Opsec Asia William Ballenthin

Category Archives: William Ballenthin

capa 2.0: Better, Faster, Stronger

July 19 2021 By Daniel Pany in analysis, Homepage Carousel, Latest Blog Posts, Malware, Reverse Engineering, Security, Threat Research, William Ballenthin

We are excited to announce version 2.0 of our open-source tool called capa. capa automatically identifies capabilities in programs using an extensible rule set. The tool supports...

capa 2.0: Better, Faster, Stronger

July 19 2021 By Daniel Pany in analysis, Homepage Carousel, Latest Blog Posts, Malware, Reverse Engineering, Security, Threat Research, William Ballenthin

We are excited to announce version 2.0 of our open-source tool called capa. capa automatically identifies capabilities in programs using an extensible rule set. The tool supports...

SUNBURST Additional Technical Details

December 24 2020 By Syndicator in analysis, Backdoor, Homepage Carousel, Latest Blog Posts, Malware, Security, Threat Research, William Ballenthin

FireEye has discovered additional details about the SUNBURST backdoor since our initial publication on Dec. 13, 2020. Before diving into the technical depth of this malware, we...

SUNBURST Additional Technical Details

December 24 2020 By Syndicator in analysis, Backdoor, Homepage Carousel, Latest Blog Posts, Malware, Security, Threat Research, William Ballenthin

FireEye has discovered additional details about the SUNBURST backdoor since our initial publication on Dec. 13, 2020. Before diving into the technical depth of this malware, we...

SUNBURST Additional Technical Details

December 24 2020 By Syndicator in analysis, Backdoor, Homepage Carousel, Latest Blog Posts, Malware, Security, Threat Research, William Ballenthin

FireEye has discovered additional details about the SUNBURST backdoor since our initial publication on Dec. 13, 2020. Before diving into the technical depth of this malware, we...

404 Exploit Not Found: Vigilante Deploying Mitigation for Citrix NetScaler Vulnerability While Maintaining Backdoor

January 16 2020 By Daniel Pany in FLARE, Homepage Carousel, Incident Response, Josh Madeley, Latest Blog Posts, Malware, Threat Research, vulnerabilities, William Ballenthin

As noted in Rough Patch: I Promise It'll Be 200 OK, our FireEye Mandiant Incident Response team has been hard at work responding to intrusions ...

Windows Management Instrumentation (WMI) Offense, Defense, and Forensics

August 8 2015 By Daniel Pany in Claudiu Teodorescu, FLARE, Matthew Graeber, Threat Research, William Ballenthin

Windows Management Instrumentation (WMI) is a remote management framework that enables the collection of host information, execution of code, and provides an eventing system that can respond...