Thomas Roccia (fr0gger) Profile

Thomas Roccia (fr0gger)

Senior Security Researcher at Microsoft

Administrator Founder Top Contributor

Thomas Roccia is a seasoned threat researcher. Currently, he serves as a Senior Security Researcher at Microsoft Threat Intelligence and operates SecurityBreak, an online platform for his project updates and research.

Contributed Techniques

Technique Name	Technique ID's	Categories	Snippet(s)	Rules(s)
XProtect Encryption Abuse	U0711
PyArmor	U1435
Trap Flag	U0131
ICE 0xF1	U0130
INT 0x2D	U0129 B0001.006
BobSoft Mini Delphi Packer	U1428
CryptOne	U1427
CloudEye/DarkEye	U1426
NLS Code Injection Through Registry	U1237
hXOR Packer	U1418
ConfuserEx	U1417
Code Cave	U0502
Base64	U0706 E1027.m02

Contributed Code Snippets

Technique	Language	Creation Date
kernel flag inspection via sysctl	Python	1 year, 2 months
Checking Memory Size	C++	3 years
Detecting USB Drive	C++	3 years
Connected Printer	C++	3 years
Geofencing	Python	3 years
Image File Execution Options Injection	C++	3 years, 2 months
COM Hijacking	C++	3 years, 2 months
Checking Pipe	C++	3 years, 3 months
Geofencing	C++	3 years, 3 months
Hiding Mechanisms	C++	3 years, 3 months
Malvertising	JavaScript	3 years, 3 months
Fast Flux	Python	3 years, 3 months
Domain Generation Algorithm	Python	3 years, 3 months
DNS Tunneling	Python	3 years, 3 months
DNS Hijacking	Python	3 years, 3 months
Tor Network C2	Python	3 years, 3 months
Peer to peer C2	Python	3 years, 3 months
C2 via Social Networks	Python	3 years, 3 months
ROL	Python	3 years, 3 months
Cryptography	Python	3 years, 3 months
Custom Encoding	Python	3 years, 3 months
XOR Operation	C++	3 years, 3 months
XOR Operation	Python	3 years, 3 months
Kill Process	C++	5 years, 5 months
TLS Callback	C++	5 years, 6 months
Checking Malware Name	C++	5 years, 6 months
IsDebuggerPresent	C++	5 years, 6 months
OutputDebugString	C++	5 years, 6 months
Indicator Removal: Clear Windows Event Logs	cmd	5 years, 6 months
Detecting Mac Address	Golang	5 years, 6 months
Caesar Cipher	Golang	5 years, 6 months
Base64	Golang	5 years, 6 months
Detecting Hostname, Username	C++	5 years, 6 months
Checking Screen Resolution	C++	5 years, 6 months
Detecting Virtual Environment Files	C++	5 years, 6 months
SMSW	C++	5 years, 6 months
Checking Hard Drive Size	Python	5 years, 6 months
Detecting Virtual Environment Artefacts	C++	5 years, 6 months

Contributed Detection Rules

Rule Name	Rule Type	Technique Count	Creation Date
Detect SMTP Data Exfiltration	YARA	1	1 year, 2 months