• Home

  • Documents

  • IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral...
23
1 IR Event Log Analysis Take FOR508: Advanced Digital Forensics & Incident Response sans.org/for508 Hal Pomeranz / [email protected] / @hal_pomeranz

IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

1

IR Event Log Analysis

Take FOR508: Advanced Digital Forensics & Incident Response

sans.org/for508

Hal Pomeranz / [email protected] / @hal_pomeranz

Page 2: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

2

Page 3: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 3

Windows Event Logs

C:\Windows\System32\winevt\Logs\*.evtx Variety of parsers available –

GUI, command-line, and scripty Analysis is something of a black art?

Page 4: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 4

Example: Lateral Movement

Compromised System

1. Malware Uploaded Via File Share

2. Malware Executed via “at” job

Target System

1.  Event IDs 4624 / 4672 show a successful network logon as admin

2.  Event ID 5140 shows share mount

3.  Event IDs 106 / 200 / 201 /141 show sched tasks

Page 5: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 5

Log Timeline

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Page 6: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 6

4624 – Network Logon

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:00:00 Event ID = 4624 SubjectUserSid = S-1-0-0 SubjectUserName = - SubjectDomainName = - SubjectLogonId = 0x0000000000000000 TargetUserSid = S-1-5-21-2723264887-207281631-482592677-2984 TargetUserName = imowned TargetDomainName = MYDOM TargetLogonId = 0x000000021457dbab LogonType = 3 LogonProcessName = Kerberos AuthenticationPackageName = Kerberos WorkstationName = LogonGuid = {726F6B9E-C1BE-4EC1-BB95-3B0B6238BE56} TransmittedServices = - LmPackageName = - KeyLength = 0 ProcessId = 0x0000000000000000 ProcessName = - IpAddress = 10.1.1.10 IpPort = 3005

Page 7: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 7

4672 – Admin Rights

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:00:00 Event ID = 4672 SubjectUserSid = S-1-5-21-2723264887-207281631-482592677-2984 SubjectUserName = imowned SubjectDomainName = MYDOM SubjectLogonId = 0x000000021457dbab PrivilegeList = SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeEnableDelegationPrivilege

Page 8: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 8

5140 – Network Share

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:00:15 Event ID = 5140 SubjectUserSid = S-1-5-21-2723264887-207281631-482592677-2984 SubjectUserName = imowned SubjectDomainName = MYDOM SubjectLogonId = 0x000000021457dbab ObjectType = File IpAddress = 10.1.1.10 IpPort = 3005 ShareName = //*/C$ ShareLocalPath = /??/C:/ AccessMask = 0x00000001 AccessList: {ReadData (or ListDirectory) }

Page 9: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 9

106 – Task Scheduled

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:02:23 Event ID = 106 TaskName = /At1 UserContext = MYDOM/imowned

Page 10: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 10

200 – Task Executed

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:03:00 Event ID = 200 TaskName = /At1 ActionName = malicious.bat TaskInstanceId = {B042B2E4-D186-4970-AE6C-B5DE328BCF3A}

Page 11: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 11

Bonus!

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:03:09 Event ID = 4688 SubjectUserSid = S-1-5-18 SubjectUserName = TARGET$ SubjectDomainName = MYDOM SubjectLogonId = 0x00000000000003e7 NewProcessId = 0x0000000000002318 NewProcessName = C:/Windows/m.exe TokenElevationType = %%1936 ProcessId = 0x0000000000001c04

Page 12: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 12

201 – Task Completed

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:03:12 Event ID = 201 TaskName = /At1 TaskInstanceId = {B042B2E4-D186-4970-AE6C-B5DE328BCF3A} ActionName = C:/Windows/SYSTEM32/cmd.exe ResultCode = 0

Page 13: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 13

141 – Task Removed

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:05:41 Event ID = 141 TaskName = /At1 UserName = NT AUTHORITY/System

Page 14: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 14

4634 – Logoff

Security.evtx

12:00:00 4624 – Network logon

12:00:00 4672 – Admin rights

12:00:15 5140 – Network share

Microsoft-Windows-TaskScheduler%4Operational.evtx

12:02:23 106 – Task scheduled

12:03:00 200 – Task executed

12:03:12 201 – Task completed

12:05:41 141 – Task removed

Security.evtx

12:07:01 4634 – Logoff

Timestamp = 2015-02-14 12:07:01 Event ID = 4634 TargetUserSid = S-1-5-21-2723264887-207281631-482592677-2984 TargetUserName = imowned TargetDomainName = MYDOM TargetLogonId = 0x000000021457dbab LogonType = 3

Page 15: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 15

Review – What Do We Know?

Login events 4624 – Who, where from, time 4672 – They’re an admin 5140 – And they mounted a share from …

Scheduled tasks 106 – Job name, who, time 200 – Start time and program name 201 – Finish time 141 – They cleaned up

Page 16: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 16

Example: Domain Controller of Doom!

Malicious RDP activty Two different RATs Security.evtx? Not so much…

Page 17: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 17

RDP Event Log Basics

Microsoft-Windows-TerminalServices-RemoteConnectionManager

13:00:00 1149 – URDOM\owendtu from 192.168.1.10 authenticated

Microsoft-Windows-TerminalServices-LocalSessionManager

13:00:41 21 – URDOM\owendtu from 192.168.1.10 logon success

14:45:27 23 – URDOM\owendtu logoff

14:45:32 24 – URDOM\owendtu from 192.168.1.10 disconnect

Page 18: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 18

RDP Event Log Permutations

Microsoft-Windows-TerminalServices-RemoteConnectionManager

15:00:00 1149 – URDOM\owendtu from 192.168.1.10 authenticated

Microsoft-Windows-TerminalServices-LocalSessionManager

15:00:32 21 – URDOM\owendtu from 192.168.1.10 logon success

Microsoft-Windows-TerminalServices-RemoteConnectionManager

16:00:00 1149 – URDOM\owendtu from 192.168.100.102 authenticated

Microsoft-Windows-TerminalServices-LocalSessionManager

16:00:10 25 - URDOM\owendtu from 192.168.100.102 reconnect

16:00:12 24 – URDOM\owendtu from 192.168.1.10 disconnect

Page 19: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 19

Bonus Clue!

Timestamp: 2015-03-17 15:00:12 Event ID: 45 (Symantec Endpoint Protection Client.evtx) Scan type: Tamper Protection Scan Event: Tamper Protection Detection Security risk detected: C:/WINDOWS/SYSWOW64/SVCHOST.EXE File: C:/Program Files (x86)/Symantec/Symantec Endpoint Protection/12.1.2015.2015.105/Bin64/Smc.exe Location: C:/Program Files (x86)/Symantec/Symantec Endpoint Protection/12.1.2015.2015.105/Bin64 Computer: OWNDC User: owendtu Action taken: Leave Alone Date found: Tuesday- March 17- 2015 15:00:10

Page 20: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 20

More Malware!

Timestamp = 2015-03-17 16:13:22 Event ID = 7045 (System.evtx) ServiceName = Nothing to See Here ImagePath = C:\Windows\Temp\NTSH.exe ServiceType = user mode service StartType = auto start AccountName = LocalSystem

Page 21: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 21

Summary – Other Places to Look

RDP logs last longer than Security.evtx Application logs can have clues System.evtx tracks service creation, etc

Page 22: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

IR Event Log Analysis 22

Wrapping Up

Any final questions? Can I have that survey link please?

Page 23: IR Event Log Analysis - Deer Runhal/IREventLogAnalysis.pdfIR Event Log Analysis 4 Example: Lateral Movement Compromised System 1. Malware Uploaded Via File Share 2. Malware Executed

23

IR Event Log Analysis

Take FOR508: Advanced Digital Forensics & Incident Response

sans.org/for508

Hal Pomeranz / [email protected] / @hal_pomeranz


Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Deep Security Supported Features by Platform€¦ · Anti-malware Web Reputation Service Firewall IntrusionPreventionSystem IntegrityMonitoring Log Inspection Recommen-dationScan

Deep Security Supported Features by Platform€¦ · Anti-malware Web Reputation Service Firewall IntrusionPreventionSystem IntegrityMonitoring Log Inspection Recommen-dationScan

Documents
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Technology
Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Documents
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Deep Security Supported Features by Platform · 4 Windows(9.6SP1Agent) Anti-malware Web Reputation Service Firewall IntrusionPreventionSystem IntegrityMonitoring Log Inspection Recommen-dationScan

Deep Security Supported Features by Platform · 4 Windows(9.6SP1Agent) Anti-malware Web Reputation Service Firewall IntrusionPreventionSystem IntegrityMonitoring Log Inspection Recommen-dationScan

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Malware armed with Fourteenforty Research Institute, Inc ... · Fourteenforty Research Institute, Inc. 1 ... Malware armed with ... • The dataset is a set of log files which is

Documents
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute

Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Documents
Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Documents
Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Documents
Strategic Anti-malware Monitoring with Nessus, PVS, & LCE · Strategic Anti-malware Monitoring with Nessus, PVS, & LCE August 2, 2012 (Revision 2) ... (PVS) and the Log Correlation

Strategic Anti-malware Monitoring with Nessus, PVS, & LCE · Strategic Anti-malware Monitoring with Nessus, PVS, & LCE August 2, 2012 (Revision 2) ... (PVS) and the Log Correlation

Documents
simple Unix Tricks: Detecting Break-ins - Deer Runhal/MWVLUG-detecting.pdf · Simple Unix Tricks: Detecting Break-Ins ... SANS' "Intrusion Discovery Cheat Sheet" ... checking tool

simple Unix Tricks: Detecting Break-ins - Deer Runhal/MWVLUG-detecting.pdf · Simple Unix Tricks: Detecting Break-Ins ... SANS' "Intrusion Discovery Cheat Sheet" ... checking tool

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
ANALYZING MALWARE LOG FILES FOR INTERNET ACCESS ...eprints.utm.my/id/eprint/78843/1/MohdSharudinMatMAIS2017.pdf · Intelligence). The results of log processing have reduced 50% of

ANALYZING MALWARE LOG FILES FOR INTERNET ACCESS ...eprints.utm.my/id/eprint/78843/1/MohdSharudinMatMAIS2017.pdf · Intelligence). The results of log processing have reduced 50% of

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents