James Northey

Most SOC reports and write-ups are punchy, to-the-point, polished reports. After all, every investigation (regardless of vertical) starts out as a chaotic mix of different threads that we corral into order like a tired sheepdog dreaming of making it as an internet meme and retiring on the royalties. Unfortunately, these polished reports don't capture how we actually form our suspicions, the pivots, the dead ends, the moment it all starts to make some semblance of sense. If you've ever wondered what that process actually looks like, I've spun up a blog series that breaks down real MDR incidents to capture what it's like riding the investigation roller-coaster, so those new to the industry can see how we progress from start to end within the context of a SOC investigation. Please enjoy this breakdown of a threat actor's attempt to enumerate and pivot further into the victim's environment — made with 100% organic human analyst tears! jevonang.com/Investigations…

Second part of a two-part @HuntressLabs blog series is here, which looks at several incidents where the threat actor used the Velociraptor DFIR tool - featuring ToolShell, Warlock ransomware, and a series of attacker fumbles. @darkrym11 huntress.com/blog/velocirap…

1⃣ The @Huntress team uncovered a campaign by a likely China-nexus threat actor. The most novel finding is use of a publicly available tool called Nezha as a post-exploitation C2 agent. This is the first public reporting of the tool I've seen. huntress.com/blog/nezha-chi…

For those who want to go step-by-step and actually learn the reversing process, I’ve written a walkthrough that starts beginner-friendly and ramps up into advanced malware RE: 👉 links.darkrym.com/pxa