Or, how to get past Crowdstrike/Defender ATP/Carbon Black on your next engagement

Manual analysis of Cobalt Strike Shellcode with Ghidra. Identifying function calls and resolving API hashing.

Maltego is the all-in-one investigation platform that accelerates complex cyber investigations from hours to minutes. Mine, merge, and map all your essential intelligence in one place, and uncover hidden truths now!

Exploits bypass most secure boot solutions from the biggest chip vendors

Introduction In this blog post, we will go over the most recurring (and critical) findings that we discovered when auditing the Active Directory environment of different companies, explain why thes…

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security

The combination of the BITSAdmin tool with Veritas backup software pointed our detection engineers to an attempted ransomware attack.

List of documents and records required by both the main part of the standard and by Annex A. Also, a list of the most common documents used for Annex A.

Most of these packages were taken down by PyPI, ESET collaborated with PyPI to ensure the removal of any remaining malicious packages.

DNS (Domain Name System) status codes, also known as DNS response codes or DNS error codes, are numerical codes that indicate the outcome of a DNS query. When a device, such as a web browser, tries to access a domain name (like www.example.com), it sends…

Monitoring USB drives on a Linux endpoint is essential for maintaining the security and integrity of the system.

What are “ghost controls” in NIST 800-171 R3? A ghost control is a legacy control that does not exist in NIST 800-171 R3 that is still reasonably required to demonstrate compliance. There are several aspects of NIST 800-171 R3 Final Public Draft (FPD) that…

Covert Access Team is a reader-supported publication.