DISCARDED: Tales From the Threat Research Trenches cover image

Weird & Wacky Researcher Summer: The Artifacts & Detections Edition

DISCARDED: Tales From the Threat Research Trenches

00:00

How to Attribute to Different Vectors

Kyle: People are still doing it. We did have that one we worked on where there was a bunch of LNK files that had embedded PDFs in like after the end of the LNK file, they just tacked on a PDF and I don't remember how they were actually getting the PDF content to load but like it was all embedded and my hunting rule still fits for it. And it's like super stupid that you can literally just copy and paste like PDF bytes and put them at the end of an LNK file and windows is still like yep seems legit but you can. Kyle: One of the things that I look for or have been is really consistent with one of my

Transcript
Play full episode

The AI-powered Podcast Player

Save insights by tapping your headphones, chat with episodes, discover the best highlights - and more!
App store bannerPlay store banner
Get the app