Ayush Anand
@Securityinbits

Detection engineering, threat hunting, malware analysis. One defender bit at a time.

 Join for free →
newsletter.securityinbits.co…
Joined September 2015
190 Photos and videos
Article

ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays

An installer landed on a workstation from a browser download. The signature checked out: CN="ConnectWise, LLC", issued by DigiCert Trusted G4. It was a real ScreenConnect client doing exactly what a
3
23
22,237
Article

32 Ransomware Groups Abuse AnyDesk. Your EDR Sees a Legit Tool

invoice_viewer.exe ran from a user's Temp folder. It was not an invoice viewer. Every version-info field on it read AnyDesk: company AnyDesk Software GmbH, product AnyDesk, description AnyDesk.

1
3
6
4,947
Article

ssh.exe -R Proves a Tunnel Exists. It Doesn't Prove a Pivot.

You found ssh.exe running on a workstation, saw the -R, and thought: just a tunnel. That reflex is right often enough to be dangerous. In a July 2025 intrusion that The DFIR Report documented, Akira's

2
5
24
25,025
Article

Hunt Ransomware Before It Encrypts: The Three Tools 45+ Gangs Reach For

In just the first five months of 2026, 3,758 organizations were hit by ransomware. The attackers were not caught at encryption because nothing fired earlier. The discovery phase is where the attack

2
34
123
53,545
Article

LSASS Dump via comsvcs.dll: Defender Detection Guide

Attackers dump LSASS with comsvcs.dll to steal credentials; here’s how to spot rundll32 + MiniDump fast and reliably. What the technique is Adversaries attempt to access credential stored in the
2
10
345
Load more