Donot (APT-C-35) Group Is Targeting Pakistani Businessman Working In China
https://ti.360.net/blog/articles/donot-group-is-targeting-pakistani-businessman-working-in-china-en
@BlueTeamLibrary
https://ti.360.net/blog/articles/donot-group-is-targeting-pakistani-businessman-working-in-china-en
@BlueTeamLibrary
Dear Joohn: The Sofacy Group’s Global Campaign
https://researchcenter.paloaltonetworks.com/2018/12/dear-joohn-sofacy-groups-global-campaign
@BlueTeamLibrary
https://researchcenter.paloaltonetworks.com/2018/12/dear-joohn-sofacy-groups-global-campaign
@BlueTeamLibrary
Palo Alto Networks Blog
Dear Joohn: The Sofacy Group’s Global Campaign - Palo Alto Networks Blog
As alluded to in our previous blog regarding the Cannon tool, the Sofacy group (AKA Fancy Bear, APT28, STRONTIUM, Pawn Storm, Sednit) has persistently attacked various government and private organizations around the world from mid-October 2018 through…
OVERRULED: Containing a Potentially Destructive Adversary
https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
@BlueTeamLibrary
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Detecting suspicious child processes using ee-outliers and Elasticsearch
https://blog.nviso.be/2018/12/21/detecting-suspicious-child-processes-using-ee-outliers-and-elasticsearch
@BlueTeamLibrary
https://blog.nviso.be/2018/12/21/detecting-suspicious-child-processes-using-ee-outliers-and-elasticsearch
@BlueTeamLibrary
NVISO Labs
Detecting suspicious child processes using ee-outliers and Elasticsearch
In this post, we will illustrate how ee-outliers can be used to detect suspicious child processes. This can be a very helpful way of spotting malicious endpoint activity during our Threat Hunting a…
Dissecting Cozy Bear’s malicious LNK file
http://cyberforensicator.com/2018/12/23/dissecting-cozy-bears-malicious-lnk-file
@BlueTeamLibrary
http://cyberforensicator.com/2018/12/23/dissecting-cozy-bears-malicious-lnk-file
@BlueTeamLibrary
When Web Servers Go Cryptocurrency Mining
https://www.redcanary.com/blog/threat-detection-cryptocurrency-mining
@BlueTeamLibrary
https://www.redcanary.com/blog/threat-detection-cryptocurrency-mining
@BlueTeamLibrary
Red Canary
Threat Detection #7017: When Web Servers Go Cryptocurrency Mining
A Red Canary analyst walks through the detection of cryptocurrency mining that led to a more insidious discovery: remote code execution. Get tips on how to prevent remote code execution exploits.
Real-Time Sysmon Processing via KSQL and HELK — Part 1: Initial Integration
https://posts.specterops.io/real-time-sysmon-processing-via-ksql-and-helk-part-1-initial-integration-88c2b6eac839
@BlueTeamLibrary
https://posts.specterops.io/real-time-sysmon-processing-via-ksql-and-helk-part-1-initial-integration-88c2b6eac839
@BlueTeamLibrary
Medium
Real-Time Sysmon Processing via KSQL and HELK — Part 1: Initial Integration 🏗
During a recent talk titled “Hunters ATT&CKing with the Right Data” that I gave with my brother Jose Luis Rodriguez @Cyb3rPandaH at…
PowerShell script that can be used to restore a domain controller from an IFM-equivalent backup (i.e. ntds.dit + SYSVOL)
https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md
@BlueTeamLibrary
https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md
@BlueTeamLibrary
GitHub
DSInternals/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md at master · MichaelGrafnetter/DSInternals
Directory Services Internals (DSInternals) PowerShell Module and Framework - MichaelGrafnetter/DSInternals
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
zBang is a risk assessment tool that detects potential privileged account threats
Blog:
https://www.cyberark.com/threat-research-blog/the-big-zbang-theory-a-new-open-source-tool
Tool:
https://github.com/cyberark/zBang
@WindowsHackingLibrary
Blog:
https://www.cyberark.com/threat-research-blog/the-big-zbang-theory-a-new-open-source-tool
Tool:
https://github.com/cyberark/zBang
@WindowsHackingLibrary
Palo Alto Networks
Idira | The Identity Security Platform
Protect your organization with Idira®. Modernize identity governance, automate access reviews, and secure every identity across your hybrid cloud environment.
Two Birds, One STONE PANDA
https://www.crowdstrike.com/blog/two-birds-one-stone-panda
@BlueTeamLibrary
https://www.crowdstrike.com/blog/two-birds-one-stone-panda
@BlueTeamLibrary
CrowdStrike.com
Two Birds, One STONE PANDA
CrowdStrike Falcon® Intelligence has observed threat actors with ties to historic STONE PANDA (APT10) engaged in major Chinese intrusion campaigns and associated with other adversaries such as GOTHIC PANDA,
Forwarded from Zer0 to her0 (Jonhnathan Jonhnathan Jonhnathan)
A deep dive into AWS S3 access controls – taking full control over your assets
https://labs.detectify.com/2017/07/13/a-deep-dive-into-aws-s3-access-controls-taking-full-control-over-your-assets
@FromZer0toHero
https://labs.detectify.com/2017/07/13/a-deep-dive-into-aws-s3-access-controls-taking-full-control-over-your-assets
@FromZer0toHero
Labs Detectify
A deep dive into AWS S3 access controls – taking full control over your assets
Original research from Frans Rosen on vulnerabilities in AWS S3 bucket access controls and how to do set it up properly and monitor security.
Global DNS Hijacking Campaign: DNS Record Manipulation at Scale
https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
@BlueTeamLibrary
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware
@BlueTeamLibrary
https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware
@BlueTeamLibrary
ServHelper and FlawedGrace - New malware introduced by TA505
https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
@BlueTeamLibrary
https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505
@BlueTeamLibrary
Proofpoint
ServHelper & FlawedGrace: New TA505 Malware | Proofpoint US
Proofpoint researchers detail two undocumented pieces of malware being used by TA505. Learn more about these threat actor campaigns.
ATT&CK-ing the Adversary: Episode 1 - A New Hope
https://www.splunk.com/blog/2019/01/15/att-ck-ing-the-adversary-episode-1-a-new-hope.html
@BlueTeamLibrary
https://www.splunk.com/blog/2019/01/15/att-ck-ing-the-adversary-episode-1-a-new-hope.html
@BlueTeamLibrary
Splunk-Blogs
ATT&CK-ing the Adversary: Episode 1 - A New Hope
Dive into what MITRE ATT&CK is, the components that make it up and how the framework can be used for threat hunting
Extracting Forensic Script Content from PowerShell Process Dumps
http://www.leeholmes.com/blog/2019/01/17/extracting-forensic-script-content-from-powershell-process-dumps
@BlueTeamLibrary
http://www.leeholmes.com/blog/2019/01/17/extracting-forensic-script-content-from-powershell-process-dumps
@BlueTeamLibrary
Leeholmes
Extracting Forensic Script Content from PowerShell Process Dumps | Precision Computing
Defeating .AU3 Obfuscated Malware
https://0xffff0800.blogspot.com/2019/01/defeating-au3-obfusticated-malware.html
@BlueTeamLibrary
https://0xffff0800.blogspot.com/2019/01/defeating-au3-obfusticated-malware.html
@BlueTeamLibrary