Threat Hunting//
Threat Hunting Case Study: FileFix
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.
Threat actors doing crime online use a variety of precautions and technologies to avoid getting caught. Mick Deben is a cybersecurity consultant with DMC Group in the Netherlands. He recently completed his master’s degree thesis, which focused on creating a knowledge base around these anonymity techniques. The knowledge base is called Concealment Layers for Online Anonymity and Knowledge (CLOAK), and it’s intended to give CTI practitioners another way to fingerprint threat actors. In this Studio 471, Deben discusses how he developed CLOAK and how practitioners can use it.
Participants:
Mick Deben, Cybersecurity Consultant, DMC Group
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471
