Published in Comae Technologies·Feb 22, 2020Active Email Campaign Identified With Malicious Excel FilesWe identified a potential campaign in preparation where the victim would received a zip file containing a Malicious Excel file embedding Excel 4.0 Macros — requiring user interaction to infect the victim. The chain works as the following: Victim receives a compressed archive (.xls.zip) file. Once opened, the .xls file…Cybersecurity3 min readCybersecurity3 min read
Published in Comae Technologies·May 5, 2019How to Assess and Respond to Your Assets In The Cloud?Analyze your Azure and AWS virtual machines from one command. — We recently made some additions to our PowerShell interface to enable users with a valid account to leverage DumpIt on their remote machines such as virtual machines (VMs) on Microsoft Azure or Amazon AWS but also machines with PowerShell Remoting enabled. The whole workflow from capture to analysis is now…Microsoft3 min readMicrosoft3 min read
Published in Comae Technologies·Apr 24, 2019How to Solve the Blindspots of Event-Driven DetectionA while back, I discussed how memory could be used as an ultimate form of the log as long as the analysis workflow and process is smooth. This blog post will start by explaining the blind spots created by event-driven detection solutions such as Endpoint Detection & Response (EDR), and…Cybersecurity5 min readCybersecurity5 min read
Published in Comae Technologies·Jan 17, 2019Leveraging Microsoft Graph API for memory forensicsHow to deal with “lack of context” issues when dealing with your endpoint alerts. — TL;DR: Download GetProcessSecurityAlerts from our GitHub account. In a previous post, I mentioned that generating a memory dump when an alert, generated by one endpoint solution, is triggered would be a good orchestration scenario for incident response or troubleshooting use cases. Microsoft Graph Security API Unfortunately, monitoring alerts require a unified interface which is…Microsoft3 min readMicrosoft3 min read
Published in Comae Technologies·Nov 26, 2018Process Dump Support in Comae StardustWe now support minidumps! — We just rolled out a new feature in Comae Stardust to enable support for process memory dumps (aka minidumps). This means that in addition to full system memory dumps generated by DumpIt, we also now support minidumps.Azure3 min readAzure3 min read
Published in Comae Technologies·Oct 7, 2018The release of Dmp2Json & Querying Memory Images through JSON formatTL;DR: Go on https://my.comae.io — Create an account, download the latest version of our toolkit, play with Dmp2Json. Scripting and open-formats have long been a very critical part of the security community, enabling researchers to search, for example, for Indicator of Compromise (IOC). This is why we decided to make…Microsoft2 min readMicrosoft2 min read
Published in Comae Technologies·Jul 24, 2018Win 1 BlackHat USA 2018 complementary ticket!Want to go to BlackHat USA 2018? I’ve decided to give away one of my BlackHat USA ticket that I get as a Review Board member as I won’t make it this year. Fill in the details here (with correct details obviously) and a winner will randomly be selected and…Cybersecurity1 min readCybersecurity1 min read
Published in Comae Technologies·Feb 20, 2018Rethinking Logging for Critical AssetsGoing beyond log files, accepting memory as its own format. — Logging is a common practice for IT and Security purposes. Mature organizations tend to have extensive and in-depth logging capabilities using either commercial or free solutions. Although, logging is a powerful way to troubleshoot and investigate events it’s often limited by the initial input format of the logs during the…Logging5 min readLogging5 min read
Published in Comae Technologies·Feb 13, 2018Announcing Comae Cryptocurrency eXchange Taskforce (CCXT)Yesterday on twitter, I announced the formation of the Comae Cryptocurrency eXchange Taskforce (CCXT). As more and more news breaks about crypto-heists, it’s becoming abundantly clear that cryptocurrency exchanges are not prepared to respond to these attacks. As explained multiple times, cryptocurrency exchanges are prime targets for criminals for…Cybersecurity2 min readCybersecurity2 min read
Published in Comae Technologies·Feb 7, 2018YARA scans in WinDbgBecause InfoSec loves RegExes. — Andrey Bazhan, from Comae Technologies, just made a neat addition to SwishDbgExt which is the ability to use Yara rules to hunt process in memory via a new command called !ms_yarascan You can refer to the commit for more information. Search through a specific process !ms_yarascan /pid 0x228 /yarafile /yarafile C:\Rules.yar Search through all processes !for_each_process "r? @$t0 =…Programming1 min readProgramming1 min read
