topic
Threat Response
2 posts
-
The Alert Wasn't the Beginning: Reconstructing a Multi-Host JavaScript RAT Intrusion
A memory-acquisition alert led back 17 hours to a KongTuke-style delivery chain, a portable Node.js RAT with Ethereum-based C2 resolution, WinRM enablement, and an attempted upload of a memory image to cloud storage.
-
Step-by-Step Investigation of a Phishing Email
The response side of a phishing report: preserve the message, reach a verdict, scope who else received and clicked it, check whether the user interacted, and contain based on what actually happened.