Content Paint
Embee Research

Featured Posts

Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars
Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars

Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars

Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis
Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis

Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.

Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples

Advanced CyberChef techniques using Registers, Regex and Flow Control

Recent Posts

Practical Queries for Identifying Malware Infrastructure - Part 2
Practical Queries for Identifying Malware Infrastructure - Part 2

Threat Intelligence Queries with Censys.

Code Snippets For Dotnet Configuration Extractors
Code Snippets For Dotnet Configuration Extractors

Useful code snippets for developing dotnet configuration extractors.

Malware Analysis and Deobfuscation With Procmon - Smokeloader Example
Malware Analysis and Deobfuscation With Procmon - Smokeloader Example

Decoding malware loaders using Procmon and Cyberchef. Utilising Powershell to retrieve additional payloads and free online tooling to identify the malware family.

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure
Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

An informal page for storing Censys/Shodan queries

Shodan Query Guide - How To Track Amadey Bot Infrastructure With TLS Certificates and Russian Profanity
Shodan Query Guide - How To Track Amadey Bot Infrastructure With TLS Certificates and Russian Profanity

Identifying Amadey Bot Servers Using Shodan.

How To Track Malware Infrastructure - Identifying Laplas Infrastructure Using Hardcoded TLS Certificates
How To Track Malware Infrastructure - Identifying Laplas Infrastructure Using Hardcoded TLS Certificates

Identification of Laplas infrastructure with Shodan and Censys.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.