Blue Team

Retained excerpt

Blue Team AsyncRAT Family Threat Overview Censys' Aidan Holland gives an overview of AsyncRAT, a family of open-source Windows remote access trojans (RATs)- an original codebase that has been forked repeatedly into dozens of descendant malware families. Aidan tracked about 40 named variants across three generations. One useful finding is that almost every fork inherited DCRAT's TLS cert without changing it, so hunting the pattern O=<Name> By <author>, L=SH, C=CN on non-standard ports covers most of the family in one query, and the approach should hold up over time because new forks keep inheriting the same cert structure. Detection Chokepoints: Starting from Scratch Tyler Bohlmann introduces Detection Chokepoints, a free knowledge base applying Matt Graeber and Joshua Prager's approach of focusing detection engineering on invariant steps attackers cannot avoid (e.g., LSASS credential theft always requires opening a handle to lsass.exe) rather than easily-changed artifacts…

This limited excerpt is retained to explain the source trail. Rights remain with the original publisher.