Attack & Detection:
Hunting In-Memory Adversaries
with Rekall and WinPmem
https://holisticinfosec.org/toolsmith/pdf/may2015.pdf
Hunting In-Memory Adversaries
with Rekall and WinPmem
https://holisticinfosec.org/toolsmith/pdf/may2015.pdf
Active directory: How to change a weak point into a leverage for security monitoring
https://www.first.org/resources/papers/conf2017/Active-Directory-How-To-Change-a-Weak-Point-Into-a-Leverage-for-Security-Monitoring.pdf
https://www.first.org/resources/papers/conf2017/Active-Directory-How-To-Change-a-Weak-Point-Into-a-Leverage-for-Security-Monitoring.pdf
Endpoint Isolation with the windows firewall
https://medium.com/@cryps1s/endpoint-isolation-with-the-windows-firewall-462a795f4cfb
https://medium.com/@cryps1s/endpoint-isolation-with-the-windows-firewall-462a795f4cfb
Medium
Endpoint Isolation with the Windows Firewall
Over the last few weeks, I’ve had conversations with several individuals around mitigating lateral movement in a Windows environment. In…
Trimarc Research: Detecting Password Spraying with Security Event Auditing
https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
Trimarc Content Hub
Trimarc Research: Detecting Password Spraying with Security Event Auditing
A common method attackers leverage as well as many penetration testers and Red Teamers is called "password spraying". Password spraying is interesting because it’s automated password guessing. This automated password guessing against all users typically avoids…
How to Mitigate Mimikatz WDigest Cleartext Credential Theft
https://p16.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft
https://p16.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft
Hunting For In-Memory .NET Attacks
https://www.endgame.com/blog/technical-blog/hunting-memory-net-attacks
https://www.endgame.com/blog/technical-blog/hunting-memory-net-attacks
www.elastic.co
Hunting For In-Memory .NET Attacks — Elastic Security Labs
As a follow up to my DerbyCon presentation, this post will investigate an emerging trend of adversaries using .NET-based in-memory techniques to evade detection
Forwarded from DFIR & Threat Hunting & SOC
APT Groups, Operations and Malware Search Engine
https://cse.google.com/cse/publicurl?cx=003248445720253387346:turlh5vi4xc
https://cse.google.com/cse/publicurl?cx=003248445720253387346:turlh5vi4xc
The Art of Detecting Kerberoast Attacks
https://www.trustedsec.com/2018/05/art_of_kerberoast/
@Blueteamlibrary
https://www.trustedsec.com/2018/05/art_of_kerberoast/
@Blueteamlibrary
TrustedSec
Cybersecurity Education from the Experts | TrustedSec Blog Posts
Learn more about how to safeguard your company through our educational blog posts on everything from updated tech to the newest scams infiltrating organizations today.