A skill, applied

Process Monitor (Procmon)

I used Procmon to follow process and registry activity during controlled analysis of an obfuscated PowerShell malware chain.

Experience at Growing MSSP with Offensive Services

Growing MSSP with Offensive Services

From obfuscated PowerShell to MSBuild injection

Malware Analysis / Incident Response

I unpacked a staged loader to explain its MSBuild injection, C2 and registry persistence, then checked which behaviours had occurred on the affected endpoint.

Read the story

Process Monitor (Procmon)

From obfuscated PowerShell to MSBuild injection

Viewed history

Ask about my work.