Adversaries Are Doing Stranger Things Part 1

[@BEAST4LIF3]

brian with the bangers as always

[@CyberAttackDefense]

Thanks for watching!

[@rongabay6598]

Always have the best content

[@CyberAttackDefense]

Thanks! Spread the word! The more people that watch the more I can make.

[@tebo2286]

This is cool, I love it

[@hablemosdetodo12]

This is art. Do you have any advice on office macros in terms of obfuscation like the one you used? Thanks.

[@CyberAttackDefense]

You can start with github.com/sevagas/macro_pack. Then edit from there.

[@harshil.]

S TIER CONTENT

[@CyberAttackDefense]

Thanks!

[@Michael-ok1fe]

Anyone have luck creating specific KQL queries for detecting these?

[@hiddengo3232]

Next part?

[@CyberAttackDefense]

Coming Next Week!

[@b1U3b0i]

Correct me if I am wrong but this is not gonna work in win11 - the MOTW bypass ;)

[@CyberAttackDefense]

You can find MOTW bypasses that work on 11. I haven’t tested isos on win11.