mitre att&ck
Posts tagged “mitre att&ck”.
Living off the land: when Windows' own tools go rogue
Attackers often skip custom malware and use tools Windows already ships, such as PowerShell, certutil and mshta. The files are genuine, so the tell is behavior, like those tools reaching the internet.
MITRE ATT&CK explained for people who aren't in a SOC
MITRE ATT&CK is a free public catalog of how real attackers operate. Tactics are their goals, techniques are their methods, and knowing the two helps you read a security alert without guessing.
When a trusted app's file suddenly changes
A trusted app's file changing usually means an update. Worry when the change brings a lost or broken signature, or new destinations — the marks of a tampered, supply-chain-compromised app.
What is beaconing? How malware checks in with its server
Beaconing is malware's regular check-in with its command-and-control server. The steady timing is hard to hide, so a program contacting one address like clockwork is worth a look.