Content Paint
Embee Research
Matthew
Author

Matthew

Australia X
Practical Queries for Identifying Malware Infrastructure - Part 2
Practical Queries for Identifying Malware Infrastructure - Part 2

Threat Intelligence Queries with Censys.

Code Snippets For Dotnet Configuration Extractors
Code Snippets For Dotnet Configuration Extractors

Useful code snippets for developing dotnet configuration extractors.

Malware Analysis and Deobfuscation With Procmon - Smokeloader Example
Malware Analysis and Deobfuscation With Procmon - Smokeloader Example

Decoding malware loaders using Procmon and Cyberchef. Utilising Powershell to retrieve additional payloads and free online tooling to identify the malware family.

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

An informal page for storing Censys/Shodan queries

Shodan Query Guide - How To Track Amadey Bot Infrastructure With TLS Certificates and Russian Profanity
Shodan Query Guide - How To Track Amadey Bot Infrastructure With TLS Certificates and Russian Profanity

Identifying Amadey Bot Servers Using Shodan.

How To Track Malware Infrastructure - Identifying Laplas Infrastructure Using Hardcoded TLS Certificates
How To Track Malware Infrastructure - Identifying Laplas Infrastructure Using Hardcoded TLS Certificates

Identification of Laplas infrastructure with Shodan and Censys.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.