The Curious Engineer

All blogs / Security

dfir.ch

dfir.ch/posts

Technical blog by Stephan Berger (@malmoeb)

SecurityLinux / UnixWindows internals

’23’24’25’26
Posts
102 from 31 Dec 2023 to 22 Oct 2026
Posting
weekly (24 in the last year)
Kind
personal blog
Feed
https://dfir.ch/posts/index.xml

2026 22

  1. Field Notes: Reconstructing an Attacker’s Workflow
  2. Field Notes: Reconstructing an Attacker’s Workflow
  3. Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
  4. Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
  5. Today I learned: Python's .start Files as a Persistence Mechanism
  6. Today I learned: Python's .start Files as a Persistence Mechanism
  7. Field Notes: Reconstructing the Attacker's LSASS Dump
  8. Field Notes: Reconstructing the Attacker's LSASS Dump
  9. The .zshrc.zwc You Forgot to Check
  10. The .zshrc.zwc You Forgot to Check
  11. Living Inside the Shell: zsh Modules on macOS
  12. Living Inside the Shell: zsh Modules on macOS
  13. Field Notes: From AV Alert to Impacket
  14. Field Notes: From AV Alert to Impacket
  15. Field Notes: NSSM - the Non-Sucking Service Manager
  16. Field Notes: NSSM - the Non-Sucking Service Manager
  17. Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  18. Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  19. Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
  20. Fantastic clear-text passwords and where to collect them (Part 1 - Linux)
  21. Anatomy of a Deno-Based Proxy & RAT
  22. Anatomy of a Deno-Based Proxy & RAT

2025 18

  1. Dissection of a PHP Backdoor leveraging php-win.exe
  2. Dissection of a PHP Backdoor leveraging php-win.exe
  3. Today I learned: binfmt_misc
  4. Today I learned: binfmt_misc
  5. Linux Capabilities Revisited
  6. Linux Capabilities Revisited
  7. Today I Learned - Protected Symlinks
  8. Today I Learned - Protected Symlinks
  9. macOS Extended Attributes: Case Study
  10. macOS Extended Attributes: Case Study
  11. Tear Down The Castle - Part 2
  12. Tear Down The Castle - Part 2
  13. Oh my .. ! - Suspicious network traffic detected including Ransomware
  14. Oh my .. ! - Suspicious network traffic detected including Ransomware
  15. Tear Down The Castle - Part 1
  16. Tear Down The Castle - Part 1
  17. Analysis of Python's .pth files as a persistence mechanism
  18. Analysis of Python's .pth files as a persistence mechanism

2024 60

  1. Today I Learned - setfacl
  2. Today I Learned - setfacl
  3. Shell Script Compiler (shc)
  4. Shell Script Compiler (shc)
  5. Reptile's Custom Kernel-Module Launcher
  6. Reptile's Custom Kernel-Module Launcher
  7. bedevil: Dynamic Linker Patching
  8. bedevil: Dynamic Linker Patching
  9. Microsoft Defender XDR's Deception Technology
  10. Microsoft Defender XDR's Deception Technology
  11. tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)
  12. tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)
  13. EDR: The Great Escape - RomHack Training Review
  14. EDR: The Great Escape - RomHack Training Review
  15. Today I Learned - NSG Flow Log
  16. Today I Learned - NSG Flow Log
  17. ScriptBlock Smuggling
  18. ScriptBlock Smuggling
  19. Botnet Fenix
  20. Botnet Fenix
  21. Today I Learned - WebDAV Cache
  22. Today I Learned - WebDAV Cache
  23. Abusing the “search-ms” URI protocol handler
  24. Abusing the “search-ms” URI protocol handler
  25. Tainted Kernels
  26. Tainted Kernels
  27. Today I Learned - kernel.modules_disabled
  28. Today I Learned - kernel.modules_disabled
  29. Systemd Path Activation - Poor Man's File Integrity
  30. Systemd Path Activation - Poor Man's File Integrity
  31. From Dangerous PHP Functions to Webshell Hunting
  32. From Dangerous PHP Functions to Webshell Hunting
  33. Today I Learned - Instrument ClamAV to extract AutoIT scripts
  34. Today I Learned - Instrument ClamAV to extract AutoIT scripts
  35. Today I Learned - Zsh Sessions (even more Timestamps)
  36. Today I Learned - Zsh Sessions (even more Timestamps)
  37. The 'Invisibility Cloak' - Slash-Proc Magic
  38. The 'Invisibility Cloak' - Slash-Proc Magic
  39. Removing Traces of RMM Tools
  40. Removing Traces of RMM Tools
  41. Today I Learned - Zsh History Timestamps
  42. Today I Learned - Zsh History Timestamps
  43. Canarytokens: Catching Insider Threats (and Threat Actors?)
  44. Canarytokens: Catching Insider Threats (and Threat Actors?)
  45. Today I Learned - Device Discovery
  46. Today I Learned - Device Discovery
  47. Sysrv Infection (Linux Edition)
  48. Sysrv Infection (Linux Edition)
  49. MicroSocks: Convenient access through a compromised SonicWall SMA
  50. MicroSocks: Convenient access through a compromised SonicWall SMA
  51. Azure Batch Misused for Crypto Mining
  52. Azure Batch Misused for Crypto Mining
  53. Two in a row - You mitigated wrong (Kentico CMS RCE)
  54. Two in a row - You mitigated wrong (Kentico CMS RCE)
  55. AWS Ransomware
  56. AWS Ransomware
  57. [s|l]trace - Linux Malware Analysis
  58. [s|l]trace - Linux Malware Analysis
  59. Hunting AsyncRAT & QuasarRAT
  60. Hunting AsyncRAT & QuasarRAT

2023 2

  1. N-IOCs to Rule Them All
  2. N-IOCs to Rule Them All