Recent content on c-b.io | RE // DFIR // CTF
Preface 
 If you spend any amount of time in infosec circles, you’ll notice that the vast majority of offensive research is still centered around endpoint malware, Active Directory abuse, EDR evasion and auth-provider shenanigans. That makes sense though! That’s where the industry mostly grew up. The tooling ecosystem around AD alone is absurd; BloodHound, Mimikatz, Rubeus,…
As someone who’s got the great misfortune of working very closely with Cloud providers (namely AWS, Azure & GCP, the unholy trinity) I’m well aware that there’s a bunch of stuff that’s vulnerable out there for various reasons. 
 AWS, as a whole, is an unfathomably complex ecosystem. They offer an absolutely insane amount of flexibility and ways to quite literally shoot…

 Welcome! It's so good to finally have a SOC analyst, we've got so much work to do! I know this will be a lot for you as a junior since it's all we could afford but I'm sure you can figure it out. Anyways, you're probably wondering where our logs are eh? Well for compliance reasons we've essentially been dumping everything into an ELK stack (whatever that is) but have never actually made…
Recommend song to listen to while reading: 
 
 
 If you find something off with what I say, please let me know. I’ll gladly amend my content and credit you for the fix. 
 
 Some thanks in alphabetical order for all those who supported this blog post: 
 
 Bakki & Deluks for supporting my insane rambling. 
 Rad for helping me ID the initial phish as a Device…
Recommend song to listen to while reading: 
 
 
 If you find something off with what I say, please let me know. I’ll gladly amend my content and credit you for the fix. 
 
 Some thanks in alphabetical order for all those who supported this blogpost: 
 
 AptAmoeba 
 Bakki 
 Deluks 
 Dingusxmcgee 
 Josh 
 Sean 
 Struppigel 
 Xorist 
…
I’ll start by saying this post is not endorsed by hunt.io . I just happen to be a really big fan of what they’re doing. 
 Some hackers suck at OpSec 
 Not all hackers are the smartest. If you’ve ever played with Shodan or Censys , you’ve most likely come across open directories. What’s an open dir? It’s essentially when you expose the entire root of your…
Today we’ll dive into a fresh malware stealer dubbed RedTiger , a sample targeting personal user data, particularly Discord tokens, browser-stored credentials, and gaming accounts. This stealer, like many others seen recently, heavily leverages Discord webhooks for Command & Control (C2). 
 SHA256: b8d1c0436023bf58ea7b0f530ea37ae67bac0e956d9c93376702b4832055e0fd
Distributed as:…
BlankGrabber is nothing new. It’s been documented by multiple companies such as ThreatMon , K7Security and has even had it’s source code disclosed on GitHub . So why exactly are we looking at a well documented and even reversed sample? Because there’s more than just the final payload. We a fresh unaltered sample, we get to look into how the sample gets dropped and loaded! 
…