Security Research

Deep Hooks: Monitoring native execution in WoW64 applications – Part 2

Where we left off In the first part of this series we presented several injection methods capable of injecting 64-bit DLLs into WoW64 processes, with the intention to eventually use this DLL to hook 64-bit API functions in the process. We finished the post by presenting injection via APC, and saw that, when tested to […]

READ MORE

Deep Hooks: Monitoring native execution in WoW64 applications – Part 1

Introduction This blog post is the first in a three-part series describing the challenges one has to overcome when trying to hook the native NTDLL in WoW64 applications (32-bit processes running on top of a 64-bit Windows platform). As documented by numerous other sources, WoW64 processes contain two versions of NTDLL. The first is a […]

READ MORE

What Really Matters with Machine Learning

Let’s cut through the noise and see what’s most important in machine learning and for security products in general

READ MORE

OSX.CpuMeaner: New Cryptocurrency Mining Trojan Targets macOS

(Image source: Beware of traps, by Carmen) In this post, we analyze a new cryptocurrency mining trojan targeting macOS. The malware hides in the pledge to download pirated applications and secretly mines Monero crypto-currency with the user’s hardware. While the idea is similar to OSX.Pwnet, the means and method of implementation are closer to that […]

READ MORE

New Bad Rabbit Ransomware Attack

It’s been almost exactly four months since the last Petya ransomware outbreak. On October 24th, a new variant of Petya called Bad Rabbit was discovered attacking consumers and organizations, mostly in Russia. Below is a copy of the ransom note, which is similar to Petya’s ransom note: SentinelOne customers are protected from this threat. Below […]

READ MORE

RTF zero day in the wild

FireEye recently published an RTF zero day that has been used in the wild since July. This zero day was used to spread FinSpy/FinFisher malware, a “lawful intercept” product with RAT-like capabilities. The disclosed vulnerability is a logical vulnerability, which means most EMET style anti-exploitation techniques (ASLR, DEP, CFG) are irrelevant. As are any other pre-execution security mechanisms […]

READ MORE

CS: Go Hacks for Mac – OSX.Pwnet.A

(Photo source: Pony Strike: Global Offense by FilipinoNinja95) We recently found Counter-Strike: Global Offensive (CS: Go) hacks on macOS that is also a trojan that could mine CryptoCurrencies without user consent. According to VirusTotal Retrohunt, the threat is in the wild since the beginning of July 2017. Warning: At the time of this writing, all URLs […]

READ MORE

Measuring the Usefulness of Multiple Models

The past several years have seen a massive increase in products, services, and features which are powered or enhanced by artificial intelligence — voice recognition, facial recognition, targeted advertisements, and so on. In the anti-virus industry, we’ve seen a similar trend with a push away from traditional, signature-based detection towards fancy machine learning models. Machine […]

READ MORE

Dissecting NotPetya: So you thought it was ransomware

By Caleb Fenton, Joseph Landry, Nir Izraeli, Itai Liba, and Udi Shamir, Senior Security Researchers, SentinelOne Labs NotPetya was in the news this week, making headlines for being yet another ransomware attack that spread like fire – affecting organizations in several verticals across 65+ countries, drawing comparisons with the WannaCry attack that recently hit over […]

READ MORE