BLACK ICE

// ENGAGEMENT_TIMELINE

1. [T+0h] Sample ingested from SOC quarantine; static triage started.
2. [T+4h] Identified sideload DLL; unpacked second-stage shellcode.
3. [T+1d] C2 protocol mapped; YARA + Sigma rules drafted.

// VULNERABILITIES

• [HIGH]IOC-01Signed MSI with vulnerable legitimate EXE
• [MEDIUM]IOC-02Encrypted config blob in .rsrc

// TOOLS_USED

// OUTCOME

> Detection pack shipped to SOC. Blocked C2 domains and MSI hash cluster across EDR fleet.