w0rk3r's Blue team Library
CARBANAK Week Part Three: Behind the CARBANAK Backdoor https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html @BlueTeamLibrary
CARBANAK Week Part Four: The CARBANAK Desktop Video Player
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-four-desktop-video-player.html
@BlueTeamLibrary
FireEye
CARBANAK Week Part Four: The CARBANAK Desktop Video Player
We explore the CARBANAK video player in this final CARBANAK Week blog post.
Spotlight: Threat Hunting YARA Rule Example
https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example
@BlueTeamLibrary
https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example
@BlueTeamLibrary
Continuous C2 hunting with Censys, Shodan, Onyphe and TheHive
https://hackmd.io/s/SkUaSrqoE
@BlueTeamLibrary
https://hackmd.io/s/SkUaSrqoE
@BlueTeamLibrary
HackMD
Continuous C2 hunting with Censys, Shodan, Onyphe and TheHive - HackMD
# Continuous C2 hunting with Censys, Shodan, Onyphe and TheHive Censys, Shodan and Onyphe are great
Forwarded from DFIR & Threat Hunting & SOC
Katie will cover how you can use ATT&CK for detection, threat intelligence, assessments, and red teaming, with a focus on actionable takeaways to help your team move toward a threat-informed defense.
https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you-have-where-you-are
https://www.slideshare.net/KatieNickels/putting-mitre-attck-into-action-with-what-you-have-where-you-are
www.slideshare.net
Putting MITRE ATT&CK into Action with What You Have, Where You Are
At Sp4rkcon 2019, Katie Nickels discusses how you can use MITRE ATT&CK regardless of your team's sophistication.
Malicious Payloads vs Deep Visibility: A PowerShell Story
https://www.slideshare.net/DanielBohannon2/malicious-payloads-vs-deep-visibility-a-powershell-story
@BlueTeamLibrary
https://www.slideshare.net/DanielBohannon2/malicious-payloads-vs-deep-visibility-a-powershell-story
@BlueTeamLibrary
Slideshare
Malicious Payloads vs Deep Visibility: A PowerShell Story
This document summarizes a presentation on malicious payloads using PowerShell. It discusses how attackers often use PowerShell due to its native Windows capabilities and offensive tradecraft possibilities. The presentation provides examples of PowerShell…
Finding Registry Malware Persistence with RECmd
https://digital-forensics.sans.org/blog/2019/05/07/malware-persistence-recmd
@BlueTeamLibrary
https://digital-forensics.sans.org/blog/2019/05/07/malware-persistence-recmd
@BlueTeamLibrary
Apt3 Large Dataset - Mordor
https://github.com/Cyb3rWard0g/mordor/blob/master/large_datasets/apt3/README.md
@BlueTeamLibrary
https://github.com/Cyb3rWard0g/mordor/blob/master/large_datasets/apt3/README.md
@BlueTeamLibrary
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Choose Your Own Red Team Adventure
https://medium.com/@malcomvetter/choose-your-own-red-team-adventure-f87d6a3b0b76
@WindowsHackingLibrary
https://medium.com/@malcomvetter/choose-your-own-red-team-adventure-f87d6a3b0b76
@WindowsHackingLibrary
Medium
Choose Your Own Red Team Adventure
The following story is your opportunity to pretend you’re going up against a world-class security program’s defenses. You get to decide…
Enriching ElasticSearch With Threat Data
Part 1 – MISP
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-1-misp
Part 2 – Memcached and Python
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-2-memcached-and-python
Part 3 – Logstash
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-3-logstash
@BlueTeamLibrary
Part 1 – MISP
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-1-misp
Part 2 – Memcached and Python
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-2-memcached-and-python
Part 3 – Logstash
https://www.securitydistractions.com/2019/05/17/enriching-elasticsearch-with-threat-data-part-3-logstash
@BlueTeamLibrary
Banload Yara Rules
.MSI:
https://gist.github.com/teixeira0xfffff/6154225339d199702c8b45dffdbd3433
.lnk:
https://gist.github.com/teixeira0xfffff/27fadb318f9801bf6ae1cc1d9d48655c
@BlueTeamLibrary
.MSI:
https://gist.github.com/teixeira0xfffff/6154225339d199702c8b45dffdbd3433
.lnk:
https://gist.github.com/teixeira0xfffff/27fadb318f9801bf6ae1cc1d9d48655c
@BlueTeamLibrary
Gist
Brazilian .MSI banking trojan
Brazilian .MSI banking trojan. GitHub Gist: instantly share code, notes, and snippets.
Winnti: More than just Windows and Gates
https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
@BlueTeamLibrary
https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
@BlueTeamLibrary
Medium
Winnti: More than just Windows and Gates
The Winnti malware family was first reported in 2013 by Kaspersky Lab. Since then, threat actors leveraging Winnti malware have victimized…
Detecting LDAP based Kerberoasting with Azure ATP
https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Detecting-LDAP-based-Kerberoasting-with-Azure-ATP/ba-p/462448
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Detecting-LDAP-based-Kerberoasting-with-Azure-ATP/ba-p/462448
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
Detecting LDAP based Kerberoasting with Azure ATP
In a typical Kerberoasting attack, attackers exploit LDAP vulnerabilities to generate a list of all user accounts with a Kerberos Service Principal Name (SPN) available. Once successful at listing these accounts, attackers grant Kerberos Service Tickets for…
Mapping Iran’s Rana Institute to MITRE Pre-ATT&CK™ and ATT&CK™
https://www.digitalshadows.com/blog-and-research/mapping-irans-rana-institute-to-mitre-pre-attck-and-attck
@BlueTeamLibrary
https://www.digitalshadows.com/blog-and-research/mapping-irans-rana-institute-to-mitre-pre-attck-and-attck
@BlueTeamLibrary
Digital Shadows
Mapping Iran's Rana Institute to MITRE Pre-ATT&CK and ATT&CK | Digital Shadows
We decided to break down the ClearSky report using the Mitre ATT&CK and PRE-ATT&CK framework to put these operations into context with lessons learned for defenders. Where possible, I’ve outlined some mitigation advice at each of these stages.
Security for Elasticsearch is now free
https://www.elastic.co/blog/security-for-elasticsearch-is-now-free
@BlueTeamLibrary
https://www.elastic.co/blog/security-for-elasticsearch-is-now-free
@BlueTeamLibrary
Elastic Blog
Security for Elasticsearch is now free
We are thrilled to announce that the core security features of the Elastic Stack -- like TLS encryption, RBAC, and both file and native authentication -- are now free....
Automation for everyone with TheHive and WALKOFF
https://medium.com/@Frikkylikeme/automation-for-everyone-with-thehive-and-walkoff-6691f1343238
@BlueTeamLibrary
https://medium.com/@Frikkylikeme/automation-for-everyone-with-thehive-and-walkoff-6691f1343238
@BlueTeamLibrary
Medium
Automation for everyone with TheHive and WALKOFF
Most incident responders don’t know how to code. This blogpost shows how to use open-source tools to automate with TheHive and WALKOFF
Abusing Code Signing for Profit
https://medium.com/@chroniclesec/abusing-code-signing-for-profit-ef80a37b50f4
@BlueTeamLibrary
https://medium.com/@chroniclesec/abusing-code-signing-for-profit-ef80a37b50f4
@BlueTeamLibrary
Medium
Abusing Code Signing for Profit
Signing a Windows executable file was originally conceived as a mechanism to guarantee the authenticity and integrity of a file published…
Uncovering New Activity By APT10
https://blog.ensilo.com/uncovering-new-activity-by-apt10
@BlueTeamLibrary
https://blog.ensilo.com/uncovering-new-activity-by-apt10
@BlueTeamLibrary
Fortinet Blog
Fortinet Blog - Broad, Integrated, Automated Cybersecurity
Explore the latest cybersecurity trends and innovations, leading edge threat intelligence from FortiGuard Labs, Fortinet executive insights, and customer perspectives.
Learning to Rank Strings Output for Speedier Malware Analysis
https://www.fireeye.com/blog/threat-research/2019/05/learning-to-rank-strings-output-for-speedier-malware-analysis.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/05/learning-to-rank-strings-output-for-speedier-malware-analysis.html
@BlueTeamLibrary
Trellix
Research | Trellix Stories
Trellix Research, get the latest cybersecurity trends, best practices, security vulnerabilities, and more from industry leaders.
Threat Hunting with Jupyter Notebooks— Part 1: Your First Notebook 📓
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-1-your-first-notebook-9a99a781fde7
@BlueTeamLibrary
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-1-your-first-notebook-9a99a781fde7
@BlueTeamLibrary
Medium
Threat Hunting with Jupyter Notebooks— Part 1: Your First Notebook 📓
When it comes to threat detection, how many times have you heard someone say “It is all in my head, just ask me if you have any…