nganhkhoa/mether049-malware
1
0
Fork 0
mirror of https://github.com/nganhkhoa/malware.git synced 2024-06-10 21:32:07 +07:00
Code Issues Projects Releases Wiki Activity

Update malware-analysis_ref_and_memo.md

Browse Source
This commit is contained in:
mether049 2020-04-21 23:19:28 +09:00 committed by GitHub
parent be2d6bebad
commit 741ab4dbb8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
malware-analysis_ref_and_memo.md
View File

@ -101,9 +101,10 @@ DFIR,マルウェア解析，OSINTに特化したUbuntuベースのディスト
- 数百万のUser Agentに対応
### Forensic
- **Windows Security Log**
- **Windows Log**
- [Windows Security Log Events](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/)
- 一覧
- [Windows security event log library](https://www.manageengine.com/products/active-directory-audit/kb/windows-event-log-id-list.html)
- **[Sysinternals](https://docs.microsoft.com/en-us/sysinternals/downloads/)**
- Sysmon
- ホスト上で発生したプロセス，ファイル，レジストリ，ネットワーク，WMI関連のインベントをEventLog(.evtx)に記録する
@ -191,7 +192,14 @@ DFIR,マルウェア解析，OSINTに特化したUbuntuベースのディスト
(process_name == 'userinit.exe' and not parent_process_name in ('dwm.exe', 'winlogon.exe'))
)
```
- ref:
- [Awesome Threat Detection and Hunting](https://github.com/0x4D31/awesome-threat-detection)
- [Threat Hunting via Windows Event Logs](https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1524493093.pdf)
- [Detecting the Elusive Active Directory Threat Hunting
](https://adsecurity.org/wp-content/uploads/2017/04/2017-BSidesCharm-DetectingtheElusive-ActiveDirectoryThreatHunting-Final.pdf)
- [インシデント調査のための攻撃ツール等の実行痕跡調査に関する報告書](https://www.jpcert.or.jp/research/20160628ac-ir_research.pdf)
- [Event Log Analysis](https://sect.iij.ad.jp/d/2018/05/044132/training_material_sample_for_eventlog_analysis.pdf)
- [ログを活用した Active Directory に対する攻撃の検知と対策](https://www.jpcert.or.jp/research/AD_report_20170314.pdf)
### .NET analysis
- **[dnspy](https://github.com/0xd4d/dnSpy)<br>**
.NETデコンパイラ,C#やVBで作成された実行ファイルを高精度でデコンパイルする