Command and Control
3 items, newest first, including 3 newsletter issues.
Newsletter
ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays
Two real samples in my lab dropped two implants on one host. One vendor-signed and loud, one self-hosted and configured to be invisible. Here is how to hunt both.
Newsletter
32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool
Is That AnyDesk Legit or Planted? A Lab-Validated Hunt
Newsletter
Detecting Reverse SSH SOCKS Tunnels: Separating Benign -R From Akira Pivoting
Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.