HelloKitty Ransomware Lacks Stealth, But Still Strikes Home
HelloKitty lacks the stealth of Ryuk, REvil and Conti, but has still struck some notable targets, including CEMIGO. Ransomware overview and IoCs here.
Read More
A Guide to Ghidra Scripting Development for Malware Researchers
Automation is the key to becoming a more effective malware analyst, and Ghidra scripting is an essential tool in your arsenal. Get started here!
Read More
20 Common Tools & Techniques Used by macOS Threat Actors & Malware
Threat hunting on macOS? These are the tools malware most often leverages, with ITW examples, MITRE behavioral indicators and links to further research.
Read More
CVE-2021-24092: 12 Years in Hiding – A Privilege Escalation Vulnerability in Windows Defender
Windows Defender has contained an elevation of privilege vulnerability since at least 2009. Learn more about SentinelOne’s discovery, CVE-2021-24092, here.
Read More
Zeoticus 2.0 | Ransomware With No C2 Required
Zeoticus is a Windows-specific ransomware that can execute fully offline with no callback to a C2, making network activity detection rules redundant.
Read More
FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts
We show how to statically reverse run-only AppleScripts for the first time, and in the process reveal new IoCs of a long-running macOS Cryptominer campaign.
Read More
Greyware’s Anatomy: The “Potentially Unwanted” are Upping Their Game
Adware infections may appear unremarkable at first, but in this example incident analysis we demonstrate their growing sophistication and risk.
Read More
Building a Custom Malware Analysis Lab Environment
Building the right malware analysis environment is the first step for every researcher. We show how it’s done and offer some free custom tools for your use.
Read More
SolarWinds | Understanding & Detecting the SUPERNOVA Webshell Trojan
Our analysis of the SUPERNOVA trojan reveals the differences between the legitimate DLL and the attacker’s implant, along with some new IoCs for detection.
Read More
SolarWinds SUNBURST Backdoor: Inside the APT Campaign
A technical analysis of the SUNBURST stealthy APT including processes, services, and drivers. SentinelOne customers protected with no updates or configuration changes.
Read More