dfir.ch (Unofficial) / dfir.ch (Unofficial) is on Nostr

Unofficial automated RSS/Atom links from the source dfir.ch, covering DFIR domain explicitly points to digital-forensics and incident-response security work. Original creators are credited at the source; follow original links. Zaps support the independent feed operator, not the source creators.

Last Notes

2026-10-25 03:46:06 GMT

Field Notes: Reconstructing an Attacker’s Workflow
Introduction
During a recent incident, we recovered several PowerShell scripts the attacker had left behind on disk. Instead of reconstructing every action from individual event log entries, file-system artefacts, and EDR telemetry, we could read some parts of the attacker’s workflow directly from their own code. The scripts covered several stages of post-compromise activity: command execution, credential harvesting, Active Directory reconnaissance, remote-access testing, and SMB share discovery.
Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network. Among other things, Microsoft described a persistent PowerShell loop that watches a local file for commands, executes them, and writes the results to another file.
https://dfir.ch/posts/field_note_attacker_workflow/
#fieldnotes #attacker #workflow #reconstructing #activedirectory #microsoft #parts #powershell #edr #smb
#rss #feeds #linksharing #qwibbit

2026-10-24 02:57:33 GMT

Field Notes: Reconstructing an Attacker’s Workflow
Introduction
During a recent incident, we recovered several PowerShell scripts the attacker had left behind on disk. Instead of reconstructing every action from individual event log entries, file-system artefacts, and EDR telemetry, we could read some parts of the attacker’s workflow directly from their own code. The scripts covered several stages of post-compromise activity: command execution, credential harvesting, Active Directory reconnaissance, remote-access testing, and SMB share discovery.
Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network. Among other things, Microsoft described a persistent PowerShell loop that watches a local file for commands, executes them, and writes the results to another file.
http://localhost:1313/posts/field_note_attacker_workflow/
#rss #feeds #linksharing #qwibbit

2026-10-16 03:14:55 GMT

Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
Introduction
The investigation began with a Microsoft Defender for Endpoint alert for suspicious screen capture activity involving PowerShell. Examining the process ancestry revealed a larger execution chain involving FbtRYX8x.exe, a renamed Node.js runtime communicating with several public Ethereum RPC providers. The observed behavior was consistent with EtherRAT, a Node.js-based backdoor previously documented by Atos Threat Research Center, The DFIR Report, and Malwarebytes.
Further hunting identified the same malware on four managed endpoints, all of which had received a malicious MSI through Microsoft Intune. The deployment itself was not the result of an identified compromise of Intune. Instead, the customer had imported what appeared to be a legitimate Advanced IP Scanner installer into its existing software distribution workflow, inadvertently deploying the malware to multiple systems.
https://dfir.ch/posts/field_notes_etherrat/