@Securityinbits

Detection engineering, threat hunting, malware analysis. One defender bit at a time.

 Join for free →
newsletter.securityinbits.com/
Joined September 2015
  • Tweets770
  • Following347
  • Followers2.1K
199Media

ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays

An installer landed on a workstation from a browser download. The signature checked out: CN="ConnectWise, LLC", issued by DigiCert Trusted G4. It was a real ScreenConnect client doing exactly what a S…

Article · @Securityinbits
4
1
26
26,248

32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool

invoice_viewer.exe ran from a user's Temp folder. It was not an invoice viewer. Every version-info field on it read AnyDesk: company AnyDesk Software GmbH, product AnyDesk, description AnyDesk. Micros…

Article · @Securityinbits
1
3
1
6
5,068

ssh.exe -R Proves a Tunnel Exists. It Doesn't Prove a Pivot.

You found ssh.exe running on a workstation, saw the -R, and thought: just a tunnel.

Article · @Securityinbits
2
5
1
24
25,094

Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For

In just the first five months of 2026, 3,758 organizations were hit by ransomware. The attackers were not caught at encryption because nothing fired earlier. The discovery phase is where the attack wa…

Article · @Securityinbits
2
36
2
126
55,338

LSASS Dump via comsvcs.dll: Defender Detection Guide

Attackers dump LSASS with comsvcs.dll to steal credentials; here’s how to spot rundll32 + MiniDump fast and reliably.

Article · @Securityinbits
2
10
351
Load more