每日攻防资讯简报[Mar.5th]

1.Wubes：利用Windows沙箱技术，在隔离环境中启动应用程序。当前仅支持Firefox

https://github.com/nccgroup/Wubes

https://research.nccgroup.com/2021/03/03/wubes-leveraging-the-windows-10-sandbox-for-arbitrary-processes/

2.efi_fuzz：针对UEFI NVRAM 变量的coverage-guided fuzzer，基于Qiling和AFL++

https://github.com/Sentinel-One/efi_fuzz

1.Rosetta 2逆向系列文章

https://ffri.github.io/ProjectChampollion/

2.反混淆恶意VBScript脚本

3.IDA反编译插件Hex-Ray反编译结果中的while(1)与while(2)循环代表什么

https://www.msreverseengineering.com/blog/2021/3/3/what-is-a-while2-loop-in-hex-rays

4.在Windows系统中部署Canary Windows Services，以跟踪正在运行的Windows服务，如果没有在主机关闭期间停止这些Windows服务（通过net stop，sc或类似工具），则自动响应，使主机休眠，将勒索软件对系统的影响降到最低

https://research.nccgroup.com/2021/03/04/deception-engineering-exploring-the-use-of-windows-service-canaries-against-ransomware/

https://github.com/nccgroup/KilledProcessCanary

5.curl在漏洞验证中的使用

https://blog.redteam-pentesting.de/2021/wholesome-curl-calls/

6.Windows.com域名抢注与比特翻转

https://remyhax.xyz/posts/bitsquatting-windows/

7.Cobalt Strike DNS Direct Egress Not That Far Away

https://dtm.uk/cobalt-strike-dns-direct-egress/

8.XLM + AMSI：针对Excel 4.0宏恶意代码的新的运行时防护技术

https://www.microsoft.com/security/blog/2021/03/03/xlm-amsi-new-runtime-defense-against-excel-4-0-macro-malware/

9.2021全球威胁报告

https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf