akde/infosec

Information security is ultimately about managing risk


See also mem­o­ry dump article.

Usu­al stuff:

  • grep
  • strings
  • hex edi­tor

Spe­cial­ized software:

Thinks to look out for:

  • Sys­tem process with invalid par­ent process id. For example: 
    • Process sys­tem with a par­ent id (nor­mal­ly, there is always only one instance with no par­ent process).
    • Process scvhost or svch0st (there is only svchost.exe)
    • … (see also Inci­dent response train­ing March 2025)

Leave a Reply

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';