Profile cover photo
Profile photo
Monty St John
192 followers -
Unstoppable. Inescapable. Driven.
Unstoppable. Inescapable. Driven.

192 followers
About
Posts

Post has attachment

Post has attachment

Post has attachment

Post has attachment

Post has attachment

Post has attachment

Post has attachment
Pe Time Stamps and Yara
Lets leverage time stamps within malware with Yara!  I mean, who cares if the time stamp is accurate -- its probably not -- its a know point, often switches between versions or campaigns and can be point of detection.  Let's look at some logic: 1.  PE Time ...

Post has attachment
Okay, its been too long.
alright, I admit it.  Its been way too long since I've posted.  Telling myself I'm busy only goes so far. Anyway, figured I might as well get back to talking about Yara.  We dug into the PE header pretty pretty well but I did skip over what you can do with ...

Post has attachment
Best quote that sums up my day
Like it says: "More data does not equate to more visibility or coverage". In fact, more data drives down retention while lengthening analysis time.  The trick is to collect and retain the most relevant  data, not just more of it.  Since the definition of wh...

Post has attachment
Deeper into the PE Header
Its been a bit, longer than I would have liked, since I posted.  Still, let's dive a bit deeper into the PE structure and get back to what we were doing.  Before I dig into PE sections, let's talk about a couple of integral concepts.  The first is about PE ...
Wait while more posts are being loaded