Was reading a great Malware Analysis Report by DeepEnd Research, http://www.deependresearch.org/2011/10/dirt-jumper-ddos-bot-new-versions-new.html.  What I particularly liked about the report was the format; it was structured, each section was clearly defined, and you knew what you were going to get out of each section.  The group breaks down each 'area' of analysis and provides a nice TOC which is below:

Table of Content

1. Binary analysis
   MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
2. Memory analysis using Volatity 2.0MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
3. Command & Control servers
   MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
4. Dirt Jumper current versions and general information
5. Review of other samples, command and control servers and DDoS actor groups

Under each section they provide screenshots of the tools and COMMANDS they run during analysis.  I find this especially helpful for the 'new' security professional because it allows them to read a report and take that knowledge and apply it immediately to what they might be doing (or plan to do in the future).

The report provides screenshots of the Bot Interface (tools) and mentions IDS rules that exists and ones which can be modified to 'cover' this type of threat.

Awesome Job Guys!!  Looking forward to what comes on in the future.

bartola

Part of my daily routine is reading endless computer security articles.  I share out the articles I find interesting on my google reader site: https://www.google.com/reader/shared/00814031516738468557  Please go ahead and use this site and pass it on to anyone in the security field. 

Well, I figured it was time to start my own site/blog.  This site will contain my thoughts, gripes, and research mostly in the world of the computer security field.  I had been doing this type of work for my old employer but one thing I learned in the last few months is sometimes you need to put it under 'your name' not the company you work for...  So we'll see where this leads....

bartola..