https://jamaldarbo.nl/blog/Technical notes, security investigations and lessons learned by Jamal Darbo.en-gbhttps://jamaldarbo.nl/blog/under-the-hood-of-windows-using-process-monitor/https://jamaldarbo.nl/blog/under-the-hood-of-windows-using-process-monitor/A step-by-step look at svchost.exe with Process Monitor: filtering events, following file and registry activity, and understanding the parent process.Fri, 23 May 2025 00:00:00 GMTWindows SecurityProcess MonitorSysinternalshttps://jamaldarbo.nl/blog/packet-capture-analysis-of-a-socgholish-and-asyncrat-infection/https://jamaldarbo.nl/blog/packet-capture-analysis-of-a-socgholish-and-asyncrat-infection/Following a SocGholish and AsyncRAT infection through a packet capture: suspicious TLS traffic, DNS correlations, HTTP streams and obfuscated PowerShell.Thu, 15 May 2025 00:00:00 GMTMalware AnalysisWiresharkNetwork Analysishttps://jamaldarbo.nl/blog/investigating-koi-stealer-malware-using-wireshark/https://jamaldarbo.nl/blog/investigating-koi-stealer-malware-using-wireshark/An end-to-end Wireshark investigation of a Koi Stealer packet capture, examining beaconing, HTTP payloads, internal network activity and indicators of compromise.Tue, 15 Apr 2025 00:00:00 GMTMalware AnalysisWiresharkNetwork Analysis