Hello, welcome to the Monday, November 30th, 2020 edition of the Sand Center and Storm Center's Stormcast.

My name is Johannes Ulrich. Entertainment recording from Jacksonville, Florida.

Well, the long weekend left me with a couple of diaries to talk about the first one by Xavier about how attackers are using PowerShell

to actually patch Windows API calls and with that disable antivirus.

This accomplished using a trick that has been around for a year or so and and it targets the anti-malver scan interface, or AMSI.

That's a library that comes with Windows,

and it's used by anti-malver from different vendors,

so by patching in particular the AMSI scan buffer function

and have it return nothing.

The anti-malver is essentially taken out of the loop if it doesn't detect the code before it runs.

Let me got two diaries that are dealing with Yarm and I think I mentioned Yarm last week. It's a library that

Salesforce came up with. Now, Salesforce, of course, has provided the passive TLS fingerprinting

library, JA3, and that has been heavily used by various threat hunting software like Seek and such, for example, uses it.

But with Jarm, it sort of takes an active approach.

So you can use Jarm to scan a TLS server and then deduct a part of its function as command control servers in particular one that

I think already pointed out, Cobalt Strike, but also as some malware uses command control servers

with very specific TLS signatures so they can be identified using the Jarm library.

Rick's diary from Friday shows how to use Jarm and how to sort of incorporate it into your

threat hunting efforts. Now, the second diary by DDI shows how to use Jarm with Sox proxy. So if you don't want to expose, for example, your own

IP address. And again, JARM does active scanning, so use it with care. Let me go to a couple

stories that I sort of would like to summarize here. They're not necessarily new, but I think a little bit of urgency now with the holiday shopping season starting and people looking for gifts for relatives and such.

Well, be a little bit careful with various IoT devices.

...