Malware writers are always looking for new ways to evade analysis frameworks and sandboxes to successfully breach targeted environments and platforms. WMI provides a simple way of environment detection to evade sandboxes and dynamic analysis tools, which seem to be underestimated by the security community. This blog looks at evasion samples.Read more...
Entries filed under 'Windows Malware'
Threat Research Blog
The FireEye Labs team posts blog entries under threat research to present and discuss cyber attacks and threat intelligence from a technical perspective. They cover the full spectrum of exploits and vulnerabilities, including advanced malware and targeted threats.
February 11, 2016 7:53 AM By Matthew Dunwoody | Vulnerabilities, Threat Research
Mandiant is continuously investigating attacks that leverage Powershell throughout all phases of the attack. A common issue we experience is a lack of available logging that adequately shows what actions the attacker performed using PowerShell. In those investigations, Mandiant routinely offers guidance on increasing PowerShell logging to provide investigators a detection mechanism for malicious activity and a historical record of how PowerShell was used on systems. This blog post details various PowerShell logging options and how they can help you obtain the visibility needed to better respond, investigate, and remediate attacks involving PowerShell.Read more...
October 27, 2015 3:00 PM By Fred House, Andrew Davis, Claudiu Teodorescu | Threat Research, Advanced Malware
April 3, 2014 10:48 AM By Amanda Stewart | Threat Research