![[s|l]trace - Linux Malware Analysis | dfir.ch logo](https://alion.io/storage/2026/0813/f56932b7a5.256.webp)
Overview
News
Technologies
Salaries
Products
People
Growth
Financials
Overview
Technical blog by Stephan Berger (@malmoeb). Long term memory of my research and Incident Response stories.
News
Field Notes: NSSM - the Non-Sucking Service Manager
Introduction While analyzing Autoruns entries during a Compromise Assessment or an Incident Response case, would you take a second look at the nssm.exe binary running as a service? Hopefully. In a recent case, attackers used nssm.exe to start ngrok as a s
Read more
Report
Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
1. Introduction This post is an expansion of a talk I recently gave about moving beyond standard memory dumping. Pentesters and attackers often rely on dumping the LSASS process to get passwords, but in modern environments, this triggers massive alerts. W
Read more
Report
Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
1. Introduction During Digital Forensics and Incident Response (DFIR) investigations, we frequently observe Threat Actors (TAs) using various methods to harvest clear-text credentials on Linux endpoints. While defense teams focus heavily on Windows creden
Read more
Report
Anatomy of a Deno-Based Proxy & RAT
This is a copy of a blog post I wrote for my employee for InfoGuard LABS. Executive Summary In a recent investigation, we encountered malware that combined aggressive social engineering with the unconventional use of Deno, a secure JavaScript and TypeScri
Read more
Report
Brucon: Anti-Forensics (and Anti-Anti-Forensics) Techniques
Abstract A full-spectrum dive into anti-forensics across Windows and Linux (with a tad of MacOS, if time permits), centered on real incidents and modern attacker behavior. The course walks through classic log wiping, deeper filesystem tricks, PowerShell,
Read more
Report
Pro access
Upgrade to see all 40 mentions
Upgrade to a paid plan to read every media mention of this company - funding news, awards, product launches and press releases from all the outlets writing about it.
Every media mention and press release
Funding news, awards and product launches
Fresh coverage from every outlet writing about the company
Upgrade now
Cancel anytime. Secure checkout. Instant activation.