A very deep dive into iOS Exploit chains found in the wild

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html

@FromZer0toHero

Definitive Dossier of Devilish Debug Details – Part One: PDB Paths and Malware

https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html

@BlueTeamLibrary

Hunting for C3

https://labs.mwrinfosecurity.com/blog/hunting-for-c3

@BlueTeamLibrary

"How do I detect technique X in Windows?" - Applied methodology to definitely answer this question
Matt Graeber at Derbycon

https://youtu.be/GVRIUsgrwSQ

@SecTalks

You Can Run, But You Can’t Hide — Detecting Process Reimaging Behavior

https://posts.specterops.io/you-can-run-but-you-cant-hide-detecting-process-reimaging-behavior-e6bb9a10c40b

@BlueTeamLibrary

Shhmon — Silencing Sysmon via Driver Unload

https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650

@WindowsHackingLibrary

Threat Hunting with ETW events and HELK — Part 1: Installing SilkETW

https://medium.com/threat-hunters-forge/threat-hunting-with-etw-events-and-helk-part-1-installing-silketw-6eb74815e4a0

@BlueTeamLibrary

Uncovering The Unknowns
Mapping Windows API’s to Sysmon Events

https://posts.specterops.io/uncovering-the-unknowns-a47c93bb6971

GitHub: https://github.com/jsecurity101/Windows-API-To-Sysmon-Events

@BlueTeamLibrary

Introducing the Funnel of Fidelity

https://posts.specterops.io/introducing-the-funnel-of-fidelity-b1bb59b04036

@BlueTeamLibrary

Unrestricted Release of Offensive Security Tools

Uncontrolled proliferation of Offensive Security Tools is an unnecessary contribution to real threat actor’s computer network operations.

https://medium.com/@QW5kcmV3/misconceptions-unrestricted-release-of-offensive-security-tools-789299c72afe

@BlueTeamLibrary

DNS Tunneling & Other Hunts w/ RockNSM (Zeek [Bro] & ELK)

https://www.perched.io/blog/2019/1/3/dns-tunneling-amp-other-hunts-w-rocknsm-bro-amp-elk

@BlueTeamLibrary

Using ATT&CK for Cyber Threat Intelligence Training

https://attack.mitre.org/resources/training/cti

@BlueTeamLibrary

Trustedsec Sysmon Community Guide

"This guide was created because documentation for this helpful, powerful tool previously didn’t exist. The goal of the Community Guide is to make it the best resource possible for all things Sysmon."

https://github.com/trustedsec/SysmonCommunityGuide/blob/master/README.md

@BlueTeamLibrary

Hunting Malicious Macros

https://blog.pwntario.com/team-posts/antons-posts/hunting-malicious-macros

@WindowsHackingLibrary

Capability Abstraction

https://posts.specterops.io/capability-abstraction-fbeaeeb26384

@BlueTeamLibrary

Restricting SMB-based lateral movement in a Windows environment

https://medium.com/palantir/restricting-smb-based-lateral-movement-in-a-windows-environment-ed033b888721

@BlueTeamLibrary

“ATT&CK with Sub-Techniques” is Now Just ATT&CK

https://medium.com/mitre-attack/attack-with-sub-techniques-is-now-just-attack-8fc20997d8de

@BlueTeamLibrary

Practical security engineering: Stateful detection

https://www.elastic.co/pt/blog/practical-security-engineering-stateful-detection

@BlueTeamLibrary

Mitre Shield:
Shield is an active defense knowledge base MITRE is developing to capture and organize what we are learning about active defense and adversary engagement.

https://shield.mitre.org

@BlueTeamLibrary

Easier data onboarding with Elastic Agent and Ingest Manager

https://www.elastic.co/blog/introducing-elastic-agent-and-ingest-manager

Elastic Security 7.9 adds anti-malware, prebuilt cloud protections, and more

https://www.elastic.co/pt/blog/whats-new-elastic-security-7-9-0-free-endpoint-security

@BlueTeamLibrary