Sysmon Archives

Anton Ovrutsky
June 2, 2021
No Comments

Introducing Sysmon Config Pusher

Introducing Sysmon Config Pusher https://www.lares.com/wp-content/uploads/2021/05/sysmonconfig.jpg 1026 685 Anton Ovrutsky Anton Ovrutsky https://secure.gravatar.com/avatar/ba20a53800565e497a2e9e70253bfe87?s=96&d=mm&r=g June 2, 2021 June 2, 2021

Introducing Sysmon Config Pusher When providing various services to clients, including Purple, Blue, and Red Team engagements, the Lares team often recomends Sysmon to close detection gaps. Indeed, Sysmon is…

Anton Ovrutsky
April 2, 2021
No Comments

Emails and Malicious Macros – What Can Go Wrong?

Emails and Malicious Macros – What Can Go Wrong? https://www.lares.com/wp-content/uploads/2021/04/joshua-aragon-BMnhuwFYr7w-unsplash-scaled.jpg 2048 1365 Anton Ovrutsky Anton Ovrutsky https://secure.gravatar.com/avatar/ba20a53800565e497a2e9e70253bfe87?s=96&d=mm&r=g April 2, 2021 April 2, 2021

Intro A few months ago, we published a blog post that examined the telemetry available through Office 365, including email visibility. If you read the blog and thought to yourself,…

Anton Ovrutsky
January 29, 2021
No Comments

Hunting in the Sysmon Call Trace

Hunting in the Sysmon Call Trace https://www.lares.com/wp-content/uploads/2021/01/chris-liverani-dBI_My696Rk-unsplash.jpg 1090 817 Anton Ovrutsky Anton Ovrutsky https://secure.gravatar.com/avatar/ba20a53800565e497a2e9e70253bfe87?s=96&d=mm&r=g January 29, 2021 January 29, 2021

Intro The Sysmon ProcessAccess event has been used in threat hunting and detection efforts in order to alert on techniques such as process injection and credential access. According to the…

Anton Ovrutsky
October 29, 2020
No Comments

Endpoint Hunting for UNC1878/KEGTAP TTPs

Endpoint Hunting for UNC1878/KEGTAP TTPs https://www.lares.com/wp-content/uploads/2020/10/jt-T-_SU1Gzqos-unsplash-scaled-e1603997027363.jpg 1024 683 Anton Ovrutsky Anton Ovrutsky https://secure.gravatar.com/avatar/ba20a53800565e497a2e9e70253bfe87?s=96&d=mm&r=g October 29, 2020 October 29, 2020

Intro On October 28th, the FireEye Threat Research team released the following threat report: https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html on the UNC1878 threat actor group and their KEGTAP/BEERBOT, SINGLEMALT/STILLBOT and WINEKEY/CORKBOT campaigns that deploy…

Anton Ovrutsky
October 5, 2020
No Comments

WFH Lateral Movement TTPs

WFH Lateral Movement TTPs https://www.lares.com/wp-content/uploads/2020/10/hybrid-8iN-YTPHAEw-unsplash.jpg 800 533 Anton Ovrutsky Anton Ovrutsky https://secure.gravatar.com/avatar/ba20a53800565e497a2e9e70253bfe87?s=96&d=mm&r=g October 5, 2020 October 6, 2020

WFH Lateral Movement TTPs With the increase of remote working arrangements due to the ongoing pandemic, corporate endpoints are now located far beyond the standard corporate perimeter. This presents attackers…

Sysmon

Introducing Sysmon Config Pusher

Emails and Malicious Macros – What Can Go Wrong?

Hunting in the Sysmon Call Trace

Endpoint Hunting for UNC1878/KEGTAP TTPs

WFH Lateral Movement TTPs

Call Us

Email Us

©2019 Lares, LLC | All rights reserved.

Sysmon

Introducing Sysmon Config Pusher

Emails and Malicious Macros – What Can Go Wrong?

Hunting in the Sysmon Call Trace

Endpoint Hunting for UNC1878/KEGTAP TTPs

WFH Lateral Movement TTPs

Privacy Preferences