FourCore Blog https://fourcore.io Latest updates, articles, tutorials and guides from the FourCore team. Thu, 05 Mar 2026 21:07:00 GMT https://validator.w3.org/feed/docs/rss2.html Feed for Node.js FourCore Blog https://fourcore.io/logo.svg https://fourcore.io All rights reserved 2026, FourCore Labs Pvt. Ltd. <![CDATA[Threat-informed defense with HarfangLab EDR and FourCore ATTACK]]> https://fourcore.io/blogs/threat-informed-defense-with-harfanglab-fourcore-attack https://fourcore.io/blogs/threat-informed-defense-with-harfanglab-fourcore-attack Tue, 27 May 2025 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[Customer Success Story: Defense Contractor in The Middle East Improves Detection and Response]]> https://fourcore.io/blogs/customer-success-story-defense-contractor https://fourcore.io/blogs/customer-success-story-defense-contractor Mon, 01 Apr 2024 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Threat-informed defense with LimaCharlie and FourCore ATTACK]]> https://fourcore.io/blogs/threat-informed-defense-with-limacharlie-fourcore-attack https://fourcore.io/blogs/threat-informed-defense-with-limacharlie-fourcore-attack Sun, 17 Dec 2023 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Rhysida Ransomware: History, TTPs and Adversary Emulation Plans]]> https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation Tue, 12 Dec 2023 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[Threat Hunting: Detecting Browser Credential Stealing [T1555.003]]]> https://fourcore.io/blogs/threat-hunting-browser-credential-stealing https://fourcore.io/blogs/threat-hunting-browser-credential-stealing Thu, 26 Oct 2023 00:00:00 GMT team@fourcore.io (Parth Gol) <![CDATA[CVE-2023-36884 MS Office Zero-Day Vulnerability Exploited For Espionage - Detection and Mitigation]]> https://fourcore.io/blogs/cve-2023-36884-ms-office-zero-day-vulnerability https://fourcore.io/blogs/cve-2023-36884-ms-office-zero-day-vulnerability Mon, 17 Jul 2023 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Clop Ransomware: History, Timeline, And Adversary Simulation]]> https://fourcore.io/blogs/clop-ransomware-history-adversary-simulation https://fourcore.io/blogs/clop-ransomware-history-adversary-simulation Sat, 03 Jun 2023 00:00:00 GMT team@fourcore.io (Jones Martin) <![CDATA[No more Access Denied - I am TrustedInstaller]]> https://fourcore.io/blogs/no-more-access-denied-i-am-trustedinstaller https://fourcore.io/blogs/no-more-access-denied-i-am-trustedinstaller Thu, 16 Feb 2023 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[A Malicious Note: Hackers using Microsoft OneNote Attachments to spread malware ]]> https://fourcore.io/blogs/hackers-using-microsoft-onenote-attachments-to-spread-malware https://fourcore.io/blogs/hackers-using-microsoft-onenote-attachments-to-spread-malware Sun, 29 Jan 2023 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Exploit Party: Bring Your Own Vulnerable Driver Attacks]]> https://fourcore.io/blogs/bring-your-own-vulnerable-driver-attack https://fourcore.io/blogs/bring-your-own-vulnerable-driver-attack Sun, 08 Jan 2023 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[Honey, I shrunk the SOC: Measuring Threat Visibility with MITRE ATT&CK(R)]]> https://fourcore.io/blogs/measuring-threat-visibility-mitre-attack-fourcore-tidal-cyber https://fourcore.io/blogs/measuring-threat-visibility-mitre-attack-fourcore-tidal-cyber Wed, 04 Jan 2023 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[EDR: Detections, Bypassess and other Shenanigans]]> https://fourcore.io/blogs/edr-detections-bypasses-and-other-shenanigans https://fourcore.io/blogs/edr-detections-bypasses-and-other-shenanigans Fri, 28 Oct 2022 00:00:00 GMT team@fourcore.io (Sourav Sen) <![CDATA[Microsoft Exchange Zero-Day Actively Exploited In Attacks: How to Mitigate]]> https://fourcore.io/blogs/microsoft-exchange-zero-day-actively-exploited-in-attack-mitigation https://fourcore.io/blogs/microsoft-exchange-zero-day-actively-exploited-in-attack-mitigation Fri, 30 Sep 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[WhatsApp zero-day bug: What you need to know]]> https://fourcore.io/blogs/whatsapp-zero-day-exploit-what-you-need-to-know https://fourcore.io/blogs/whatsapp-zero-day-exploit-what-you-need-to-know Thu, 29 Sep 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Ryuk Ransomware: History, Timeline, and Adversary Simulation]]> https://fourcore.io/blogs/ryuk-ransomware-simulation-mitre-ttp https://fourcore.io/blogs/ryuk-ransomware-simulation-mitre-ttp Wed, 31 Aug 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Detection Engineering with MITRE Top Techniques & Atomic Red Team]]> https://fourcore.io/blogs/detection-engineering-with-mitre-engenuity-atomic-red-team https://fourcore.io/blogs/detection-engineering-with-mitre-engenuity-atomic-red-team Sat, 20 Aug 2022 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[ATT&CK + D3FEND = D.E.A.T.H]]> https://fourcore.io/blogs/mitre-attack-mitre-defend-detection-engineering-threat-hunting https://fourcore.io/blogs/mitre-attack-mitre-defend-detection-engineering-threat-hunting Sat, 13 Aug 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[New Era of Phishing Payloads]]> https://fourcore.io/blogs/modern-initial-access-vector-macro-depreciation https://fourcore.io/blogs/modern-initial-access-vector-macro-depreciation Fri, 05 Aug 2022 00:00:00 GMT team@fourcore.io (Ratan Gupta) <![CDATA[Manipulating Windows Tokens with Go]]> https://fourcore.io/blogs/manipulating-windows-tokens-with-golang https://fourcore.io/blogs/manipulating-windows-tokens-with-golang Wed, 27 Jul 2022 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[Top 10 Awesome Open-Source Adversary Simulation Tools]]> https://fourcore.io/blogs/top-10-open-source-adversary-emulation-tools https://fourcore.io/blogs/top-10-open-source-adversary-emulation-tools Sun, 24 Jul 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Genesis - The Birth of a Windows Process (Part 2)]]> https://fourcore.io/blogs/how-a-windows-process-is-created-part-2 https://fourcore.io/blogs/how-a-windows-process-is-created-part-2 Sat, 16 Jul 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Genesis - The Birth of a Windows Process (Part 1)]]> https://fourcore.io/blogs/how-a-windows-process-is-created-part-1 https://fourcore.io/blogs/how-a-windows-process-is-created-part-1 Wed, 13 Jul 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Raspberry Robin Worm infecting hundreds of Windows networks - Detection Sigma Rules]]> https://fourcore.io/blogs/raspberry-robin https://fourcore.io/blogs/raspberry-robin Tue, 05 Jul 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Jenkins discloses zero-day vulnerabilities affecting dozens of plugins]]> https://fourcore.io/blogs/jenkins-plugins-zero-day-dozens-vulnerable https://fourcore.io/blogs/jenkins-plugins-zero-day-dozens-vulnerable Mon, 04 Jul 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[A deep dive into Sigma rules and how to write your own threat detection rules]]> https://fourcore.io/blogs/sigma-rules-open-source-threat-hunting-approach https://fourcore.io/blogs/sigma-rules-open-source-threat-hunting-approach Tue, 21 Jun 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Red, Blue, and Purple Teaming: A collaborative approach to Security Assurance]]> https://fourcore.io/blogs/red-blue-purple-teaming https://fourcore.io/blogs/red-blue-purple-teaming Tue, 14 Jun 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Customer Success Story: Financial Services Firm improved threat visibility in two weeks]]> https://fourcore.io/blogs/customer-success-story-improve-threat-visibility-2-weeks-financial-services https://fourcore.io/blogs/customer-success-story-improve-threat-visibility-2-weeks-financial-services Tue, 07 Jun 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Using Windows Event Log IDs for Threat Hunting]]> https://fourcore.io/blogs/threat-hunting-with-windows-event-log-sigma-rules https://fourcore.io/blogs/threat-hunting-with-windows-event-log-sigma-rules Mon, 06 Jun 2022 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[New zero-day code execution vulnerability in MS Office - Follina]]> https://fourcore.io/blogs/follina-ms-office-msdt-code-execution-zero-day-vulnerability https://fourcore.io/blogs/follina-ms-office-msdt-code-execution-zero-day-vulnerability Mon, 30 May 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[F5 BIG-IP critical vulnerability exploited by attackers to gain unauthenticated RCE]]> https://fourcore.io/blogs/f5-big-ip-cve-2022-1388-unauthenticated-rce-exploited-by-attackers https://fourcore.io/blogs/f5-big-ip-cve-2022-1388-unauthenticated-rce-exploited-by-attackers Mon, 16 May 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[The curious case of mavinject.exe]]> https://fourcore.io/blogs/mavinject-curious-process-injection https://fourcore.io/blogs/mavinject-curious-process-injection Thu, 05 May 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Privilege escalation vulnerabilities discovered in Linux known as Nimbuspwn]]> https://fourcore.io/blogs/nimbuspwn-linux-vulnerabilities-allows-root-access-cve-2022-29799-and-cve-2022-29800 https://fourcore.io/blogs/nimbuspwn-linux-vulnerabilities-allows-root-access-cve-2022-29799-and-cve-2022-29800 Fri, 29 Apr 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[Colibri Loader's unique Persistence Technique using Get-Variable cmdlet]]> https://fourcore.io/blogs/colibri-loader-powershell-get-variable-persistence https://fourcore.io/blogs/colibri-loader-powershell-get-variable-persistence Tue, 26 Apr 2022 00:00:00 GMT team@fourcore.io (Swapnil) <![CDATA[Critical Zero-Click Zero-Day Vulnerability in Windows RPC (CVE-2022-26809)]]> https://fourcore.io/blogs/cve-2022-26809-ms-rpc-zero-day-vulnerability https://fourcore.io/blogs/cve-2022-26809-ms-rpc-zero-day-vulnerability Mon, 18 Apr 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[firedrill: an open source malware simulation harness]]> https://fourcore.io/blogs/firedrill-open-source-attack-simulation https://fourcore.io/blogs/firedrill-open-source-attack-simulation Sun, 23 Jan 2022 00:00:00 GMT team@fourcore.io (Aarush Ahuja) <![CDATA[This cyber attack can cost you $4mn.]]> https://fourcore.io/blogs/this-cyber-attack-can-cost-you-4mn https://fourcore.io/blogs/this-cyber-attack-can-cost-you-4mn Fri, 14 Jan 2022 00:00:00 GMT team@fourcore.io (Hardik Manocha) <![CDATA[Red Team Adventure: Digging into Windows Endpoints for EDRs and profit]]> https://fourcore.io/blogs/red-team-adventure-windows-endpoints-edr-edrhunt https://fourcore.io/blogs/red-team-adventure-windows-endpoints-edr-edrhunt Sun, 10 Oct 2021 00:00:00 GMT team@fourcore.io (Hardik Manocha)