Command Palette

Search for a command to run...

The fault in our shell

UpdatedNovember 10, 2025

I am a information security professional with interest mainly in defenses/ blue teaming. I enjoy leisure running 🏃‍♂️ and PC games.

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Detection Pipeline for CloudTrail Detection Engine

Guide on setting up detection pipeline with Github Action

Nov 10, 2025·5 min read

Detection Pipeline for CloudTrail Detection Engine

About idleak.net

Indonesia leak, ransomware, and data breach monitoring

Oct 7, 2025·6 min read

CloudTrail Detection Engine

Leveraging AWS lambda and sigma for CloudTrail monitoring

Sep 26, 2025·6 min read

If I were to start validating my cloud detection...

Thoughts on starting cloud-centric detection assessment

Aug 3, 2025·7 min read

If I were to start validating my cloud detection...

What Are Indicators of Compromise (IOCs) and Why Do They Matter?

This article is an excerpt from my piece originally published on cdef.id. You can read the full article here. Indicators of Compromise (IOCs) are simply evidence that a cyber intrusion has occurred. They are the digital breadcrumbs left behind by att...

Jun 21, 2025·2 min read

What Are Indicators of Compromise (IOCs) and Why Do They Matter?

Ewaldo Simon Hiras's Blog

35 posts

Talks about infosec🧑‍💻, mainly focusing on digital forensics and incident response; detection engineering; SOC stuff and occasionally random stuff 🍩🕹️.

Tulisan lama saya mengenai honeypot. Secara umum sebagian besar malware yang melakukan serangan merupakan varian dari Mirai.

Serangan dilakukan dengan menggunakan brute force kombinasi username/password yang sangat umum ditemui dalam wordlist/dictionary maupun username/password default milik beberapa device IoT.

Setelah mendapatkan akses, malware melakukan fingerprinting, mengunduh dan menjalankan payload. Dari 43 payload unik yang diunduh, terdapat 6 (enam) dari yang bukan merupakan executable. 5 (lima) diantaranya merupakan bash/shell script, sedangkan sisanya merupakan backdoor perl script yang berkomunikasi ke C2 server melalui protocol IRC.

Dikarenakan keterbatasan interaksinya, cowrie tidak mendokumentasikan aktivitas dari payload yang diunduh dan dijalankan, hal ini dapat dijadikan topik penelitian lebih lanjut namun diperlukan penggunaan high interaction honeypot.

rinciannya dapat dilihat di sini, dan originally posted on: cdef 4

#mirai #malware

Archive
Privacy
Terms

Sitemap RSS