Coffee Lover. Nerd. Does wild stuff in network sessions. VP of Analysis @TrinityCyber
Joined October 2020
- Tweets109
- Following642
- Followers320
- Likes204
/3 Digging into this a bit - what actually happened in the LNK?
1. Use CommandArgs flag
2. Slight obfuscation ( ` char) to evade sigs
3. Calling PowerShell to trigger Start-BitsTransfer
4. EXE delivered, renamed, and executed from Public folder
Context matters. Apply your strings and logic within YARA modules for maximum effect. Here's an example of this for hunting those pesky evasion GUIDs from Packer-as-a-Service inside of the ".data" section of a PE.
Happy hunting!
#dailyyara
Don鈥檛 shy away from criticism or betterment of your work. You can always improve. Here we see @cyb3rops optimizing my YARA rule for CVE-2021-40444 XML files. Check it out, some great performance tips!
youtu.be/53gpfmKFxr4
Quick and dirty YARA rule for those hunting CVE-2021-40444 within XML files. Getting great results in VT livehunt with it. Apply it within the OOXML archive.
DM me for copy/paste of it.
#dailyyara #rce #cve_2021_40444
