<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Security &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Mon, 05 May 2025 10:21:29 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Security &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Prototype Memory &#038; Services</title>
		<link>https://blog.cerbero.io/prototype-memory-services/</link>
					<comments>https://blog.cerbero.io/prototype-memory-services/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 05 May 2025 10:21:29 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3139</guid>

					<description><![CDATA[We are excited to announce the release of version 0.3 of our Memory Analysis package, currently in beta. This update introduces two major features: support for prototype Page Table Entries (PTEs) and the ability to enumerate and display Windows services from memory captures. Prototype PTEs are a crucial aspect of Windows memory management. These entries &#8230; <a href="https://blog.cerbero.io/prototype-memory-services/" class="more-link">Continue reading<span class="screen-reader-text"> "Prototype Memory &#038; Services"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/prototype-memory-services/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3139</post-id>	</item>
		<item>
		<title>Memory Decompression &#038; Pagefiles</title>
		<link>https://blog.cerbero.io/memory-decompression-pagefiles/</link>
					<comments>https://blog.cerbero.io/memory-decompression-pagefiles/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 28 Apr 2025 15:04:47 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3132</guid>

					<description><![CDATA[Windows 10 (version 1507) introduced memory compression, a feature that allows certain memory pages to be compressed and managed by the &#8220;MemCompression&#8221; process. As a result, in a memory snapshot, some pages may be unavailable because they reside in compressed memory. Memory compression in Windows is optional and can be disabled if desired, but it &#8230; <a href="https://blog.cerbero.io/memory-decompression-pagefiles/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Decompression &#038; Pagefiles"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-decompression-pagefiles/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3132</post-id>	</item>
		<item>
		<title>Memory Analysis Package</title>
		<link>https://blog.cerbero.io/memory-analysis-package/</link>
					<comments>https://blog.cerbero.io/memory-analysis-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 25 Mar 2025 08:46:58 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Dump]]></category>
		<category><![CDATA[Memory]]></category>
		<category><![CDATA[Snapshot]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3108</guid>

					<description><![CDATA[We&#8217;re excited to announce the release of the new Memory Analysis package, capable of analyzing memory dumps from all Windows versions, from XP to 11, both x86 and x64. The package will be available to all licenses of Cerbero Suite. Today we&#8217;re rolling out the beta for all commercial licenses, and it will be accessible &#8230; <a href="https://blog.cerbero.io/memory-analysis-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Analysis Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-analysis-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3108</post-id>	</item>
		<item>
		<title>ThreatPulse Package</title>
		<link>https://blog.cerbero.io/threatpulse-package/</link>
					<comments>https://blog.cerbero.io/threatpulse-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 05 Oct 2023 10:03:21 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2813</guid>

					<description><![CDATA[To stay ahead of the ever-evolving landscape of malware techniques, we have released the ThreatPulse package. This continuously updated package is available for all Cerbero Suite licenses through Cerbero Store. We&#8217;ve been contemplating this project for some time, and the opportunity came in the form of a Microsoft Word document disguised as a PDF. SHA256: &#8230; <a href="https://blog.cerbero.io/threatpulse-package/" class="more-link">Continue reading<span class="screen-reader-text"> "ThreatPulse Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/threatpulse-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2813</post-id>	</item>
		<item>
		<title>Malicious Windows Link with Embedded Microsoft Cabinet</title>
		<link>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/</link>
					<comments>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 10 Sep 2020 04:28:53 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[cab]]></category>
		<category><![CDATA[Cabinet]]></category>
		<category><![CDATA[Link]]></category>
		<category><![CDATA[lnk]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1893</guid>

					<description><![CDATA[You can find the original analysis for this malware at malwarebytes. As a bonus, in the video we show how to improve the static analysis of the final payload by resolving API calls. This script converts the decrypted blob hashes into a call index → api name dictionary. blob = bytes([ 0x6B, 0x65, 0x72, 0x6E, &#8230; <a href="https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/" class="more-link">Continue reading<span class="screen-reader-text"> "Malicious Windows Link with Embedded Microsoft Cabinet"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/malicious-windows-link-with-embedded-microsoft-cabinet/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1893</post-id>	</item>
		<item>
		<title>Microsoft Office DDE Detection</title>
		<link>https://blog.cerbero.io/microsoft-office-dde-detection/</link>
					<comments>https://blog.cerbero.io/microsoft-office-dde-detection/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 Jan 2018 14:21:58 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[DDE]]></category>
		<category><![CDATA[Macro]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Office]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1701</guid>

					<description><![CDATA[In this article we&#8217;re not going to discuss how DDE works, there are plenty of excellent resources about this topic already (also here and here). Instead we&#8217;re going to see how to inspect DDE field codes in Profiler. In fact, the upcoming 2.9 version of Profiler comes with detection of DDE field codes. So let&#8217;s &#8230; <a href="https://blog.cerbero.io/microsoft-office-dde-detection/" class="more-link">Continue reading<span class="screen-reader-text"> "Microsoft Office DDE Detection"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/microsoft-office-dde-detection/feed/</wfw:commentRss>
			<slash:comments>2</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1701</post-id>	</item>
		<item>
		<title>URL Download Action (Tor)</title>
		<link>https://blog.cerbero.io/url-download-action-tor/</link>
					<comments>https://blog.cerbero.io/url-download-action-tor/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Sat, 11 Mar 2017 20:22:49 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Download]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Tor]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1651</guid>

					<description><![CDATA[In the upcoming version of Profiler Advanced we have introduced a new useful action, namely the URL Download action. Many times in previous posts we have analyzed some malware which at the end of its shellcode ended up downloading a binary from the internet and executing it. We thought it would be nice to give &#8230; <a href="https://blog.cerbero.io/url-download-action-tor/" class="more-link">Continue reading<span class="screen-reader-text"> "URL Download Action (Tor)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/url-download-action-tor/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1651</post-id>	</item>
		<item>
		<title>Disclosure: Creating undetected malware for OS X</title>
		<link>https://blog.cerbero.io/disclosure-creating-undetected-malware-for-os-x/</link>
					<comments>https://blog.cerbero.io/disclosure-creating-undetected-malware-for-os-x/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 07 Oct 2013 09:31:54 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Disclosure]]></category>
		<category><![CDATA[Issue]]></category>
		<category><![CDATA[Mac]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[OS X]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1311</guid>

					<description><![CDATA[While this PoC is about static analysis, it&#8217;s very different than applying a packer to a malware. OS X uses an internal mechanism to load encrypted Apple executables and we&#8217;re going to exploit the same mechanism to defeat current anti-malware solutions. OS X implements two encryption systems for its executables (Mach-O). The first one is &#8230; <a href="https://blog.cerbero.io/disclosure-creating-undetected-malware-for-os-x/" class="more-link">Continue reading<span class="screen-reader-text"> "Disclosure: Creating undetected malware for OS X"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/disclosure-creating-undetected-malware-for-os-x/feed/</wfw:commentRss>
			<slash:comments>27</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1311</post-id>	</item>
		<item>
		<title>Creating undetected malware for OS X</title>
		<link>https://blog.cerbero.io/creating-undetected-malware-for-os-x/</link>
					<comments>https://blog.cerbero.io/creating-undetected-malware-for-os-x/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 16 Sep 2013 07:32:03 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Issue]]></category>
		<category><![CDATA[Mac]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[OS X]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1285</guid>

					<description><![CDATA[We have discovered a way to defeat current anti-malware solutions. We will publicly disclose the full details of the issue in a few weeks. In the meantime, we&#8217;re more than happy to confidentially disclose the information with interested organizations (either security vendors or known companies which could benefit from it). Just send an email to: &#8230; <a href="https://blog.cerbero.io/creating-undetected-malware-for-os-x/" class="more-link">Continue reading<span class="screen-reader-text"> "Creating undetected malware for OS X"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/creating-undetected-malware-for-os-x/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1285</post-id>	</item>
	</channel>
</rss>
