Content Paint
Embee Research

Featured Posts

Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars
Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars

Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars

Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis
Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis

Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.

Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples

Advanced CyberChef techniques using Registers, Regex and Flow Control

Recent Posts

Ghidra For Malware Analysis - Pivoting from String Cross References
Ghidra For Malware Analysis - Pivoting from String Cross References

Leveraging Ghidra to establish context and intent behind suspicious strings.

Beginner Ghidra Guide - Manual Shellcode Decryption
Beginner Ghidra Guide - Manual Shellcode Decryption

Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)
Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

More interesting and practical queries for identifying malware infrastructure.

Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike
Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

Identifying Malware infrastructure by combining weak pivot points.

How To Use Garbageman To Extract C2's From Dotnet Malware
How To Use Garbageman To Extract C2's From Dotnet Malware

Extracting C2 configuration using the Garbageman .NET analysis tool

Identifying Simple Pivot Points in Malware Infrastructure - RisePro Stealer
Identifying Simple Pivot Points in Malware Infrastructure - RisePro Stealer

Identifying Simple pivot points in RisePro Stealer Infrastructure using Censys.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.