A Hunting Story

Now that we have positively identified useful base64 encoded malicious strings through a Recorded Future list and
search, we will save the search and alert on future references or events that match our criteria, because a hunting
team’s work is never done.
Recorded Future email alert based on new “FromBase64String” references.
4. Examples of base64 encoded strings in web favicons.
Our fourth example involves favicons, because they are specifically referenced in the above nation-state attack
observables.
Favicon references containing base64 encoded strings.
Recorded Future Threat Intelligence Report
19