SOC-Writeups-Reports/1) SOC L2 331 Report.pdf at main · Mehrshad-sh1382/SOC-Writeups-Reports
AMIR S. — SOC & DFIR Engineer
What does it actually look like when a state-sponsored actor digs in and hides? 🐻🚨
I recently led the triage for a high-severity escalation involving the Zebrocy framework—a signature tool of the APT28 (Fancy Bear) espionage group. Working through this simulated incident response scenario provided a deep dive into the sophisticated evasion tactics and reconnaissance patterns used by top-tier adversaries.
My latest L2 Incident Response Write-up deconstructs the entire lifecycle, from the initial breach to final containment. Understanding these advanced TTPs isn't just a technical exercise; it’s essential for hardening our defenses against real-world nation-state threats.
Key technical highlights from the investigation:
🔹 Delivery Evasion: Using password-protected archives with credentials hidden in the phishing body to neutralize automated email gateway scanning.
🔹 Environmental Awareness: Analyzing how the malware utilizes complex PowerShell CIM queries to detect AWS, Xen, or Citrix hardware artifacts and terminate in virtualized/sandbox environments.
🔹 Living off the Land (LotL): Mapping the process lineage as the actor leveraged native Windows utilities (silcollector.cmd, TASKLIST) and dropped secondary payloads into AppData\Local\Temp to circumvent permission sets.
By mapping these behaviors to the MITRE ATT&CK framework, we can build more resilient detection engineering and streamline SOC workflows.
📄 I’ve attached the full Incident Response Report below, featuring the complete forensic timeline, process tree analysis, and extracted IoCs.
https://github.com/Mehrshad-sh1382/SOC-Writeups-Reports/blob/main/1)%20SOC%20L2%20331%20Report.pdf
Blue Teamers: What is your primary strategy for catching evasive, multi-stage malware like Zebrocy before it successfully establishes a C2 heartbeat? Let’s discuss in the comments! 👇
#CyberSecurity #IncidentResponse #SOC #ThreatHunting #APT28 #BlueTeam #MalwareAnalysis #LetsDefend #InfoSec
1 reactions · 0 comments
Topics: #blueteam, #malwareanalysis, #threathunting, #infosec, #incidentresponse, #apt28, #letsdefend, #cybersecurity, #soc