🔴 Malware Mondays Episode 01 - Identifying Malicious Activity in Process Monitor (ProcMon) Data

[@tar.gzip.malware]

Thanks for sharing this, you are a fantastic teacher! Looking forward for more content 🦾

[@jstrosch]

Thank you so much for the kind words and the support through the super thanks! This is my first one and really means a lot :) If there is anything else I can do, don't hesitate to reach out.

[@tar.gzip.malware]

Thanks for sharing, your effort is very appreciated!

[@jstrosch]

You're very welcome, glad to hear you enjoyed it!

[@Hartley94]

Thanks for another insight ❤.

[@jstrosch]

You are so welcome

[@cyber_chrisp]

Great work!

[@jstrosch]

Thanks!

[@PygArguss]

+1 for the liquid dnb at the beginning

[@jstrosch]

Thanks! I have no real system to picking the music other than I think it sounds good :)

[@bluebadgersec]

Awesome! Please, please continue the series!

[@jstrosch]

Episode 4 is tomorrow :) Thanks for the feedback!

[@md.mahimbinfirojavi9676]

Wonderful content. Thanks, your explanations are very easy to understand. Keep it up please :)

[@jstrosch]

Thanks, will do!

[@manjunathdeewatagi7728]

Great explaination Sir, Thanks for the Knowledge sharing 👍

[@jstrosch]

My pleasure 🙏

[@johnnywilliams2641]

awesome

[@jstrosch]

Thank you :)

[@Manavetri]

Brilliant content !!

[@jstrosch]

Thank you :)

[@Cochise85]

Great stuff 👍

[@jstrosch]

Thank you :)

[@ghibbster]

is there any way to spot process injection in procmon logs? @jstrosch

[@jstrosch]

Not that I'm aware of with ProcMon. I've looked/asked around a bit and nothing has come up. If you do find something please let me know, I'd be happy to make a video out of it!

[@ghibbster]

@@jstrosch never mind, I extensively looked for an answer in my past without any success ... probably there is no means at all.
Edit: Thanks btw

[@jstrosch]

@@ghibbster Good to know we're at least finding the same lack of results... thanks for the update!

[@TADSCHLATRE]

In the command line for Conhost.exe (3804) what does the parameter "0xffffffff -ForceV1" signify?

[@jstrosch]

Here's a great answer on LinkedIn from a colleague - www.linkedin.com/posts/ryanjchapman_dfir-blueteam-cybersecurity-activity-7057458353047801857-_BVK/. This should answer your question!

[@SoCyber-n5k]

great content but it is difficult to follow without known the passowrd to unzip the pcap.What is the password to unzip the pcap?

[@jstrosch]

It's posted on the website where you download it - thecyberyeti