Documentation for the curious.
Welcome to the_default_gateway
In networking, the default gateway is the device your traffic turns to when it doesn't know the route. No entry in the table, no idea where to go next? Send it to the gateway — it'll figure it out from there.
That's exactly what I want this site to be.
Read more →6 posts·19 notes·35 projects
Latest
Malware Analysis — Part 8: Dynamic Analysis Part 2 — Network Traffic and Sandboxes
Network traffic analysis during malware execution — capturing and reading PCAPs with Wireshark, understanding C2 communication patterns, extracting artifacts from network captures, and using automated sandboxes effectively.
Malware Analysis — Part 7: Dynamic Analysis Part 1 — Behavioral Monitoring
Dynamic analysis in depth — setting up the monitoring stack, using Process Monitor, Process Explorer, Autoruns, and TCPView to capture every filesystem, registry, process, and network action the malware takes. Includes filtering strategies for making sense of millions of events.
Malware Analysis — Part 6: Static Analysis Part 2 — Strings, YARA, and IOC Extraction
The second half of static analysis — extracting strings from obfuscated binaries with FLOSS, writing YARA rules to detect malware families, using capa for capability mapping, and extracting every indicator of compromise before touching dynamic analysis.
Malware Analysis — Part 5: Static Analysis Part 1 — File Identification and PE Structure
A deep dive into static analysis — examining malware without executing it. Covers the Windows PE file format in detail, what headers and sections reveal, entropy analysis, packer detection, and reading import tables like a story.
Malware Analysis — Part 4: Safe Sample Acquisition, Triage, and Permissions
How to safely obtain malware samples, verify file integrity with hashes, use VirusTotal correctly, configure Windows permissions to prevent accidental execution, and perform initial triage before touching a sample.
Malware Analysis — Part 3: Setting Up REMnux and INetSim
Install and configure REMnux — the Linux-based malware analysis distribution — and set up INetSim to simulate internet services for controlled malware network analysis. Every built-in tool explained.