple queries that can be utilized to detect evil across numerous event logs with high fidelity.
-
Obfuscation: An Open-Source Nightmare
Discussing obfuscation and its effect on the broader open-source supply chain.
-
The XZ Backdoor Dilemma
No-lone zones are ubiquitous with critical military tasks, and the scope and potential impact of the xz backdoor present an excellent opportunity to discuss how this could be applied to open source software.
-
Pico CTF 24 - dont-you-love-banners
Abusing symlinks to include and subsequently display arbitrary textfiles in place of standard SSH banners.
-
Pico CTF 24 - C3
Working through security by obscurity with the PicoCTF 2024 C3 challenge.
-
Pico CTF 24 - rsa_oracle
Implementing a known plaintext attack utilizing an RSA oracle.
-
Pico CTF 24 - weirdSnake
Reverse engineering disassembled Python bytecode back to the original code.
-
DreamyOak Quasar Malware
Following the kill chain of a malicious Python package, and decompiling a basic Quasar RAT while rapidly learning some valuable lessons.
-
Tracking Peristent PyPI Malware
The Python Packaging Ecosystem remains fairly stable in the broad scope of open source package distribution, but they are not immune to sustained attacks either. One threat actor group has evolved from simple nuissance to a sustained stream of spam and malware utilizing GitHub staging and direct targeting of userbases for the distribution of malicious programs.
-
Discord Engagement
Discord is the most populated live chat interaction platform on the internet. Let's take some time to discuss how we could use that to engage open source communities and enterprise user bases more effectively, and discuss some of the public perceptions that surround Discord.
-
Dearmored
Looking deeper into PyArmor obfuscated malware utilizing tools such as Process Monitor and Wireshark, and hooking third party libraries to gain access to web requests and encrypted data.
-
-