A short thread of solid #CyberChef alternatives and complementary tools.... ⏬
Ciphey: a fantastic tool that does automated decryption & decoding. Great documentation, and easy to setup via Docker. github.com/Ciphey/Ciphey
Binary Refinery: I'll admit I haven't played with this as much as I should have. It looks fantastic. Each script doing one job, which can be piped like a command line CyberChef. Credit to @huettenhaingithub.com/binref/refinery
ExplainShell: If you are Linux-challenged like me then this is a life-saver. Just remember not to post sensitive information if you are not running it locally. explainshell.com
I've probably missed heaps of great tools, and for that I'm sorry. Please post what you use, so we can all benefit. Thanks to everyone who contributes their time and skills. 💪😎
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Following my analysis, I realised there is an excellent write up of the same PowerShell on SANS here which is worth a read: isc.sans.edu/forums/diary/P… Thanks to @xme for saving me the detonation to learn its ransomware! 👍
Taking a scan we can see an AES decrypt function and blob of Base64 - likely what is to be decrypted. Later on we see our IV and Key variables references, also in Base64.
Here it is! It was an absolute pleasure to develop this course, #CyberChef for Security Analysts, with @chrissanders88. I've tried to cover a range of use cases for work in our field but I probably only scratched the surface. (1/5)
What I've aimed to do instead is to teach the skills so that you can look at the data you'll be using in your work and be confident you can whip up a recipe in CyberChef to suit your needs (2/5).
What's covered are the fundamentals of CyberChef up to the more advanced features that make it the indispensable tool for network defenders. Totally unpaid tweet right here: 👇 (3/5)
A small Powershell script leads to a longer #CyberChef recipe.
(1/6): Let's extract the obfuscated section with a regular expression: a regex lookahead/lookbehind.
(2/6) We're going to convert the obfuscated text into Character Codes.
(3/6) Now, following the script we have to subtract 1 from each of the Character Code values and convert it back again. So we put a 1 next to each value with a Find/Replace...
So in #DFIR you'll come across lots (and lots) of timestamps. Let's take a quick dive into this weird and wonderful world....(1/x)
For Windows, FILETIME is your main man. It's a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since 12:00 A.M. January 1, 1601 Coordinated Universal Time (UTC). (2/x) docs.microsoft.com/en-au/windows/…
So why 1601? According to Microsoft, "The Gregorian calendar operates on a 400-year cycle, and 1601 is the first year of the cycle...active at the time Windows NT was being designed...it was chosen to make the math come out nicely." Seems fair. (3/x) devblogs.microsoft.com/oldnewthing/20…