Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Invoke-AtomicTest - Automating MITRE ATT&CK with Atomic Red Team
http://subt0x11.blogspot.com/2018/08/invoke-atomictest-automating-mitre-att.html
@WindowsHackingLibrary
http://subt0x11.blogspot.com/2018/08/invoke-atomictest-automating-mitre-att.html
@WindowsHackingLibrary
Tightly Defining Cyber Threat Hunting
https://www.activecountermeasures.com/tightly-defining-cyber-threat-hunting
@BlueTeamLibrary
https://www.activecountermeasures.com/tightly-defining-cyber-threat-hunting
@BlueTeamLibrary
Active Countermeasures
Tightly Defining Cyber Threat Hunting - Active Countermeasures
I briefly considered titling this blog entry “Why Threat Hunting Scope Creep Will Swallow Your Soul”, because I’ve spoken with quite a few folks that are completely overwhelmed with tasks the get labeled as “threat hunting”. Many feel like there are not enough…
Protecting Software Against Exploitation with DARPA’s CFAR
https://blog.trailofbits.com/2018/09/10/protecting-software-against-exploitation-with-darpas-cfar
@BlueTeamLibrary
https://blog.trailofbits.com/2018/09/10/protecting-software-against-exploitation-with-darpas-cfar
@BlueTeamLibrary
The Trail of Bits Blog
Protecting Software Against Exploitation with DARPA’s CFAR
Today, we’re going to talk about a hard problem that we are working on as part of DARPA’s Cyber Fault-Tolerant Attack Recovery (CFAR) program: automatically protecting software from 0-day exploits, memory corruption, and many currently undiscovered bugs.…
Antivirus Event Analysis Cheat Sheet v1.4
https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4
@BlueTeamLibrary
https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4
@BlueTeamLibrary
Office VBA + AMSI: Parting the veil on Malicious Macros
https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros
@BlueTeamLibrary
https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros
@BlueTeamLibrary
Microsoft Security Blog
Office VBA + AMSI: Parting the veil on malicious macros - Microsoft Security Blog
As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check…
Threat modeling for drivers
https://docs.microsoft.com/en-us/windows-hardware/drivers/driversecurity/threat-modeling-for-drivers
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows-hardware/drivers/driversecurity/threat-modeling-for-drivers
@BlueTeamLibrary
Docs
Threat Modeling for Drivers - Windows drivers
Driver writers and architects should make threat modeling an integral part of the design process for any driver. This article provides guidelines for creating threat models for drivers for the Microsoft Windows family of operating systems.
Kernel Mode Threats & Practical Defenses: Part 1
https://www.endgame.com/blog/technical-blog/kernel-mode-threats-practical-defenses-part-1
@BlueTeamLibrary
https://www.endgame.com/blog/technical-blog/kernel-mode-threats-practical-defenses-part-1
@BlueTeamLibrary
Elastic Blog
Introducing Elastic Endpoint Security
Reducing the Active Directory Attack Surface
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/reducing-the-active-directory-attack-surface
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/reducing-the-active-directory-attack-surface
@BlueTeamLibrary
Docs
Reducing the Active Directory Attack Surface
Learn more about: Reducing the Active Directory Attack Surface
Didier Stevens Tools Flashcards
https://quizlet.com/316786300/didier-stevens-tools-flash-cards
@BlueTeamLibrary
https://quizlet.com/316786300/didier-stevens-tools-flash-cards
@BlueTeamLibrary
Quizlet
Didier Stevens Tools Flashcards | Quizlet
Didier Stevens Tools study guide by amskatoff includes 125 questions covering vocabulary, terms and more. Quizlet flashcards, activities and games help you improve your grades.
w0rk3r's Blue team Library
Kernel Mode Threats & Practical Defenses: Part 1 https://www.endgame.com/blog/technical-blog/kernel-mode-threats-practical-defenses-part-1 @BlueTeamLibrary
Kernel Mode Threats & Practical Defenses: Part 2
https://www.endgame.com/blog/technical-blog/kernel-mode-threats-practical-defenses-part-2
@BlueTeamLibrary
https://www.endgame.com/blog/technical-blog/kernel-mode-threats-practical-defenses-part-2
@BlueTeamLibrary
Elastic Blog
Introducing Elastic Endpoint Security
Visualise Sysmon Logs and Detect Suspicious Device Behaviour -SysmonSearch-
https://blog.jpcert.or.jp/2018/09/visualise-sysmon-logs-and-detect-suspicious-device-behaviour--sysmonsearch.html
https://github.com/JPCERTCC/SysmonSearch
@BlueTeamLibrary
https://blog.jpcert.or.jp/2018/09/visualise-sysmon-logs-and-detect-suspicious-device-behaviour--sysmonsearch.html
https://github.com/JPCERTCC/SysmonSearch
@BlueTeamLibrary
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
PowerShell: Documenting your environment by running systeminfo on all Domain-Computers
https://sid-500.com/2017/08/09/powershell-documenting-your-environment-by-running-systeminfo-on-all-domain-computers
@WindowsHackingLibrary
https://sid-500.com/2017/08/09/powershell-documenting-your-environment-by-running-systeminfo-on-all-domain-computers
@WindowsHackingLibrary
SID-500.COM
PowerShell: Documenting your environment by running systeminfo on all Domain-Computers
Systeminfo gives you a perfect overview of your system. But what about the other systems in your domain? Sure, you can use 3rd Party Tools or SCCM. But the number of those who can´t use enterprise …
Should Threat Hunting Be a Standards Requirement?
https://www.activecountermeasures.com/should-threat-hunting-be-a-standards-requirement
@BlueTeamLibrary
https://www.activecountermeasures.com/should-threat-hunting-be-a-standards-requirement
@BlueTeamLibrary
Active Countermeasures
Should Threat Hunting Be a Standards Requirement? - Active Countermeasures
As part of some recent research, I was looking at which security standards and attestations require regular threat hunts. Imagine my surprise when […]
Security baseline (DRAFT) for Windows 10 v1809 and Windows Server 2019
https://blogs.technet.microsoft.com/secguide/2018/10/01/security-baseline-draft-for-windows-10-v1809-and-windows-server-2019
@BlueTeamLibrary
https://blogs.technet.microsoft.com/secguide/2018/10/01/security-baseline-draft-for-windows-10-v1809-and-windows-server-2019
@BlueTeamLibrary
Defrag Tools #198 - AaronLocker
https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-198-AaronLocker
@BlueTeamLibrary
https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-198-AaronLocker
@BlueTeamLibrary
Channel 9
Defrag Tools #198 - AaronLocker
In this episode of Defrag Tools, Aaron Margosis joins us to discuss AaronLocker - a set of scripts that help you configure AppLocker. AppLocker restricts application execution, auditing or protecting
Introduction to Windows Forensics — 13cubed
https://www.youtube.com/watch?v=VYROU-ZwZX8
@BlueTeamLibrary
https://www.youtube.com/watch?v=VYROU-ZwZX8
@BlueTeamLibrary
YouTube
Introduction to Windows Forensics
🎉 Official Training Courses from 13Cubed! 🎉
If you are looking for an online, on-demand, comprehensive, and affordable Windows forensics course, check out Investigating Windows Endpoints at training.13cubed.com.
An introduction to basic Windows forensics…
If you are looking for an online, on-demand, comprehensive, and affordable Windows forensics course, check out Investigating Windows Endpoints at training.13cubed.com.
An introduction to basic Windows forensics…
Forwarded from Security papers (Jonhnathan Jonhnathan Jonhnathan)
Disrupting the Empire: Identifying PowerShell Empire Command and Control Activity
https://www.sans.org/reading-room/whitepapers/incident/disrupting-empire-identifying-powershell-empire-command-control-activity-38315
@CyberWhitePapers
https://www.sans.org/reading-room/whitepapers/incident/disrupting-empire-identifying-powershell-empire-command-control-activity-38315
@CyberWhitePapers