New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration
https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module
@BlueTeamLibrary
https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module
@BlueTeamLibrary
crowdstrike.com
New Evidence Proves Ongoing WIZARD/LUNAR SPIDER Collaboration
By tracking TrickBot and BokBot proxy modules, CrowdStrike has uncovered a new wrinkle in the relationship between WIZARD SPIDER and LUNAR SPIDER.
mkYARA – Writing YARA rules for the lazy analyst
https://blog.fox-it.com/2019/03/28/mkyara-writing-yara-rules-for-the-lazy-analyst
@BlueTeamLibrary
https://blog.fox-it.com/2019/03/28/mkyara-writing-yara-rules-for-the-lazy-analyst
@BlueTeamLibrary
Fox-IT International blog
mkYARA – Writing YARA rules for the lazy analyst
Writing YARA rules based on executable code within malware can be a tedious task. An analyst cannot simply copy and paste raw executable code into a YARA rule, because this code contains variable v…
Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware
https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
@BlueTeamLibrary
Mandiant
Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware | Mandiant
Advanced Windows Logging Finding What AV Missed
https://www.youtube.com/watch?v=C2cgvpN44is
@BlueTeamLibrary
https://www.youtube.com/watch?v=C2cgvpN44is
@BlueTeamLibrary
YouTube
Advanced Windows Logging - Finding What AV Missed
00:00 - Intro
01:00 - Explaining the HELK Architecture
02:50 - Showing my VM's Spec's/build
03:50 - Installing HELK
05:40 - Poking around HELK's Logstash container to see how it works
08:40 - Examining HELK Elastalert to view sigma rules
09:08 - The magic…
01:00 - Explaining the HELK Architecture
02:50 - Showing my VM's Spec's/build
03:50 - Installing HELK
05:40 - Poking around HELK's Logstash container to see how it works
08:40 - Examining HELK Elastalert to view sigma rules
09:08 - The magic…
Assess your data potential with ATT&CK Datamap
https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11
GitHub:
https://github.com/olafhartong/ATTACKdatamap
@BlueTeamLibrary
https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11
GitHub:
https://github.com/olafhartong/ATTACKdatamap
@BlueTeamLibrary
Medium
Assess your data potential with ATTACK Datamap
While helping clients that chose to work on coverage of the ATT&CK framework I found myself lacking a solid way to represent their options…
TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping
https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
@BlueTeamLibrary
FireEye
TRITON Actor TTP Profile, Custom Attack Tools, Detections, and
ATT&CK Mapping
ATT&CK Mapping
FireEye uncovered and is responding to an additional intrusion by the attacker behind TRITON.
Churning Out Machine Learning Models: Handling Changes in Model Predictions
https://www.fireeye.com/blog/threat-research/2019/04/churning-out-machine-learning-models-handling-changes-in-model-predictions.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/churning-out-machine-learning-models-handling-changes-in-model-predictions.html
@BlueTeamLibrary
Mandiant
Churning Out Machine Learning Models: Handling Changes in Model Predictions | Mandiant
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Threat Hunting Research Methodology: A Data Driven Approach
by Roberto & Jose Luis Rodriguez at Insomni'hack 2019
https://www.youtube.com/watch?v=DuUF-zXUzPs
@SecTalks
by Roberto & Jose Luis Rodriguez at Insomni'hack 2019
https://www.youtube.com/watch?v=DuUF-zXUzPs
@SecTalks
Securing Vendor Webapps - A Vulnerability Assessment on HELK
https://www.youtube.com/watch?v=2OWtEymBQfA
@BlueTeamLibrary
https://www.youtube.com/watch?v=2OWtEymBQfA
@BlueTeamLibrary
YouTube
Securing Vendor Webapps - A Vulnerability Assessment on HELK
More detailed notes: https://gist.github.com/IppSec/137a9f8870bed2763048072f321073e5
00:50 - My Vulnerability Assessment methodology
03:00 - Starting a Nessus Scan to see what it thinks
04:20 - Running nmap and deciding what ports are needed
09:35 - Reviewing…
00:50 - My Vulnerability Assessment methodology
03:00 - Starting a Nessus Scan to see what it thinks
04:20 - Running nmap and deciding what ports are needed
09:35 - Reviewing…
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors
by Juan Andrés Guerrero-Saade at CyberWarCon
https://www.youtube.com/watch?v=t5xd5drCPT0
@SecTalks
by Juan Andrés Guerrero-Saade at CyberWarCon
https://www.youtube.com/watch?v=t5xd5drCPT0
@SecTalks
YouTube
Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors
Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors
CYBERWARCON, November 28, 2018, Arlington, VA
Presentation by Juan Andrés Guerrero-Saade, Chronicle
Recording Sponsored by RiskIQ
Threat actor profiling is traditionally…
CYBERWARCON, November 28, 2018, Arlington, VA
Presentation by Juan Andrés Guerrero-Saade, Chronicle
Recording Sponsored by RiskIQ
Threat actor profiling is traditionally…
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Purple Team ATT&CK™ Automation
https://github.com/praetorian-inc/purple-team-attack-automation
@WindowsHackingLibrary
https://github.com/praetorian-inc/purple-team-attack-automation
@WindowsHackingLibrary
GitHub
GitHub - praetorian-inc/purple-team-attack-automation: Praetorian's public release of our Metasploit automation of MITRE ATT&CK™…
Praetorian's public release of our Metasploit automation of MITRE ATT&CK™ TTPs - praetorian-inc/purple-team-attack-automation
Pirates of Brazil: Integrating the Strengths of Russian and Chinese Hacking Communities
https://www.recordedfuture.com/brazilian-hacking-communities
@BlueTeamLibrary
https://www.recordedfuture.com/brazilian-hacking-communities
@BlueTeamLibrary
Recordedfuture
Pirates of Brazil: Integrating the Strengths of Russian and Chinese Hacking Communities Report | Recorded Future
New research from Insikt Group examines the history of Brazil’s cybercriminal underground, including their tactics, techniques, and procedures.
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Lateral Movement — SCM and Dll Hijacking Primer
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
@WindowsHackingLibrary
https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
@WindowsHackingLibrary
Posts By SpecterOps Team Members
Lateral Movement — SCM and Dll Hijacking Primer
Using the Service Control Manager and built-in services for lateral movement.
Hacking (Back) and Influence Operations
The new convergence of disinformation tactics and CNE in the Middle East
https://blog.0day.rocks/hacking-back-and-influence-operations-85cd52c1e933
@BlueTeamLibrary
The new convergence of disinformation tactics and CNE in the Middle East
https://blog.0day.rocks/hacking-back-and-influence-operations-85cd52c1e933
@BlueTeamLibrary
Medium
Hacking (Back) and Influence Operations
The new convergence of disinformation tactics and CNE in the Middle East
CARBANAK Week Part One: A Rare Occurrence
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html
@BlueTeamLibrary
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html
@BlueTeamLibrary
Introducing Venator: A macOS tool for proactive detection
https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56
@BlueTeamLibrary
https://posts.specterops.io/introducing-venator-a-macos-tool-for-proactive-detection-34055a017e56
@BlueTeamLibrary
Posts By SpecterOps Team Members
Introducing Venator: A macOS tool for proactive detection
Background & Introduction
w0rk3r's Blue team Library
CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-two-continuing-source-code-analysis.html @BlueTeamLibrary
CARBANAK Week Part Three: Behind the CARBANAK Backdoor
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-three-behind-the-backdoor.html
@BlueTeamLibrary
FireEye
CARBANAK Week Part Three: Behind the CARBANAK Backdoor
We revisit some previous research in Part Three of our CARBANAK Week blog series.