dist67

My videos.
http://blog.DidierStevens.com
http://DidierStevensLabs.com

Reversing A Network Protocol
Reversing A Network Protocol
Analyzing Malicious OneNote Documents
Analyzing Malicious OneNote Documents
Extracting Information From
Extracting Information From "logfmt" Files With InteractiveSieve
Extracting Information From
Extracting Information From "logfmt" Files With CyberChef
PNG + mimikatz.exe
PNG + mimikatz.exe
PNG Analysis
PNG Analysis
Analysis of a Malicious HTML File (QBot)
Analysis of a Malicious HTML File (QBot)
Grep & Tail -f With Notepad++
Grep & Tail -f With Notepad++
Analyzing Obfuscated VBS with CyberChef
Analyzing Obfuscated VBS with CyberChef
Maldoc Analysis: Rehearsed vs. Unrehearsed
Maldoc Analysis: Rehearsed vs. Unrehearsed
An Obfuscated Beacon - Extra XOR Layer
An Obfuscated Beacon - Extra XOR Layer
VBA Maldoc & UTF7 (APT-C-35)
VBA Maldoc & UTF7 (APT-C-35)
James Webb JPEG With Malware
James Webb JPEG With Malware
1768.py's Sanity Check
1768.py's Sanity Check
Maldoc: non-ASCII VBA Identifiers
Maldoc: non-ASCII VBA Identifiers
Another Exercise In Encoding Reversing
Another Exercise In Encoding Reversing
Decoding Obfuscated BASE64 Statistically
Decoding Obfuscated BASE64 Statistically
Maldoc .DOCX MSDT Inside Sandbox
Maldoc .DOCX MSDT Inside Sandbox
Office Protects You From Malicious ISO Files
Office Protects You From Malicious ISO Files
Method For String Extraction Filtering
Method For String Extraction Filtering
curl, json & jo
curl, json & jo
Maldoc Cleaned by Anti-Virus
Maldoc Cleaned by Anti-Virus
TShark & Multiple IP Addresses
TShark & Multiple IP Addresses
Quick & Dirty Shellcode Analysis - CVE-2017-11882
Quick & Dirty Shellcode Analysis - CVE-2017-11882
YARA's Console Module
YARA's Console Module
MSBuild & Cobalt Strike
MSBuild & Cobalt Strike
YARA Rules for Office Maldocs
YARA Rules for Office Maldocs
Obfuscated Maldoc: Reversed BASE64
Obfuscated Maldoc: Reversed BASE64
Decrypting Cobalt Strike Metadata Without and With Malleable C2 Instructions
Decrypting Cobalt Strike Metadata Without and With Malleable C2 Instructions
Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory
Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory