Threat Hunting with Function Imports
Using static analysis of function imports to triage files in order to determine if they are legitimate or malicious.
Threat Hunting with Function Imports Read More »
Threat Hunting with Digital Signatures
What are Digital Signatures? Digital Signatures provide a way to determine whether or not I can trust a particular file. A digital signature on a file can be used to verify that the file was signed by a code signing certificate issued by a certificate authority. Then you can decide whether or not you trust
Threat Hunting with Digital Signatures Read More »
Threat Hunting with the PE Checksum
What is the PE Checksum? When the portable executable format was developed, network connections were much less reliable than they are today. It was not uncommon for the integrity of a connection to be compromised and the data being transferred to become corrupted. Additionally, it was difficult for a client to detect whether or not
Threat Hunting with the PE Checksum Read More »
Threat Hunting with File Entropy
Using entropy as a feature to find malware.
Threat Hunting with File Entropy Read More »