Invisible Strings – Contemporary Challenges And Techniques Of Infrastructure Tracking
summary
Provides a repeatable infrastructure profiling method: a spreadsheet plus a bit.ly guide that records pivots, queries and observed values so searches are reproducible. Uses JARM hashes, Shodan SSL history and C2 fingerprints (certificate CNs, favicons, header-order hashes) to find real servers — a GitHub Cobalt Strike jQuery certificate returns one active C2, Mythic instances cluster on ports 7443/8443, and Vault Typhoon abuse SOHO routers; Vertex signups-style notes preserve queries so detections remain actionable.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:47Infrastructure analysis basics
- 5:01Planning and methodology
- 8:22Composite indicator approach
- 11:52Cobalt Strike profiling
- 15:04Mythic framework analysis
- 18:52Tracking ongoing campaigns
- 22:36Pitfalls in attribution
- 26:03Operationalizing sharing
related talks
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
30mTrawling for IOCs: Catching C2 in a Sea of Data
14mDFIR - Don't Forget Your Roots!
32mSomething’s Phishy: See the Hook Before the Bait
01h 01mSomething Something Cyber
57mSomething Something Security
44mNetsec is Dead(?): Modern Network Fingerprinting for...
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection