Pinned
New logo. New website. Same DFIR Report team. 🔎
Check out the incredible analysts behind the research:
The DFIR Report
1,765 posts
The DFIR Report
@TheDFIRReport
Real Intrusions by Real Attackers, the Truth Behind the Intrusion
- Cobalt Strike, a Defender's Guide - Part 2 ➡️In this report we talk about domain fronting, SOCKS proxy, C2 traffic, Sigma rules, JARM, JA3/S, RITA & more. Big shout-out to @Kostastsale for helping put this together! thedfirreport.com/2022/01/24/cob…
- Cobalt Strike, a Defender's Guide thedfirreport.com/2021/08/29/cob… Thanks to @Kostastsale for helping put this together! Shout outs to: @MalwareRE, @FSecureLabs, @Paulsec4, @redcanary, @CrowdStrike, @MichalKoczwara, @WLesicki, @bh4b3sh, @jpcert_en, @DidierStevens, and @ForensicITGuy.
- Sodinokibi (aka REvil) Ransomware ➡️TTR: 4 hours ➡️Initial Access: IcedID ➡️Discovery: nltest, net, wmic, AdFind, BloodHound, etc. ➡️PrivEsc: UAC-TokenMagic & Invoke-SluiBypass ➡️Defense Evasion: Safe Mode & new GPO ➡️Exfil: Rclone ➡️C2: CobaltStrike thedfirreport.com/2021/03/28/sod…
- Here's a thread on some of the interesting things we've seen in the #ContiLeaks. If you would like to read the chat logs and TrickBot Forum information, @Kostastsale has translated them to English here: github.com/tsale/translat…. He will be adding more as things get leaked.
- Exchange Exploit Leads to Domain Wide Ransomware TTR: 42 Hours Initial Access: Exchange Exploited (ProxyShell) Discovery: ipconfig, nslookup, ping, KPortScan, etc. Execution: Fast Reverse Proxy & Plink Lateral Movement: RDP Impact: Data Encryption
- 🎉 Announcing DFIR Labs! 🎉 Introducing our DFIR Labs based on real intrusions from our public reports and private threat briefs! Whether you're starting out or looking to deepen your skills, our labs can help. 1/2
00:00 - BumbleBee Roasts Its Way to Domain Admin ➡️Initial Access: BumbleBee (zipped ISO /w LNK+DLL) ➡️Persistence: AnyDesk ➡️Discovery: VulnRecon, Seatbelt, AdFind, etc. ➡️Credentials: Kerberoast, comsvcs.dll, ProcDump ➡️C2: BumbleBee, CobaltStrike, AnyDesk
- From Zero to Domain Admin ➡️Initial Access: Maldoc deploys Hancitor ➡️C2: #CobaltStrike & #Hancitor ➡️Discovery: net, nltest, check.exe, AD module, scan for backup systems ➡️Privilege Escalation: Zerologon CVE-2020-1472
- Quantum Ransomware ➡️TTR: 3h 48 minutes ➡️Initial Access: IcedID ISO ➡️Persistence: Scheduled Tasks ➡️Discovery: WMIC, net, nltest, AdFind, etc. ➡️C2: Cobalt Strike ➡️Lateral Movement: PsExec, WMI, RDP ➡️Impact: Domain wide ransomware
- From ScreenConnect to Hive Ransomware in 61 hours ➡️Initial Access: ScreenConnect ➡️Defense Evasion: BITS Jobs, Embedded Payloads ➡️Lateral Movement: Impacket, RDP, SMB ➡️C2: ScreenConnect, Atera, Splashtop, Cobalt Strike, Metasploit ➡️Exfil: Rclone thedfirreport.com/2023/09/25/fro… 1/X
- Malicious ISO File Leads to Domain Wide Ransomware ➡️Initial Access: IcedID ISO ➡️Credentials: DCsync ➡️PrivEsc: ZeroLogon ➡️Lateral: RDP, SMB/Remote Service, WMI ➡️C2: IcedID, Cobalt Strike, Anydesk ➡️Exfil: Rclone to Mega ➡️Impact: Quantum Ransomware
- Replying to @TheDFIRReportRyuk in 5 Hours ➡️Zerologon (CVE-2020-1472) exploited 2 hours after initial execution of Bazar ➡️Cobalt Strike & Bazar for C2 ➡️AdFind, Net, Ping, Nltest & PowerShell for Discovery ➡️WMI & RDP for Execution ➡️Ryuk ransomware for Impact thedfirreport.com/2020/10/18/ryu…
