Stéfan Le Berre - Heurs

I'm glad to share my talk at @botconf.infosec.exchange.ap.brid.gy 2025!
Do you want to know how we compare a sample with 150k others in seconds on @exalyze.bsky.social? This talk is made for you🚀
At the end, you'll get a hint on what's coming next for Exalyze 😉
youtube.com/watch?v=TS8X...
exalyze.io

23.07.2025 08:16 — 👍 4    🔁 3    💬 0    📌 0

#Podcast #Potatosécurité

Épisode #502 : détection vs. recherche de compromissions (suite de l'épisode #491), avec @heurs.bsky.social

www.nolimitsecu.fr/detection-vs...

12.05.2025 06:31 — 👍 0    🔁 1    💬 0    📌 0

Détection vs Recherche de Compromissions : La discussion continue - NoLimitSecu Épisode #502 – Détection vs Recherche : La discussion continue (épisode #491) Avec Stéfan LE BERRE

#Podcast #Cybersécurité

Épisode #501 : détection vs. recherche de compromissions (suite de l'épisode #491), avec @heurs.bsky.social

www.nolimitsecu.fr/detection-vs...

12.05.2025 06:38 — 👍 5    🔁 7    💬 0    📌 0

GitHub - ExaTrack/Kdrill: Python tool to check rootkits in Windows kernel Python tool to check rootkits in Windows kernel. Contribute to ExaTrack/Kdrill development by creating an account on GitHub.

Kdrill update 📢
ARM64 support added, hunt those rootkits before they adapt to your Winows!
github.com/ExaTrack/Kdr...

02.02.2025 12:32 — 👍 2    🔁 0    💬 0    📌 0

The nineth article (38 pages) of the Malware Analysis Series (MAS) is available on:

exploitreversing.com/2025/01/08/m...

Even though I haven't been on this subject for years, I promised I would write a series of ten articles, and the last one will be released next week (JAN/15).

#malware

08.01.2025 16:45 — 👍 5    🔁 3    💬 0    📌 0

A image that shows a piece of code. On top there is an expression (param_1 & 1) * 2 + (param_1 ^ 1). On the bottom is a deobfuscated version, param_1 + 1. In the middle there is a custom Ghidra DSL, explained in the post.

RULECOMPILE - Undocumented Ghidra decompiler rule language.
A blog post about how frustration with poor decompilation led me to dive deep into Ghidra's decompiler to discover (and reverse-engineer) - an obscure, undocumented DSL
msm.lt/re/ghidra/ru...
#reverseengineering #ghidra

30.12.2024 19:34 — 👍 14    🔁 9    💬 0    📌 0

Perfctl malware exploiting exposed Portainer agent and using new SSH persistenceExaTrack

3+ YEARS of stealth! We uncovered new tactics used by the perfctl malware, including a userland rootkit & an SSH backdoor (a single SPACE in /etc/passwd!). More insights: blog.exatrack.com/Perfctl-usin... #cybersecurity #threat_hunting #linux #infosec #perfctl #rootkit #ssh #exatrack

17.12.2024 10:02 — 👍 10    🔁 6    💬 0    📌 0