Diving into the Security Analyst’s Mind
https://posts.specterops.io/diving-into-the-security-analysts-mind-b1708668e8d4
@BlueTeamLibrary
https://posts.specterops.io/diving-into-the-security-analysts-mind-b1708668e8d4
@BlueTeamLibrary
Medium
Diving into the Security Analyst’s Mind
At SpecterOps we provide consulting services, but we also get the opportunity to teach training. Our training courses are offered in two…
w0rk3r's Blue team Library
Threat Hunting with Jupyter Notebooks— Part 1: Your First Notebook 📓 https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-1-your-first-notebook-9a99a781fde7 @BlueTeamLibrary
Threat Hunting with Jupyter Notebooks — Part 2: Basic Data Analysis with Pandas 📊
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-2-basic-data-analysis-with-pandas-80d1400ab6ee
@BlueTeamLibrary
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-2-basic-data-analysis-with-pandas-80d1400ab6ee
@BlueTeamLibrary
Medium
Threat Hunting with Jupyter Notebooks — Part 2: Basic Data Analysis with Pandas 📊
In the previous post, I introduced the basic concepts of Jupyter Notebooks and showed you how to deploy a basic notebook environment. At…
w0rk3r's Blue team Library
Threat Hunting with Jupyter Notebooks — Part 2: Basic Data Analysis with Pandas 📊 https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-2-basic-data-analysis-with-pandas-80d1400ab6ee @BlueTeamLibrary
Threat Hunting with Jupyter Notebooks — Part 3: Querying Elasticsearch via Apache Spark ✨
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-3-querying-elasticsearch-via-apache-spark-670054cd9d47
@BlueTeamLibrary
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-3-querying-elasticsearch-via-apache-spark-670054cd9d47
@BlueTeamLibrary
Medium
Threat Hunting with Jupyter Notebooks — Part 3: Querying Elasticsearch via Apache Spark ✨
In the previous post, I introduced the concept of using DataFrames to represent and analyze security event logs in a tabular format, and…
w0rk3r's Blue team Library
Threat Hunting with Jupyter Notebooks — Part 3: Querying Elasticsearch via Apache Spark ✨ https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-3-querying-elasticsearch-via-apache-spark-670054cd9d47 @BlueTeamLibrary
Threat Hunting with Jupyter Notebooks — Part 4: SQL JOIN via Apache SparkSQL 🔗
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-4-sql-join-via-apache-sparksql-6630928c931e
@BlueTeamLibrary
https://posts.specterops.io/threat-hunting-with-jupyter-notebooks-part-4-sql-join-via-apache-sparksql-6630928c931e
@BlueTeamLibrary
Medium
Threat Hunting with Jupyter Notebooks — Part 4: SQL JOIN via Apache SparkSQL 🔗
In the previous post, we covered the basics of Apache Spark and a few basic PySpark SQL classes to read and load data from Elasticsearch…
A journey on APT34 (OilRig) PoisonFrog C2 Server
Analyzing a possible vulnerability that could allow the compromise/takeover of the c2 server
https://0x09al.github.io/security/apt34/malware/poisonfrog/vulnerability/2019/05/31/apt-34-poisonfrog-vulnerability.html
@BlueTeamLibrary
Analyzing a possible vulnerability that could allow the compromise/takeover of the c2 server
https://0x09al.github.io/security/apt34/malware/poisonfrog/vulnerability/2019/05/31/apt-34-poisonfrog-vulnerability.html
@BlueTeamLibrary
0x09AL Security blog
A journey on APT34 PoisonFrog C2 Server
In the recent years APTs have been the center of infosec. Mainly because of the public coverage by the media, glorifying by security companies and many more things. In this blog post I will analyse the C2 Server used by Oilrig/APT34 and how bad coding practice…
Using osquery for remote forensics
https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics
@BlueTeamLibrary
https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics
@BlueTeamLibrary
The Trail of Bits Blog
Using osquery for remote forensics
System administrators use osquery for endpoint telemetry and daily monitoring. Security threat hunters use it to find indicators of compromise on their systems. Now another audience is discovering osquery: forensic analysts. While osquery core is great for…
Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER
https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics
@BlueTeamLibrary
https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics
@BlueTeamLibrary
crowdstrike.com
Timelining GRIM SPIDER's Big Game Hunting Tactics | CrowdStrike
Learn how CrowdStrike Services uses the ATT&CK framework to map a timeline of GRIM SPIDER's big game hunting tactics, from initial access to ransomware deployment.
An APT Blueprint: Gaining New Visibility into Financial Threats
https://labs.bitdefender.com/2019/06/an-apt-blueprint-gaining-new-visibility-into-financial-threats
@BlueTeamLibrary
https://labs.bitdefender.com/2019/06/an-apt-blueprint-gaining-new-visibility-into-financial-threats
@BlueTeamLibrary
Bitdefender Labs
An APT Blueprint: Gaining New Visibility into Financial Threats
This new Bitdefender forensic investigation reveals a complete attack timeline
and behavior of a notorious financial cybercriminal group, known as Carbanak.
and behavior of a notorious financial cybercriminal group, known as Carbanak.
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Bloodhound walkthrough. A Tool for Many Tradecrafts
https://www.pentestpartners.com/security-blog/bloodhound-walkthrough-a-tool-for-many-tradecrafts
@WindowsHackingLibrary
https://www.pentestpartners.com/security-blog/bloodhound-walkthrough-a-tool-for-many-tradecrafts
@WindowsHackingLibrary
Pen Test Partners
Bloodhound walkthrough. A Tool for Many Tradecrafts | Pen Test Partners
A walkthrough on how to set up and use BloodHound BloodHound (https://github.com/BloodHoundAD/BloodHound) is an application used to visualize active directory environments. The front-end is built on electron and the back-end is a Neo4j database, the data…
Security Advisory: Critical Vulnerabilities in NTLM Allow Remote Code Execution and Cloud Resources Compromise
https://blog.preempt.com/security-advisory-critical-vulnerabilities-in-ntlm
@BlueTeamLibrary
https://blog.preempt.com/security-advisory-critical-vulnerabilities-in-ntlm
@BlueTeamLibrary
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Visualizing BloodHound Data with PowerBI — Part 1
https://posts.specterops.io/visualizing-bloodhound-data-with-powerbi-part-1-ba8ea4908422
@WindowsHackingLibrary
https://posts.specterops.io/visualizing-bloodhound-data-with-powerbi-part-1-ba8ea4908422
@WindowsHackingLibrary
Medium
Visualizing BloodHound Data with PowerBI — Part 1
In this blog post, I’ll show you how you can use BloodHound data, the Cypher query language, and Microsoft’s PowerBI to create…
Visualizing BloodHound Data with PowerBI — Part 2
https://posts.specterops.io/visualizing-bloodhound-data-with-powerbi-part-2-3e1c521fb7ae
@BlueTeamLibrary
https://posts.specterops.io/visualizing-bloodhound-data-with-powerbi-part-2-3e1c521fb7ae
@BlueTeamLibrary
Medium
Visualizing BloodHound Data with PowerBI — Part 2
Intro
msticpy - Python Defender Tools
https://techcommunity.microsoft.com/t5/Azure-Sentinel/msticpy-Python-Defender-Tools/ba-p/648929
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/Azure-Sentinel/msticpy-Python-Defender-Tools/ba-p/648929
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
msticpy - Python Defender Tools | Microsoft Community Hub
msticpy is a package of python tools intended to be used for security investigations and hunting (primarily in Jupyter notebooks). The article gives an...
Threat detection metrics: exploring the true-positive spectrum
https://medium.com/@ateixei/threat-detection-metrics-exploring-the-true-positive-spectrum-ca688dc9f97e
@BlueTeamLibrary
https://medium.com/@ateixei/threat-detection-metrics-exploring-the-true-positive-spectrum-ca688dc9f97e
@BlueTeamLibrary
Medium
Threat detection metrics: exploring the true-positive spectrum
I’ve had the chance to work with many great security teams during my career and in 2012, I had the opportunity to join Verizon's SOC in…
5 Things ICS Operators and Critical Infrastructure Must Do in the Face of Cyber Escalation
https://dragos.com/blog/industry-news/5-things-ics-operators-and-critical-infrastructure-must-do-in-the-face-of-cyber-escalation
@BlueTeamLibrary
https://dragos.com/blog/industry-news/5-things-ics-operators-and-critical-infrastructure-must-do-in-the-face-of-cyber-escalation
@BlueTeamLibrary
Dragos | Industrial (ICS/OT) Cyber Security
5 Things ICS Operators and Critical Infrastructure Must Do in the Face of Cyber Escalation
Dragos strongly recommends all ICS operators take this threat seriously to protect lives, services, business, & critical infrastructure worldwide.
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
CVE-2019-1040 scanner
Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target host(s) and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx.
Note that this does not generate failed login attempts as the login information itself is valid, it is just the NTLM message integrity code that is absent, which is why the authentication is refused without increasing the badpwdcount.
https://github.com/fox-it/cve-2019-1040-scanner
@WindowsHackingLibrary
Checks for CVE-2019-1040 vulnerability over SMB. The script will establish a connection to the target host(s) and send an invalid NTLM authentication. If this is accepted, the host is vulnerable to CVE-2019-1040 and you can execute the MIC Remove attack with ntlmrelayx.
Note that this does not generate failed login attempts as the login information itself is valid, it is just the NTLM message integrity code that is absent, which is why the authentication is refused without increasing the badpwdcount.
https://github.com/fox-it/cve-2019-1040-scanner
@WindowsHackingLibrary
GitHub
GitHub - fox-it/cve-2019-1040-scanner
Contribute to fox-it/cve-2019-1040-scanner development by creating an account on GitHub.
Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
@BlueTeamLibrary
https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
@BlueTeamLibrary
Cybereason
Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers
In 2018, the Cybereason Nocturnus team identified Operation Soft Cell, an advanced, persistent attack targeting global telecommunications providers.