Word to your moms (certutil qualms)
They came to drop FOMBs!
🆕 #ManagedDefense Blog: fireeye.com/blog/threat-re…
Our awesome global SOC team ran into something interesting:
1️⃣ WMI compiled .bmf files (FOMB file magic) – new [to me] implementation
2️⃣ Weaver exploit (still no CVE!)
They came to drop FOMBs!
🆕 #ManagedDefense Blog: fireeye.com/blog/threat-re…
Our awesome global SOC team ran into something interesting:
1️⃣ WMI compiled .bmf files (FOMB file magic) – new [to me] implementation
2️⃣ Weaver exploit (still no CVE!)
Blog/section titles that should make all dads proud:
• The analysts who found it & authored the blog are in the Dublin SOC – so the blog title is a homage to @houseofpain1's 2/3 Irish heritage.
• Everybody’s Working for the Recon
• FOMBs Away
• String it to Weaver
• The analysts who found it & authored the blog are in the Dublin SOC – so the blog title is a homage to @houseofpain1's 2/3 Irish heritage.
• Everybody’s Working for the Recon
• FOMBs Away
• String it to Weaver
Really great to see the SOC share a glimpse of the activity they deal with every day. They did all the hard work here.
I added the note on origins of mofcomp usage from @cglyer and @_devonkerr_'s 2014 "There’s Something about WMI" talk: fireeye.com/content/dam/fi…
I added the note on origins of mofcomp usage from @cglyer and @_devonkerr_'s 2014 "There’s Something about WMI" talk: fireeye.com/content/dam/fi…
I love that the authors shared the public binary MOF file (.bmf) decompiler in case it benefits other analysts & #DFIR peeps: github.com/pali/bmfdec
You can play along at home with the in-the-wild FOMB from the blog.
You can play along at home with the in-the-wild FOMB from the blog.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
