Incident Response Tip ⚡
When you need to open a file in a text editor to inspect its raw data during an investigation, here are 4 useful #VScode plugins to inspect different non-binary file types.
A thread 🧵 (1/4 useful IR plugins) Email - highlights the syntax of .eml files. marketplace.visualstudio.com/items?itemName…

Here's a tip for creating Sigma rules.

Sometimes you want to keep your rule strict to avoid false positives, but other times it can be useful to add relevant info.

Thread 🧵

intezer.com/blog/threat-hu… e.g. Emotet uses Word documents so you can extend the rule to include detection of cmd processes that execute Word, Excel, and PowerPoint. This way the detection will cover other variants of the threat.

Keep reading intezer.com/blog/threat-hu…