The July 9, 2026, episode of the SANS Internet Storm Center Stormcast, presented by Johannes Ullrich from Jacksonville, Florida, introduced three key cybersecurity topics. The first was Stack Simulator, a web-based learning tool developed for the SANS FOR610 (Reverse Engineering Malware) course, designed to help users understand stack operations, pointer manipulation, and command execution in exploit development and malware analysis. The second tool discussed was rootasrole, a Linux privilege management utility that enables granular assignment of capabilities to users, unlike traditional sudo, though it is currently only natively supported on Arch Linux and requires manual compilation for other distributions. The episode also highlighted a supply chain security vulnerability identified by Jacob Guinness of Carnegie Mellon University, demonstrating how Git commit signatures and hashes can be spoofed due to inconsistent normalization in GitHub and local Git implementations, allowing attackers to create valid signatures for malicious commits. The issue underscores the need for bug fixes in Git and GitHub while raising awareness of potential detection methods.

During my last FOR610 session, a student asked me if I had some statistics in mind about the compilers used to generate malicious PE files? A couple of months ago, I shared some stats about the trend in 64bits VS. 32bits malware[1]. Can we go a bit further? I (vibe-)coded a Python script based on the pefile library[2] to extract some info from the PE headers. Indeed, the PE file format contains a lot of metadata! They can be accessed using a lot of tools, like Detect It Easy:

This week, I'm attending the SEC670[1] training (“Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control”). From my point of view, this training fits perfectly with FOR610 or FOR710 (malware analysis) because it addresses malware from the opposite: Instead of performing reverse engineering, you write malicious code! Always interesting to have another point of view.

This week, I’m attending the SEC670[1] training (“Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control”). From my point of view, this training fits perfectly with FOR610 or FOR710 (malware analysis) because it addresses malware from the opposite: Instead of performing reverse engineering, you write malicious code! Always interesting to have another point of view. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using co...

In 2022 (time flies!), I wrote a diary about the 32-bits VS. 64-bits malware landscape[1]. It demonstrated that, despite the growing number of 64-bits computers, the "old-architecture" remained the standard. In the SANS malware reversing training (FOR610[2]), we quickly cover the main differences between the two architectures. One of the conclusions is that 32-bits code is still popular because it acts like a comme denominator and allows threat actors to target more Windows computers. Yes, Microsoft Windows can smoothly execute 32-bits code on 64-bits computers. It is still the case in 2026? Did the situation evolved?

When I'm teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31de63d5afaf18a735744f) identified by 17/65 antiviruses on VT[2]. Let's have a look at the infection path.

When I’m teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files” (read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst or security controls. Here is an example that I found yesterday. An email was received via an attached ZIP archive. It contained a simple file: “Payment_confirmation_copy_30K__202512110937495663904650431.vbs” (SHA256:d9bd350b04cd2540bbcbf9da1f3321f8c6bba1d8fe31...

Learn about SANS Digital Forensics courses, training and certifications as well as an extensive suite of free Digital Forensics resources.

118 Posts, 46 Following, 816 Followers · Freelance | Blogger | SANS ISC Handler | FOR610 & FOR710 Instructor | BruCON Co-organizer | BlueTeam | DFIR | Drones | MTB | PGP: 0x42D006FD51AD7F2C | Msgs are mine!

Xavier asked me a question from one of his FOR610 students: "how can you perform a regex search with XORsearch"?

I returned from another FOR610[1] class last week in London. One key tip I give to my students is to keep an eye on "strange" API calls. In the Windows ecosystem, Microsoft offers tons of API calls to developers. The fact that an API is used in a program does not always mean we are facing malicious code, but sometimes, some of them are derived from their official purpose. One of my hunting rules for malicious scripts is to search for occurrences of the ctypes[2] library. It allows Python to call functions in DLLs or shared libraries.

A cybersecurity analyst recently returned from a FOR610 class in London, where he shared a crucial piece of advice: monitoring "strange" API calls within the Windows ecosystem. Although API calls are not always malicious, some can be misused from their intended purpose. A hunting rule for malicious scripts is to look for occurrences of the ctypes library, which allows Python to call functions in DLLs or shared libraries.

FOR610 teaches how to perform interactive behavioral analysis of malware, deobfuscate samples, circumvent anti-analysis capabilities, and review key aspects of malicious code for a deeper understanding of its functionality.

When I teach FOR610[1], I like to use a funny quotation with my students: “Make malware happy!” What does it mean? Yes, we like malware, and we need to treat it in a friendly way. To help the malware work or detonate successfully, it's recommended that we replicate the environment where it was discovered (or at least, as much as possible). This is not always easy because we often receive a sample outside of its context.