{"id":220764,"date":"2020-04-22T09:35:45","date_gmt":"2020-04-22T07:35:45","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=220764"},"modified":"2020-04-22T09:35:45","modified_gmt":"2020-04-22T07:35:45","slug":"malware-wav","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/malware-wav\/","title":{"rendered":"Incident Response: How can malware use the WAV format to deploy a malicious payload?"},"content":{"rendered":"\n[et_pb_section fb_built=\u00a0\u00bb1″ _builder_version=\u00a0\u00bb4.4.3″][et_pb_row _builder_version=\u00a0\u00bb4.4.3″][et_pb_column type=\u00a0\u00bb4_4″ _builder_version=\u00a0\u00bb4.4.3″][et_pb_text _builder_version=\u00a0\u00bb4.4.3″]

Les groupes d\u2019attaquant utilisent aujourd\u2019hui des techniques de plus en plus avanc\u00e9es afin de passer inaper\u00e7us aux yeux des m\u00e9canismes de d\u00e9tection<\/strong> utilis\u00e9s par leurs cibles. Certaines de ces attaques utilisent la st\u00e9ganographie<\/strong>\u00a0<\/strong>pour tenter de dissimuler des charges malveillantes.<\/strong><\/p>\n

Par exemple, nous avons observ\u00e9 l\u2019utilisation de fichiers WAV<\/strong>, initialement destin\u00e9s \u00e0 contenir des donn\u00e9es audio, \u00eatre utilis\u00e9s afin d\u2019ex\u00e9cuter des malwares. L\u2019article de Symantec[1] faisant r\u00e9f\u00e9rence \u00e0 Waterbug, \u00e9voque cette technique.<\/p>\n

Lors d\u2019une r\u00e9ponse \u00e0 incident, nous avons constat\u00e9 l\u2019utilisation de ce type de fichier. Les attaquants utilisaient un binaire nomm\u00e9 \u00ab\u00a0Tasklistw.exe\u00a0\u00bb prenant comme param\u00e8tre un fichier WAV, dans lequel y \u00e9tait stock\u00e9 un code permettant d\u2019ex\u00e9cuter Meterpreter. La m\u00e9thode utilis\u00e9e par ce binaire \u00e9tait tr\u00e8s similaire \u00e0 celle d\u00e9crite dans l\u2019article de Cylance[2].<\/p>[\/et_pb_text][et_pb_text _builder_version=\u00a0\u00bb4.4.3″ header_text_color=\u00a0\u00bb#071793″ header_2_text_color=\u00a0\u00bb#071793″]

<\/h2>\n

<\/h2>\n

Analyse<\/h2>[\/et_pb_text][et_pb_text _builder_version=\u00a0\u00bb4.4.3″]

Nous allons revoir ensemble comment le binaire malveillant r\u00e9cup\u00e9rait le contenu malveillant depuis le fichier WAV.<\/strong><\/p>\n

Tout d\u2019abord les 44 premiers octets d\u2019un fichier WAV contiennent son en-t\u00eate [3]. L\u2019offset 40 correspond \u00e0 la taille de la section DATA, dans laquelle va \u00eatre stock\u00e9e la charge malveillante. La section DATA quant \u00e0 elle, est situ\u00e9e juste apr\u00e8s l\u2019en-t\u00eate, \u00e0 l\u2019offset 44.<\/p>\n

L\u2019analyse montre que le malware (Tasklistw.exe) va tout d\u2019abord r\u00e9cup\u00e9rer la taille de la section du fichier WAV passer en param\u00e8tre et ensuite l\u2019extraire avec la fonction ReadFile\u00a0:<\/p>[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2020\/04\/fig1-turla.png" align="center" _builder_version="4.4.3" width="68%"][\/et_pb_image][et_pb_text _builder_version="4.4.3"]

La principale diff\u00e9rence avec les \u00e9l\u00e9ments identifi\u00e9s par Cylance se fait sur l\u2019extraction\u00a0:<\/p>[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2020\/04\/fig2-turla.png" align="center" _builder_version="4.4.3"][\/et_pb_image][et_pb_text _builder_version="4.4.3"]

La fonction srand va ensuite \u00eatre appel\u00e9e avec comme seed 0x309. Puis, pour chaque octet, le binaire va calculer la diff\u00e9rence entre la valeur originale et le retour de la fonction rand modulo 256\u00a0:<\/p>[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2020\/04\/fig3-turla.png" align="center" _builder_version="4.4.3"][\/et_pb_image][et_pb_text _builder_version="4.4.3"]

Gr\u00e2ce \u00e0 ces \u00e9l\u00e9ments il a \u00e9t\u00e9 possible de d\u00e9velopper un extracteur en python[4].<\/p>[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2020\/04\/fig4-t.png" align="center" _builder_version="4.4.3" width="69%"][\/et_pb_image][et_pb_text _builder_version="4.4.3"]

Comme dit pr\u00e9c\u00e9demment, la principale diff\u00e9rence avec ce qui a d\u00e9j\u00e0 \u00e9t\u00e9 constat\u00e9 par Cylance, est le d\u00e9calage entre les diff\u00e9rents octets composant le binaire dans la section DATA du fichier WAV. Il est alors possible de reprendre la r\u00e8gle Yara et de la modifier de la sorte [5]<\/p>[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2020\/04\/6-turla.png" align="center" _builder_version="4.4.3"][\/et_pb_image][et_pb_text _builder_version="4.4.3"]

N\u00e9anmoins, cette r\u00e8gle ne permet pas de respecter les bonnes pratiques de performance car trop d\u2019al\u00e9atoire.<\/p>[\/et_pb_text][et_pb_text _builder_version=\u00a0\u00bb4.4.3″ header_2_text_color=\u00a0\u00bb#071793″]

<\/h2>\n

<\/h2>\n

R\u00e9f\u00e9rences<\/h2>[\/et_pb_text][et_pb_text _builder_version=\u00a0\u00bb4.4.3″]

[1] https:\/\/www.symantec.com\/blogs\/threat-intelligence\/waterbug-espionage-governments<\/a><\/p>\n

[2] https:\/\/threatvector.cylance.com\/en_us\/home\/malicious-payloads-hiding-beneath-the-wav.html<\/a><\/p>\n

[3] <\/span>https:\/\/github.com\/corkami\/pics\/blob\/master\/binary\/wav101\/wav101.pdf<\/a><\/p>\n

[4] https:\/\/github.com\/Intrinsec\/CERT\/tree\/master\/Scripts\/turla_wav_extractor<\/a><\/p>\n

[5]\u00a0https:\/\/github.com\/Intrinsec\/CERT\/blob\/master\/Signatures\/yara\/turla_wav.yara<\/a><\/span><\/p>\n

<\/span><\/p>\n

 <\/p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=\u00a0\u00bb1″ _builder_version=\u00a0\u00bb4.4.2″ use_background_color_gradient=\u00a0\u00bbon\u00a0\u00bb background_color_gradient_start=\u00a0\u00bb#071793″ background_color_gradient_end=\u00a0\u00bbrgba(7,23,147,0.59)\u00a0\u00bb custom_margin=\u00a0\u00bb|103px||87px||\u00a0\u00bb][et_pb_row column_structure=\u00a0\u00bb3_4,1_4″ _builder_version=\u00a0\u00bb3.25″][et_pb_column type=\u00a0\u00bb3_4″ _builder_version=\u00a0\u00bb3.25″ custom_padding=\u00a0\u00bb|||\u00a0\u00bb custom_padding__hover=\u00a0\u00bb|||\u00a0\u00bb][et_pb_text _builder_version=\u00a0\u00bb4.4.2″ text_font=\u00a0\u00bbNunito Sans||||||||\u00a0\u00bb text_text_color=\u00a0\u00bb#ffffff\u00a0\u00bb text_font_size=\u00a0\u00bb24px\u00a0\u00bb text_line_height=\u00a0\u00bb1.4em\u00a0\u00bb header_font=\u00a0\u00bb||||||||\u00a0\u00bb width=\u00a0\u00bb101.2%\u00a0\u00bb custom_margin=\u00a0\u00bb-11px|-42px||31px||\u00a0\u00bb custom_padding=\u00a0\u00bb13px||\u00a0\u00bb]

Want to learn more about our Computer Emergency Response Team (CERT) ?\u00a0<\/strong><\/p>[\/et_pb_text][\/et_pb_column][et_pb_column type=\u00a0\u00bb1_4″ _builder_version=\u00a0\u00bb3.25″ custom_padding=\u00a0\u00bb|||\u00a0\u00bb custom_padding__hover=\u00a0\u00bb|||\u00a0\u00bb][et_pb_button button_url=\u00a0\u00bbhttps:\/\/www.intrinsec.com\/cert-intrinsec\u00a0\u00bb url_new_window=\u00a0\u00bbon\u00a0\u00bb button_text=\u00a0\u00bbDiscover\u00a0\u00bb button_alignment=\u00a0\u00bbleft\u00a0\u00bb _builder_version=\u00a0\u00bb4.4.2″ custom_button=\u00a0\u00bbon\u00a0\u00bb button_text_size=\u00a0\u00bb18px\u00a0\u00bb button_text_color=\u00a0\u00bb#e02b20″ button_bg_color=\u00a0\u00bb#ffffff\u00a0\u00bb button_border_color=\u00a0\u00bb#ffffff\u00a0\u00bb button_font=\u00a0\u00bbNunito Sans|700|||||||\u00a0\u00bb button_icon=\u00a0\u00bb%%86%%\u00a0\u00bb button_icon_color=\u00a0\u00bb#ffffff\u00a0\u00bb button_icon_placement=\u00a0\u00bbleft\u00a0\u00bb custom_margin=\u00a0\u00bb14px|-30px|7px|-6px||\u00a0\u00bb][\/et_pb_button][\/et_pb_column][\/et_pb_row][\/et_pb_section]\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":33,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-220764","post","type-post","status-publish","format-standard","hentry","category-cert"],"yoast_head":"\nWAV : dissimulation de charge malveillante - INTRINSEC<\/title>\n<meta name=\"description\" content=\"Lors d'une r\u00e9ponse \u00e0 incident, nous avons observ\u00e9 des fichiers WAV, initialement destin\u00e9s \u00e0 contenir des donn\u00e9es audio, \u00eatre utilis\u00e9s afin d\u2019ex\u00e9cuter des malwares.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/malware-wav\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?\" \/>\n<meta property=\"og:description\" content=\"Lors d'une r\u00e9ponse \u00e0 incident, nous avons observ\u00e9 des fichiers WAV, initialement destin\u00e9s \u00e0 contenir des donn\u00e9es audio, \u00eatre utilis\u00e9s afin d\u2019ex\u00e9cuter des malwares.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/malware-wav\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-22T07:35:45+00:00\" \/>\n<meta name=\"author\" content=\"Tiago Jesus Da Conceiao\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tiago Jesus Da Conceiao\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/\"},\"author\":{\"name\":\"Tiago Jesus Da Conceiao\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/7250e455cd7fdfba15770f4d3fd54962\"},\"headline\":\"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?\",\"datePublished\":\"2020-04-22T07:35:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/\"},\"wordCount\":908,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"articleSection\":[\"CERT\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/\",\"name\":\"WAV : dissimulation de charge malveillante - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"datePublished\":\"2020-04-22T07:35:45+00:00\",\"description\":\"Lors d'une r\u00e9ponse \u00e0 incident, nous avons observ\u00e9 des fichiers WAV, initialement destin\u00e9s \u00e0 contenir des donn\u00e9es audio, \u00eatre utilis\u00e9s afin d\u2019ex\u00e9cuter des malwares.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/malware-wav\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/7250e455cd7fdfba15770f4d3fd54962\",\"name\":\"Tiago Jesus Da Conceiao\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Tiago Jesus Da Conceiao\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/tiago-jesus-da-conceiao\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"WAV: Malicious payload concealment - INTRINSEC","description":"During an incident response, we observed WAV files, originally intended to contain audio data, being used to run malware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/malware-wav\/","og_locale":"en_US","og_type":"article","og_title":"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?","og_description":"Lors d'une r\u00e9ponse \u00e0 incident, nous avons observ\u00e9 des fichiers WAV, initialement destin\u00e9s \u00e0 contenir des donn\u00e9es audio, \u00eatre utilis\u00e9s afin d\u2019ex\u00e9cuter des malwares.","og_url":"https:\/\/www.intrinsec.com\/en\/malware-wav\/","og_site_name":"INTRINSEC","article_published_time":"2020-04-22T07:35:45+00:00","author":"Tiago Jesus Da Conceiao","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Tiago Jesus Da Conceiao","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/"},"author":{"name":"Tiago Jesus Da Conceiao","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/7250e455cd7fdfba15770f4d3fd54962"},"headline":"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?","datePublished":"2020-04-22T07:35:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/"},"wordCount":908,"commentCount":0,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"articleSection":["CERT"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intrinsec.com\/en\/malware-wav\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/","url":"https:\/\/www.intrinsec.com\/en\/malware-wav\/","name":"WAV: Malicious payload concealment - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"datePublished":"2020-04-22T07:35:45+00:00","description":"During an incident response, we observed WAV files, originally intended to contain audio data, being used to run malware.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/en\/malware-wav\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/en\/malware-wav\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"R\u00e9ponse \u00e0 incident : Comment un malware peut-il utiliser le format WAV pour d\u00e9ployer une charge malveillante ?"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/7250e455cd7fdfba15770f4d3fd54962","name":"Tiago Jesus Da Conceiao","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Tiago Jesus Da Conceiao"},"url":"https:\/\/www.intrinsec.com\/en\/author\/tiago-jesus-da-conceiao\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/220764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=220764"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/220764\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=220764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=220764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=220764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}