Nostr notes by dfir.ch (Unofficial)

Field Notes: Reconstructing an Attacker’s Workflow Introduction ...

2026-10-25T03:46:06Z

Field Notes: Reconstructing an Attacker’s Workflow

Introduction
During a recent incident, we recovered several PowerShell scripts the attacker had left behind on disk. Instead of reconstructing every action from individual event log entries, file-system artefacts, and EDR telemetry, we could read some parts of the attacker’s workflow directly from their own code. The scripts covered several stages of post-compromise activity: command execution, credential harvesting, Active Directory reconnaissance, remote-access testing, and SMB share discovery.
Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network. Among other things, Microsoft described a persistent PowerShell loop that watches a local file for commands, executes them, and writes the results to another file.

https://dfir.ch/posts/field_note_attacker_workflow/

#fieldnotes #attacker #workflow #reconstructing #activedirectory #microsoft #parts #powershell #edr #smb

#rss #feeds #linksharing #qwibbit

Field Notes: Reconstructing an Attacker’s Workflow Introduction ...

2026-10-24T02:57:33Z

Field Notes: Reconstructing an Attacker’s Workflow

Introduction
During a recent incident, we recovered several PowerShell scripts the attacker had left behind on disk. Instead of reconstructing every action from individual event log entries, file-system artefacts, and EDR telemetry, we could read some parts of the attacker’s workflow directly from their own code. The scripts covered several stages of post-compromise activity: command execution, credential harvesting, Active Directory reconnaissance, remote-access testing, and SMB share discovery.
Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network. Among other things, Microsoft described a persistent PowerShell loop that watches a local file for commands, executes them, and writes the results to another file.

http://localhost:1313/posts/field_note_attacker_workflow/

#rss #feeds #linksharing #qwibbit

Field Notes: EtherRAT Distributed Through a Legitimate Intune ...

2026-10-16T03:14:55Z

Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow

Introduction
The investigation began with a Microsoft Defender for Endpoint alert for suspicious screen capture activity involving PowerShell. Examining the process ancestry revealed a larger execution chain involving FbtRYX8x.exe, a renamed Node.js runtime communicating with several public Ethereum RPC providers. The observed behavior was consistent with EtherRAT, a Node.js-based backdoor previously documented by Atos Threat Research Center, The DFIR Report, and Malwarebytes.
Further hunting identified the same malware on four managed endpoints, all of which had received a malicious MSI through Microsoft Intune. The deployment itself was not the result of an identified compromise of Intune. Instead, the customer had imported what appeared to be a legitimate Advanced IP Scanner installer into its existing software distribution workflow, inadvertently deploying the malware to multiple systems.

https://dfir.ch/posts/field_notes_etherrat/