This DOSfuscation white paper showcases nine months of research into several facets of command line argument obfuscation that affect static and dynamic detection approaches.
Read more...Entries filed under 'Detection'
Threat Research Blog
FireEye posts blog entries under threat research to present and discuss cyber attacks and threat intelligence from a technical perspective. These blog posts cover everything from exploits and vulnerabilities, to advanced malware and targeted attacks.
DOSfuscation: Exploring the Depths of Cmd.exe Obfuscation and Detection Techniques
March 22, 2018 11:45 PM By Daniel BohannonNew FakeNet-NG Feature: Content-Based Protocol Detection
October 23, 2017 11:15 AM By Matthew Haigh, Michael Bailey , Peter KacherginskyFLARE’s FakeNet-NG tool is a powerful network-simulation tool available for Windows and Linux, and the new content-based protocol detection and SSL detection features ensure that FakeNet-NG remains the most useful tool for malware analysts.
Read more...Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation Dynamic Network Analysis Tool
July 5, 2017 11:00 AM By Michael BaileyFLARE has brought FakeNet-NG to Linux, allowing analysts to perform basic dynamic analysis either on a single Linux host or using a separate, dedicated machine in the same way as INetSim.
Read more...Increased Use of WMI for Environment Detection and Evasion
October 7, 2016 8:00 AM By Muhammad Hasib Latif, Dr. Farrukh Shahzad | Threat Intelligence, Advanced MalwareMalware writers are always looking for new ways to evade analysis frameworks and sandboxes to successfully breach targeted environments and platforms. WMI provides a simple way of environment detection to evade sandboxes and dynamic analysis tools, which seem to be underestimated by the security community. This blog looks at evasion samples.
Read more...M-Trends Asia Pacific: Organizations Must Improve at Detecting and Responding to Breaches
August 24, 2016 7:00 PM By Bryce Boland | Threat IntelligenceFor the first time, FireEye releases an M-Trends report specifically for the Asia Pacific region. Find out why most breaches in this region were never made public and how much time it takes to discover breaches in the area -- as well as how that timeframe differs from the global median number of days.
Read more...
Sign up for email update
Get information and insight on today's advanced threats from the leader in advanced threat prevention.
