# Securehat

## Securehat

- [Blog Overview](https://blog.securehat.co.uk/master.md)
- [Cobalt Strike Staging and Extracting Configuration Information](https://blog.securehat.co.uk/cobaltstrike/extracting-config-from-cobaltstrike-stager-shellcode.md): This post covers how Cobalt Strike staging works, how to replicate a staging request to obtain beacon shellcode, and then how to extract the Cobalt Strike config from the shellcode.
- [Fighting Back Against Cobalt Strike - Detection Ideas](https://blog.securehat.co.uk/cobaltstrike/fighting-back-against-cobalt-strike-detection-ideas.md)
- [Tool-Less Extraction of IOCs from an Emotet Maldoc](https://blog.securehat.co.uk/malware-analysis/tool-less-extraction-of-iocs-from-an-emotet-maldoc.md): This blog post covers how to examine and extract the underlying payload from a recent Emotet delivery campaign. We will cover how to use basic dynamic analysis to quickly step over VBA obfuscation.
- [Extracting the Cobalt Strike Config from a TEARDROP Loader](https://blog.securehat.co.uk/malware-analysis/extracting-the-cobalt-strike-config-from-a-teardrop-loader.md): This blog post will cover how to use dynamic analysis to extract the underlying Cobalt Strike config from a recent TEARDROP sample
- [Shellcode Execution via EnumSystemLocalA](https://blog.securehat.co.uk/process-injection/shellcode-execution-via-enumsystemlocala.md): This post covers a shellcode execution technique that leverages the UuidFromStringA and EnumSystemLocalA APIs to load and execute shellcode
- [Manually Implementing Inline Function Hooking](https://blog.securehat.co.uk/process-injection/manually-implementing-inline-function-hooking.md): This post covers the general process of implementing a simple inline function hook for an x86 Win32 API.
- [Detecting Process Injection using Microsoft Detour Hooks](https://blog.securehat.co.uk/process-injection/detecting-process-injection-using-microsoft-detour-hooks.md): This blog post discusses using Microsoft Detours to add hooks for common APIs in an attempt to detect and prevent process injection.
- [Detecting Parent Process Spoofing using KrabsETW](https://blog.securehat.co.uk/detection-experiments/detecting-parent-process-spoofing-using-krabsetw.md): This blog post covers how to build a simple PoC program that will use the KrabsETW library to subscribe to an ETW provider in order to detect parent process spoofing.
- [Chainsaw Tool - Search and Hunt Through Event Logs](https://blog.securehat.co.uk/detection-experiments/chainsaw-tool-search-and-hunt-through-event-logs.md): A few months ago I wrote a tool in my day job that helps analysts to search and hunt through Windows Event Logs. The relevant blog post and tool links are below.
- [Hunting for C3 Activity](https://blog.securehat.co.uk/detection-experiments/hunting-for-c3-activity.md)
- [Scaling Detection and Response Operations](https://blog.securehat.co.uk/high-level-blue-team-topics/scaling-detection-and-response-operations.md): A couple of blog posts that I wrote in my day job: