Practical Examples of URL Hunting Queries - Part 1

Practical examples of URL hunting queries.

Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control

Applying Flow Control and Mathematical operators to deobfuscate a .vbs loader for Nanocore malware.

Decoding a Cobalt Strike Downloader Script With CyberChef

Decoding a Cobalt Strike script with CyberChef and VsCode.

Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars

Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars

How To Track Malicious Infrastructure With DNS Records - Vultur Banking Trojan

Tracking Malware Infrastructure Through Subdomain Analysis

How To Track Malware Infrastructure - Identifying MatanBuchus Domains Through Hardcoded Certificate Values

Identifying malicious infrastructure through hardcoded TLS Certificates and Subdomains.

Tracking Malware Infrastructure With Passive DNS and 302 Redirects

Finding phishing domains passive DNS tooling and 302 redirects.

Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis

Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.

Introduction To Malware Infrastructure Analysis With Passive DNS

Malware Infrastructure Tracking Using Passive DNS Intelligence.

Latrodectus Malware Analysis - Decoding Obfuscated Malware By Removing Junk Comments

Identifying and Removing Obfuscation in a Self-Referencing Latrodectus Loader

Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples

Advanced CyberChef techniques using Registers, Regex and Flow Control

Practical Queries for Identifying Malware Infrastructure With FOFA

Identifying malware infrastructure with the FOFA scanner.

Malware Analysis Guides

How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers

Manual analysis of Cobalt Strike Shellcode with Ghidra. Identifying function calls and resolving API hashing.

Malware Analysis Guides

How To Use Ghidra For Malware Analysis - Identifying, Decoding and Fixing Encrypted Strings

Manual identification, decryption and fixing of encrypted strings using Ghidra and x32dbg.

Threat Intelligence Guides

Identifying Qakbot Servers with Regex and TLS Certificates

Catching 83 Qakbot Servers using Regular Expressions.

Threat Intelligence Guides

How To Build Advanced Threat Intelligence Queries Utilising Regex and TLS Certificates - (BianLian)

Creating Regex Signatures on TLS Certificates with Censys.

Malware Analysis Guides

How To Use Ghidra For Malware Analysis - Establishing Context on Imported Functions

Leveraging Ghidra to establish context and intent behind imported functions.

Threat Intelligence Guides

Identifying PrivateLoader Servers with Infrastructure Queries

Refining Queries and Identifying Suspicious servers using Censys.

Malware Analysis Guides

Ghidra For Malware Analysis - Pivoting from String Cross References

Leveraging Ghidra to establish context and intent behind suspicious strings.

Malware Analysis Guides

Beginner Ghidra Guide - Manual Shellcode Decryption

Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.

Threat Intelligence Guides

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

More interesting and practical queries for identifying malware infrastructure.

Threat Intelligence Guides

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Identifying Malware infrastructure by combining weak pivot points.

Malware Analysis Guides

How To Use Garbageman To Extract C2's From Dotnet Malware

Extracting C2 configuration using the Garbageman .NET analysis tool

Threat Intelligence Guides

Identifying Simple Pivot Points in Malware Infrastructure - RisePro Stealer

Identifying Simple pivot points in RisePro Stealer Infrastructure using Censys.