Reply to thread

Message

<blockquote data-quote="WiseVector" data-source="post: 953426" data-attributes="member: 76851">Thanks for the test, from the description of this APT simulation tool we know that curl is used to simulate Cobalt Strike, and we have to say that it is very similar to the real Cobalt Strike communication, the URL address is very similar, and the HTTP header is also very similar. However, when actually extracting network signatures, we will try to avoid URL or http header features because they can be easily modified. WVSX has a multi-layer approach to protect users from real Cobalt Strike malware. For example, we have just executed a Cobalt Strike trojan we captured a few hours ago,[ATTACH=full]259976[/ATTACH]For nslookup and certutil, how did you execute them? From which menu? In our Win10 system, this simulation tool crashes frequently, which makes our tests very unproductive. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite120" alt="o_O" title="Er... what?&nbsp; &nbsp; o_O" loading="lazy" data-shortname="o_O" /></blockquote>

[QUOTE="WiseVector, post: 953426, member: 76851"] Thanks for the test, from the description of this APT simulation tool we know that curl is used to simulate Cobalt Strike, and we have to say that it is very similar to the real Cobalt Strike communication, the URL address is very similar, and the HTTP header is also very similar. However, when actually extracting network signatures, we will try to avoid URL or http header features because they can be easily modified. WVSX has a multi-layer approach to protect users from real Cobalt Strike malware. For example, we have just executed a Cobalt Strike trojan we captured a few hours ago, [ATTACH type="full" width="378px"]259976[/ATTACH] For nslookup and certutil, how did you execute them? From which menu? In our Win10 system, this simulation tool crashes frequently, which makes our tests very unproductive. o_O [/QUOTE]

Verification