Category: IT Security
-

Malware’s Conspiracy at a Glance! 🕸️ Visualizing the ‘Link’ Between Registry and File Behavior (with AI)
*This posting is part of Coupang Partners activity and receives a certain amount of commission. Hello, security analysts who see the big picture! 🕵️♂️ Last time, we used AI to meticulously pick out only ‘Anomalies’ from tens of thousands of lines of log data. “Oh? An unusual file (payload.exe) was secretly created?” “Oh? Something was…
-
![[Hands-on] “Too Many Logs, I’m Drowning!” 🤮 Extracting Only ‘Anomalous Behavior’ from Vast System Logs with AI! 📉](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a56bf7adbc4d.jpeg)
[Hands-on] “Too Many Logs, I’m Drowning!” 🤮 Extracting Only ‘Anomalous Behavior’ from Vast System Logs with AI! 📉
Hello, security analysts who love efficiency! 🕵️♂️ Last time, we executed malware in a sandbox and collected logs with ProcMon, didn’t we? But when you actually open the collected log files… 100,000 lines, 200,000 lines… you’re often overwhelmed by an endless feast of text. 😱 “When am I supposed to read all of this? How…
-

Can the original text be fully restored by reverse-engineering embedding vectors?
LLM and RAG systems use embeddings to search for documents or conversation content. For example, let’s say we have the following sentence: "고객사 A와 1억 원 규모의 보안 교육 계약을 체결했다." An embedding model converts this sentence into a numerical array like this: [0.132, -0.847, 0.291, …] This numerical array is an embedding vector. This…
-
![[Practice] “What’s the Name of This Attack?” 🏷️ Converting (Mapping) Identified Malicious Behaviors to MITRE ATT&CK IDs](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a556e5a47b09.jpeg)
[Practice] “What’s the Name of This Attack?” 🏷️ Converting (Mapping) Identified Malicious Behaviors to MITRE ATT&CK IDs
Hello, security analysts striving for global standards! 🌏 Over the past sessions, we’ve dissected, executed, and even drawn timelines for malware, meticulously uncovering its ‘criminal acts (Behavior)’. Your analysis notes probably contain entries like these: “Registered in the Registry Run key, so it executes even after reboot.” “Bypassed UAC prompt to gain administrator privileges.” “Executed…
-
![[Practice] “Time of Crime: 14:30!” ⏱️ Reconstructing Malicious Activity Timeline and Completing the Scenario](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a556e1c48757.jpeg)
[Practice] “Time of Crime: 14:30!” ⏱️ Reconstructing Malicious Activity Timeline and Completing the Scenario
Hello, digital forensic investigators uncovering the truth of incidents! 🕵️♂️⌚️ Until now, we have gathered the puzzle pieces of malware one by one. We’ve analyzed code, behavioral logs, mapped to MITRE ATT&CK, and even understood the attacker’s intent. But there’s still one missing piece: ‘Time’. In crime investigation movies, they reconstruct the incident by writing…
-
![[Theory] The Essential Weapon for Malware Hunters! 🏹 Mastering YARA Rule Syntax (Meta, Strings, Condition)](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a541d3a27112.jpeg)
[Theory] The Essential Weapon for Malware Hunters! 🏹 Mastering YARA Rule Syntax (Meta, Strings, Condition)
Hello, analysts fighting on the front lines of security! 🛡️ When analyzing malware, there are times when you need to pinpoint “that specific one I was looking for” among thousands or tens of thousands of files. You can’t open them all one by one, and it’s even more daunting if it’s new malware that existing…
-
![[Advanced] “Thought the analysis was over?” 🕵️♂️ How AI Helps Find ‘Missed Evidence’ (Intent-Based Artifact Recommendation)](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a541cfeb1b20.jpeg)
[Advanced] “Thought the analysis was over?” 🕵️♂️ How AI Helps Find ‘Missed Evidence’ (Intent-Based Artifact Recommendation)
Hello, security researchers who question everything! 🔍 Last time, we identified the attacker’s ‘Intent’ and ‘Objective’ through AI. “Aha! This guy’s objective was ‘Information Theft (Infostealer)’ to steal our company’s blueprints and sell them to a competitor!” So, now that we know the culprit’s objective, is the investigation over? Absolutely not. 🙅♂️ In fact, the…
-
![[Practice] “What did you talk about with the hacker?” 📡 C&C Server Communication Packet Analysis and Kill Chain Classification](https://cslab.cloudsecuritylab.co.kr/wp-content/uploads/2026/07/wrimo-image-6a541cbdead5e.jpeg)
[Practice] “What did you talk about with the hacker?” 📡 C&C Server Communication Packet Analysis and Kill Chain Classification
Hello, digital world eavesdropping experts (?), everyone! 🕵️♂️🎧 Until last time, we executed malware inside a PC and observed what it did (dynamic analysis). We confirmed that it created files and tampered with the registry. However, the ‘finishing touch’ of malware analysis is network analysis. Malware does not act alone. It must communicate with the…
-

ChatGPT Has a Pet? OpenAI Pets Feature and How to Create Custom Pets
ChatGPT Has a Pet? What is OpenAI’s ‘Pets’ Feature? Recently, when using the ChatGPT desktop app or Codex, you might have noticed a small animated character appearing on one side of the screen. At first glance, it might seem like a simple desktop pet designed to entertain users, but the actual role of this character…
-

GPT-5.6 Release Summary: Performance, Price, Sol·Terra·Luna, and ChatGPT Changes
Evolution to an ‘AI that finishes tasks,’ not just a smarter chatbot OpenAI (OpenAI) has launched. It’s often called ‘ChatGPT 5.6,’ but to be precise, the GPT-5.6 model has been newly applied to the ChatGPT service. GPT-5.6 has officially become available on ChatGPT, Codex, and the OpenAI API after a limited preview period. OpenAI describes…