Released v1 of a python module to extract strings from binary content: binary2strings. Similar to sysinternals strings, except it's a python module for easy integration with your malware analysis automation. It has a few tricks up it's sleeve...
- PUA protection is a really good protection feature, I highly recommend enabling this to stay safe!The potentially unwanted apps (PUA) blocking feature, previously available to Enterprise customers, is now broadly available with the Windows 10 May 2020 Update. blogs.windows.com/windowsexperie…
- Learn about how we harden our Defender ATP ML protection models against adversaries by adding monotonic constraints. This is effective against attacks that code-sign and the recent third party ML evasion technique demonstrated by @SkylightCyber.
- Great overview of Windows Defender AV. You'll notice most protection engines are driven by ML investments in the cloud and the client. We have clusters of servers around the world that handle billions of classification queries daily. This includes post-execution behavior ML.Windows Defender AV provides industry-best detection & blocking capabilities to stop a wide range of threats & attacker techniques. Multiple advanced engines work together under the hood to make this happen. Details in our new blog: microsoft.com/security/blog/…
- Guilty, but it seems he really had left his criminal path from his youth behind.Marcus @MalwareTechBlog Hutchins has pleaded guilty to two criminal charges of authoring, selling, distributing the Kronos banking trojan and a related malware strain. krebsonsecurity.com/2019/04/marcus… My deep dive on Hutchins' past, from 2017: krebsonsecurity.com/2017/09/who-is…
