Tony Lambert
@ForensicITGuy
Followers
6K
Following
9K
Statuses
4K
Recovering sysadmin that now chases adversaries instead of uptime. Sr Malware Analyst @redcanary
Tennessee
Joined November 2011
RT @SquiblydooBlog: Cert Central .org is live! We track and report abused code-signing certs. By submitting to the website, you contribute…
0
52
0
RT @NetworkDefense: In our latest Analyst Skills Vault lesson, @ForensicITGuy breaks down how to analyze and decode the Meduza stealer mal…
0
7
0
RT @k1nd0ne: Following the release of @volatility 2.11, VolWeb 3.13.3 is now available including most of the new plugins and a bunch of new…
0
43
0
RT @SecurityAura: "svchost.exe should always have services.exe as a parent process and should never be launched without any arguments/param…
0
61
0
The first step to getting robust detections is writing brittle ones that get bypassed and finding out in a red team report.
1
1
28
@mgreen27 I don’t know if it’ll help optimization wise but you can also hash it for comparison like That same rich hdr md5 gets used in VT reports. The full header might be faster though
0
0
3
RT @mgreen27: ##100daysofyara more yara-x > Dumping a RedCurl malware pe I saw Rich Header and thought I would give it a try. Rule: https:…
0
5
0
RT @cyb3rops: Fortinet FortiOS/FortiProxy CVE-2024-55591 Advisory Why you should never blindly block IP IOCs from threat reports: They co…
0
89
0
RT @AustinLarsen_: 🚨 New: Zero-day vulnerability CVE-2025-0282 in Ivanti Connect Secure VPN is being actively exploited, including by suspe…
0
39
0
RT @greypiperr: I’m building incredibly in-depth course work for Command and Control operations as well as detection engineering. This is N…
0
68
0
RT @greglesnewich: #100DaysofYARA we're brute forcing Steve's prompt with regular expressions :P
0
3
0
RT @tccontre18: Excited to share the latest Splunk Threat Research Team blog on the Meduza Stealer! This analysis breaks down the MITRE ATT…
0
35
0
RT @mgreen27: After reading this cool post I loooked into yara-x this afternoon and thought I would do a #100daysofyara post. Super easy f…
0
6
0
RT @elasticseclabs: We're starting 2025 strong. Join us on January 14th for Detection Engineering with the Elastic Global Threat Report, a…
0
7
0
New blog post for #100DaysofYARA , in this one I look at a VenomRAT sample and create rules based on PE metadata and an encryption salt value. #malware
2
10
62
#100daysofyara I like taking the approach of having multiple YARA rules to detect the same thing from different perspectives, like these rules for Cronos Crypter. One looks for just strings, another a string + encryption salt, 3rd for assembly name
0
2
15
RT @fr0gger_: 🤓During the #100DaysOfYara, if you are not sure how to contribute, you can always contribute to the #UnprotectProject! cc: @D…
0
8
0
RT @greglesnewich: #100DaysofYARA day 1 - the Amos stealer is regularly evolving and updating its obfuscation techniques You know what is…
0
15
0
RT @redcanary: HijackLoader—a newcomer to our monthly top 10 list—is fond of renaming executables, which presents a detection opportunity.…
0
8
0
RT @NetworkDefense: In our latest Analyst Skills Vault lesson, Dan Marr demonstrates how attackers use DNS Tunneling to evade defenses. He'…
0
6
0