Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @pmelson

Paul Melson

@pmelson

24 Aug

THREAD
Prompted by a thread earlier today, I've compiled a few presentations that Target's cybersecurity team members have given over the years that I think are particularly interesting or novel, mostly aligned to the themes of maturity and innovation.

@jshlbrd

Target alumni @jshlbrd presenting on file analysis with Strelka* at @BSidesSF 2019:

@malz_intel

Target team members @malz_intel and Paul Hutelmeyer talking about detection with Strelka* and introducing some new scanning modules at FIRSTCon 2021:

Read 9 tweets

Paul Melson

@pmelson

30 Mar

THREAD
Let's analyze a malicious VBA macro payload. On visual inspection, we can easily see that the macro performs string concatenation and then uses Shell() to execute a PowerShell script. It declares AutoOpen() & Workbook_Open() in order to execute when the document is opened.

Once we decode the base64 script from the macro, we can see that it further obfuscates its intention with more base64 encoding and gzip compression.

When we decode & decompress the long string, we get the final PowerShell payload. This script creates a byte array containing shellcode from another base64 encoded string, which it will then reflectively load into kernel32.dll running in memory.

Read 6 tweets

Paul Melson

@pmelson

16 Jan

THREAD
Let's talk about detection philosophy a little bit. There are 2 main competing approaches; 1) Define Normal, Detect Abnormal, and 2) Find Evil. 1/7

First, let's acknowledge this is a false choice. You can do both. The key is to know which approach is superior in which context. In general, I prefer Find Evil. Let me tell you why. 2/7

To make Find Evil work, you need to think of attackers as groups with motivations and goals, then frame that in the context of a process, lifecycle, or even a cyber kill chain. Seriously, this is key. 3/7

Read 7 tweets

Paul Melson

@pmelson

21 May 20

THREAD for beginning malware/SOC analysts
When analyzing interpreted languages like PowerShell, JavaScript, VBA/VBS, there are some handy shortcuts to dealing with obfuscated code. (NOTE: Always do this kind of analysis in a sandbox VM off of your corporate network.)

Let's use this PowerShell script as an example (raw code on the right). The code is triggered with an obfuscated 'IEX' command that is reconstructed from a predictable PowerShell environment variable, $PSHome.

To de-obfuscate the rest of of the script, replace 'IEX' with 'Write-Host'. This general approach, replacing an execution command with a print/write command, works in basically all interpreted languages. In this case, the output is more obfuscated PowerShell.

Read 7 tweets

Paul Melson

@pmelson

21 Aug 18

THREAD
A quick walk-through of analyzing a PowerShell backdoor using Python.
Here's the backdoor if you want to play along at home: pastebin.com/JbYwq9WJ

1. Looking at the raw payload, we can see powershell.exe is invoked and a base64-encoded script is passed for execution.

2. Open Python, import the base64 module, create a string of the original encoded script, and another string (step1) of the decoded script.

Read 8 tweets

Paul Melson

@pmelson

23 Jul 17

view original on Twitter

This thread got me thinking about DefCon, hacker culture, and insecurity. 1/

External Tweet loading...
If nothing shows, it may have been deleted
by @withzombies view original on Twitter

My first con of any kind was DC6 in 1998. At the time, I worked for a school, fixing Macs and LaserJets, resetting passwords, etc 2/

I knew some folks from IRC, but approaching them IRL seemed hard. I was really intimidated. So I hung with the local BBSers I came with. 3/

Read 22 tweets

Share this page!

Paul Melson

Try unrolling a thread yourself!

More from @pmelson

Paul Melson

Paul Melson

Paul Melson

Paul Melson

Paul Melson

Paul Melson

Did Thread Reader help you today?

Like this author's thread?