Introducing the Adversary Resilience Methodology — Part One
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604
@BlueTeamLibrary
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604
@BlueTeamLibrary
Medium
Introducing the Adversary Resilience Methodology — Part One
Note: This is the first in a two-part blog series. This post covers the higher level strategy of the Adversary Resilience Methodology. In…
Introducing the Adversary Resilience Methodology — Part Two
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-two-279a1ed7863d
@BlueTeamLibrary
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-two-279a1ed7863d
@BlueTeamLibrary
Medium
Introducing the Adversary Resilience Methodology — Part Two
Note: This is the second in a two-part blog series. This companion blog post covers the more technical, prescriptive tactics on executing…
Adventures of an RDP Honeypot – Part One: RDP Security
https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-one-rdp-security
@BlueTeamLibrary
https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-one-rdp-security
@BlueTeamLibrary
TrustedSec
Adventures of an RDP Honeypot – Part One: RDP Security - TrustedSec
Over the last several months, TrustedSec has noticed a common thread in the root cause of incidents we’ve investigated: Microsoft Remote Desktop Protocol (RDP) open to the Internet. RDP on the Internet is a very bad idea. Attackers are constantly searching…
RemotePSpy: Remote PowerShell Visibility for Older Versions
https://countercept.com/blog/remotepspy-remote-powershell-visibility-for-older-versions
@BlueTeamLibrary
https://countercept.com/blog/remotepspy-remote-powershell-visibility-for-older-versions
@BlueTeamLibrary
APT39: An Iranian Cyber Espionage Group Focused on Personal Information
https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
@BlueTeamLibrary
Mandiant
APT39 | Iranian Threat Group Focused on Personal Information
APT39 is an Iranian cyber espionage group responsible for the widespread theft of personal information, setting it apart from other Iranian threat groups.
Windows Privilege Abuse: Auditing, Detection, and Defense
https://medium.com/palantir/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
@BlueTeamLibrary
https://medium.com/palantir/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
@BlueTeamLibrary
Medium
Windows Privilege Abuse: Auditing, Detection, and Defense
Privileges are an important native security control in Windows. As the name suggests, privileges grant rights for accounts to perform…
Excel 4.0 Macro Utilized by TA505 to Target Financial Institutions Recently
https://ti.360.net/blog/articles/excel-4.0-macro-utilized-by-ta505-to-target-financial-institutions-recently-en
@BlueTeamLibrary
https://ti.360.net/blog/articles/excel-4.0-macro-utilized-by-ta505-to-target-financial-institutions-recently-en
@BlueTeamLibrary
Analyzing a new stealer written in Golang
https://blog.malwarebytes.com/threat-analysis/2019/01/analyzing-new-stealer-written-golang
@BlueTeamLibrary
https://blog.malwarebytes.com/threat-analysis/2019/01/analyzing-new-stealer-written-golang
@BlueTeamLibrary
Malwarebytes
Analyzing a new stealer written in Golang
Golang (Go) is a relatively new programming language, and it is not common to find malware written in it. However, new...
Mac Malware Steals Cryptocurrency Exchanges’ Cookies
https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies
@BlueTeamLibrary
https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies
@BlueTeamLibrary
Unit 42
Mac Malware Steals Cryptocurrency Exchanges’ Cookies
Palo Alto Networks’ Unit 42 recently discovered malware that we believe has been developed from OSX.DarthMiner, a malware known to target the Mac platform.This malware is capable of stealing browser cookies associated with mainstream cryptocurrency exchanges…
w0rk3r's Blue team Library
Adventures of an RDP Honeypot – Part One: RDP Security https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-one-rdp-security @BlueTeamLibrary
Adventures of an RDP Honeypot – Part Two: Know You Enemy
https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-two-know-you-enemy
@BlueTeamLibrary
https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-two-know-you-enemy
@BlueTeamLibrary
TrustedSec
Cybersecurity Education from the Experts | TrustedSec Blog Posts
Learn more about how to safeguard your company through our educational blog posts on everything from updated tech to the newest scams infiltrating organizations today.
w0rk3r's Blue team Library
Adventures of an RDP Honeypot – Part Two: Know You Enemy https://www.trustedsec.com/2019/01/adventures-of-an-rdp-honeypot-part-two-know-you-enemy @BlueTeamLibrary
Adventures of an RDP Honeypot – Part Three: Creation of an RDP Honeypot
https://www.trustedsec.com/2019/02/adventures-of-an-rdp-honeypot-part-three-creation-of-an-rdp-honeypot
@BlueTeamLibrary
https://www.trustedsec.com/2019/02/adventures-of-an-rdp-honeypot-part-three-creation-of-an-rdp-honeypot
@BlueTeamLibrary
TrustedSec
Cybersecurity Education from the Experts | TrustedSec Blog Posts
Learn more about how to safeguard your company through our educational blog posts on everything from updated tech to the newest scams infiltrating organizations today.
RDP Man-in-the-Middle – Smile! You’re on Camera
https://gosecure.net/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera
@BlueTeamLibrary
https://gosecure.net/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera
@BlueTeamLibrary
GoSecure
RDP Man-in-the-Middle - Smile! You're on Camera
As part of our four-month internship at GoSecure, we chose to work on creating a Remote Desktop Protocol (RDP) honeypot. To achieve this, we used a Linux server with an RDP man-in-the-middle (MITM) program that redirects traffic to a real Windows Server.
Tracing an offshore bank and a dark web service using the blockchain — an OSINT investigation
https://medium.com/coinmonks/tracing-an-offshore-bank-and-a-dark-web-service-using-the-blockchain-an-osint-investigation-a1000251c3ec
@BlueTeamLibrary
https://medium.com/coinmonks/tracing-an-offshore-bank-and-a-dark-web-service-using-the-blockchain-an-osint-investigation-a1000251c3ec
@BlueTeamLibrary
Medium
Tracing an offshore bank and a dark web service using the blockchain — an OSINT investigation
A how to guide on analysing dark web sites using an onion crawler and analyse their blockchain relationship of bitcoin transactions
Threat Actor “Magecart”: Coming to an eCommerce Store Near You
https://www.crowdstrike.com/blog/threat-actor-magecart-coming-to-an-ecommerce-store-near-you
@BlueTeamLibrary
https://www.crowdstrike.com/blog/threat-actor-magecart-coming-to-an-ecommerce-store-near-you
@BlueTeamLibrary
crowdstrike.com
Threat Actor “Magecart”: Coming to an eCommerce Store Near You
Learn about the tactics, techniques and procedures (TTPs) used by Magecart threat actors to target eCommerce platforms and skim credit card information from online shoppers.
Investigating WMI Attacks
https://digital-forensics.sans.org/blog/2019/02/09/investigating-wmi-attacks
@BlueTeamLibrary
https://digital-forensics.sans.org/blog/2019/02/09/investigating-wmi-attacks
@BlueTeamLibrary
digital-forensics.sans.org
SANS Digital Forensics and Incident Response Blog | Investigating WMI Attacks | SANS Institute
SANS Digital Forensics and Incident Response Blog blog pertaining to Investigating WMI Attacks
Mitigating Exchange Permission Paths to Domain Admins in Active Directory
https://www.trimarcsecurity.com/single-post/2019/02/12/Mitigating-Exchange-Permission-Paths-to-Domain-Admins-in-Active-Directory
@BlueTeamLibrary
https://www.trimarcsecurity.com/single-post/2019/02/12/Mitigating-Exchange-Permission-Paths-to-Domain-Admins-in-Active-Directory
@BlueTeamLibrary
Trimarc Content Hub
Mitigating Exchange Permission Paths to Domain Admins in Active Directory
A blog post was published by Dirk-jan Mollema titled "Abusing Exchange: One API call away from Domain Admin " (https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/) which highlighted several issues with Exchange permissions and a chained…
Guidance to mitigate unconstrained delegation vulnerabilities
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190006
@BlueTeamLibrary
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190006
@BlueTeamLibrary
Automatically generated knowledge base of analytics designed to cover threats based on MITRE's ATT&CK
https://github.com/krakow2600/atomic-threat-coverage
@BlueTeamLibrary
https://github.com/krakow2600/atomic-threat-coverage
@BlueTeamLibrary
GitHub
GitHub - krakow2600/atomic-threat-coverage: The project was moved here https://github.com/atomic-threat-coverage/atomic-threat…
The project was moved here https://github.com/atomic-threat-coverage/atomic-threat-coverage - krakow2600/atomic-threat-coverage
State of the Hack S2E01: #NoEasyBreach REVISITED
https://www.fireeye.com/blog/products-and-services/2019/02/state-of-the-hack-no-easy-breach-revisited.html
@BlueTeamLibrary
https://www.fireeye.com/blog/products-and-services/2019/02/state-of-the-hack-no-easy-breach-revisited.html
@BlueTeamLibrary
FireEye
State of the Hack S2E01: #NoEasyBreach REVISITED
Christopher Glyer and Nick Carr are back with an all new season of State of the Hack.
APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations
https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en
@BlueTeamLibrary
https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en
@BlueTeamLibrary
ti.360.net
奇安信威胁情报中心
Nuxt.js project