corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0e543-06ca-7110-8b29-d5e1432eee32

Actionable Threat Intel (VI) - A day in a Threat Hunter's life

VirusTotal Engineering · published 23 November 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.virustotal.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
17
Words captured
1,192

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf
media.kasperskycontenthub.com
https://blog.virustotal.com/2023/10/the-path-from-vt-intelligence-queries.html
blog.virustotal.com
https://lolbas-project.github.io/
lolbas-project.github.io
https://learn.microsoft.com/en-us/powershell/scripting/developer/cmdlet/cmdlet-overview?view=powershell-7.3
learn.microsoft.com
https://learn.microsoft.com/en-us/powershell/module/bitstransfer/start-bitstransfer?view=windowsserver2022-ps
learn.microsoft.com
https://www.virustotal.com/gui/search/behavior_processes%253A%2522Start-BitsTransfer%2520-Source%2522%2520(behavior_processes%253A%2522%255BSystem.Convert%255D%253A%253AFromBase64String%2522%2520or%2520behavior_processes%253A%2522%255BSystem.IO.File%255D%253A%253AWriteAllBytes%2522
virustotal.com
https://www.virustotal.com/gui/file/6b3aeeb01a2eaa36fdbfb6c07a86ffd7db6088c06662353812ab7b1a591d8078/details
virustotal.com
https://www.virustotal.com/gui/file/ff4b378d5e1de2232ab00a1262a3c848090f42538178c22366a3446c182b5957/details
virustotal.com
https://www.virustotal.com/gui/search/(behavior_processes%253A%2522EventNamespace%2520%253D%2522
virustotal.com
https://www.virustotal.com/gui/file/df47a0fe2ce6a7ec51249d641a36ae48da6623ece0056cfb5f381bf62a62c5d0/details
virustotal.com
https://www.virustotal.com/gui/file/fe7cc5a2579668cb6afd239dc181c404ef602d72605fe46361e31cecb17187a2/behavior
virustotal.com
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml
github.com
https://www.virustotal.com/gui/search/behavior_processes%253A%2522%257B%2524b%253D'PowerShell.exe'%257D%2522%2520behavior_processes%253A%2522-nop%2520-w%2520hidden%2520-noni%2520-c%2522%2520behavior_processes%253A%2522%257B%2524b%253D%2524env%253Awindir%252B%2522/files
virustotal.com
https://github.com/VirusTotal/vt-public-crowdsourced-yara/blob/main/File/PowerShell_BitsTransfer_Execution.yar
github.com
https://github.com/VirusTotal/vt-public-crowdsourced-yara/blob/main/File/WMI_Event_Subscription_Behaviors.yar
github.com
https://github.com/VirusTotal/vt-public-crowdsourced-yara/blob/main/File/PowerShell_Binary_Injection.yar
github.com
https://www.virustotal.com/gui/contact-us
virustotal.com