🛡️ DFIR & Threat Intelligence Research

Defensive research repository. All malware samples are defanged. See DISCLAIMER.md before use.

Practical Digital Forensics, Incident Response (DFIR), and Threat Intelligence research — built around real-world campaigns observed in the wild.

This is not a theoretical collection. Every playbook, sample, and write-up here comes from actual threat activity.

⚡ Quick Actions

Jump straight to the most useful resources in this repo.

What's in Here

📋 Incident Response Playbooks (/playbooks/)

Step-by-step SOC-ready response procedures aligned with NIST and SANS IR methodology. Each playbook covers Detection → Triage → Containment → Eradication → Recovery → Lessons Learned.

🦠 Malware Samples (/playbooks/malware-infection/)

Defanged samples collected from active campaigns. All .php files renamed to .php.sample — cannot execute in this state.

See the malware-infection README for full analysis notes.

🕵️ Threat Intelligence & Incident Notes (/incident-notes/)

Real-world threat investigations written in analyst format.

• Fake CAPTCHA PowerShell Campaign (91.84.125.16) — Active campaign abusing Windows Run dialog to execute fileless PowerShell malware

🏗️ Threat Infrastructure (/threat-infrastructure/)

📊 Ransomware Intelligence

• Black Shrantac — Double-extortion actor active Sep 2025–Jan 2026. 30+ victims across government, healthcare, utilities, financial services.
• Green Blood Ransomware — Extension .gblood, known SHA-256 hashes, ransom note variants.

🎯 IOC Quick Reference

Copy-paste ready for SIEM, firewall, or threat hunting. All IPs/domains are defanged — remove brackets before use.

Malicious IPs

91.84.125[.]16        # Fake CAPTCHA PowerShell C2 — payload host (/big.txt)
5.9.228[.]188:5000    # Shadow C2 admin panel

Malicious Domains

wertg-rewe[.]com      # cleavable.php loader C2 (obfuscated in octal)
stepmomhub[.]com      # cache.php WordPress mass-compromise receiver

File Hashes (SHA-256)

365f2f4de5ac872ce5a1fe6fbbf382b936c1defc6d767a37f69b5df4188d9522   # shadow-bot PHP shell
05294c9970f365c92e0b0f1250db678dc356dbf418dba27bdd5eeb68487a7199   # Green Blood ransomware sample

Ransomware File Extensions

.gblood    # Green Blood Ransomware

Ransomware Note Filenames

RESTORE_FILES.txt
README.txt
DECRYPT_INSTRUCTIONS.txt
IMPORTANT_README.txt
HOW_TO_RECOVER_FILES.txt

🔎 Detection Quick Reference

Ready-to-adapt queries for common SIEM/EDR platforms.

PowerShell / Fileless Malware

# Windows Event Log — ScriptBlock Logging (Event ID 4104)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
  Where-Object { $_.Message -match "Invoke-Expression|iex\b|-enc\b|91\.84\.125\.16" }

# Sysmon / EDR — suspicious PowerShell launch
CommandLine contains "-enc" AND ParentProcess in ("outlook.exe","chrome.exe","msedge.exe","firefox.exe")

Web Shell Detection

# Search for web shell indicators in web root
grep -rn "eval(base64_decode\|shell_exec\|system(\|passthru(\|root@xshikata\|create_wp_admin" /var/www/

# Alert on PHP process spawning shell
ParentProcess == "php-fpm" AND ChildProcess in ("bash","sh","cmd.exe","powershell.exe")

C2 Network Hunting

# SIEM — outbound to known bad IPs
dst_ip IN ("91.84.125.16", "5.9.228.188") AND direction == "outbound"

# Proxy logs — suspicious path
http.uri_path == "/big.txt" AND http.method == "GET"

# Alert on port 5000 outbound from servers
dst_port == 5000 AND src_zone == "server_dmz"

DNS Tunneling

# High-entropy subdomain detection
dns.query.name MATCHES "^[a-z0-9]{25,}\\..*$"
AND dns.query.count > 50 WITHIN 5m
AND dns.query.domain NOT IN (whitelist)

Ransomware Indicators

# File extension monitoring
file.extension IN (".gblood") OR
file.name IN ("RESTORE_FILES.txt","DECRYPT_INSTRUCTIONS.txt","HOW_TO_RECOVER_FILES.txt")

# Mass file modification (ransomware encryption behavior)
file.write_count > 500 WITHIN 60s AND process.name NOT IN (backup_tools_whitelist)

🗺️ MITRE ATT&CK Coverage

🌍 Live Threat Map

Visualizing active campaigns, C2 infrastructure, and attacker geography documented in this repo.

Design Principles

• Real campaigns, not hypotheticals
• Defender-first — detection queries and response steps are the priority
• MITRE ATT&CK mapped across all playbooks
• SOC-ready structure for Tier 1–3 analysts

⚠️ Disclaimer

All samples are defanged and stored for defensive research only. See DISCLAIMER.md.

Regan Temudo | DFIR & Threat Intelligence
LinkedIn · GitHub