wmiexec – The DFIR Report

From ScreenConnect to Hive Ransomware in 61 hours

September 25, 2023

In 2022, The DFIR Report observed an increase in the adversarial usage of Remote Management and Monitoring (RMM) tools. When compared to post-exploitation channels that heavily rely on terminals, such … Read More

cobaltstrike Exfiltrate Data ursnif wmiexec

Unwrapping Ursnifs Gifts

January 9, 2023

In late August 2022, we investigated an incident involving Ursnif malware, which resulted in Cobalt Strike being deployed. This was followed by the threat actors moving laterally throughout the environment … Read More