
Weird & Wacky Researcher Summer: The Artifacts & Detections Edition
DISCARDED: Tales From the Threat Research Trenches
00:00
How to Attribute to Different Vectors
Kyle: People are still doing it. We did have that one we worked on where there was a bunch of LNK files that had embedded PDFs in like after the end of the LNK file, they just tacked on a PDF and I don't remember how they were actually getting the PDF content to load but like it was all embedded and my hunting rule still fits for it. And it's like super stupid that you can literally just copy and paste like PDF bytes and put them at the end of an LNK file and windows is still like yep seems legit but you can. Kyle: One of the things that I look for or have been is really consistent with one of my
Transcript
Play full episode