Analysis of MuddyC3, a New Weapon Used by MuddyWater
https://ti.qianxin.com/blog/articles/analysis-of-muddyc3-a-new-weapon-used-by-muddywater
@BlueTeamLibrary
https://ti.qianxin.com/blog/articles/analysis-of-muddyc3-a-new-weapon-used-by-muddywater
@BlueTeamLibrary
Qianxin
奇安信威胁情报中心
Nuxt.js project
Inside the MSRC – Customer-centric incident response
https://msrc-blog.microsoft.com/2019/06/25/inside-the-msrc-customer-centric-incident-response
@BlueTeamLibrary
https://msrc-blog.microsoft.com/2019/06/25/inside-the-msrc-customer-centric-incident-response
@BlueTeamLibrary
Sniffing and replaying ADFS claims with Fiddler!
https://cqureacademy.com/blog/replaying-adfs-claims-with-fiddler
@BlueTeamLibrary
https://cqureacademy.com/blog/replaying-adfs-claims-with-fiddler
@BlueTeamLibrary
Evasion of Security Policies by VPN Clients
https://unit42.paloaltonetworks.com/evasion-of-security-policies-by-vpn-clients-poses-great-risk-to-network-operators
@BlueTeamLibrary
https://unit42.paloaltonetworks.com/evasion-of-security-policies-by-vpn-clients-poses-great-risk-to-network-operators
@BlueTeamLibrary
Unit 42
Evasion of Security Policies by VPN Clients Poses Great Risk to Network Operators
Researchers with Palo Alto Networks Unit 42 investigated the tunneling software X-VPN, which uses various evasion techniques to bypass security and policy enforcement mechanisms. X-VPN is a type of Virtual Private Network (VPN) that can be used to bypass…
Tracking driver inventory to unearth rootkits
https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits
@BlueTeamLibrary
https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits
@BlueTeamLibrary
Red Canary
Tracking driver inventory to unearth rootkits
As defenders, we need to understand, enumerate, and evaluate the drivers in our environments because sometimes adversaries use them as rootkits.
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Inside Cybercrime Groups Harvesting Active Directory for fun & Profit
By Vitali Kremez at CONFidence 2019
https://youtu.be/u1XvMcwdvgI
@SecTalks
By Vitali Kremez at CONFidence 2019
https://youtu.be/u1XvMcwdvgI
@SecTalks
YouTube
CONFidence 2019: "Inside Cybercrime Groups Harvesting Active Directory for Fun..." - Vitali Kremez
Vitali presents malware techniques and tricks on how to reverse engineer and analyze malware families exploiting active directory. The talk dives deeper into pseudo-source code level analysis and malware developer implementation of Lightweight Directory Access…
Changes to Ticket-Granting Ticket (TGT) Delegation Across Trusts in Windows Server (PFE edition)
https://techcommunity.microsoft.com/t5/Premier-Field-Engineering/Changes-to-Ticket-Granting-Ticket-TGT-Delegation-Across-Trusts/ba-p/440283
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/Premier-Field-Engineering/Changes-to-Ticket-Granting-Ticket-TGT-Delegation-Across-Trusts/ba-p/440283
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
Core Infrastructure and Security Blog
Hard Pass: Declining APT34’s Invite to Join Their Professional Network
https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html
@BlueTeamLibrary
Mandiant
Hard Pass: Declining APT34’s Invite to Join Their Professional Network | Mandiant
ABADBABE 8BADF00D: Discovering BADHATCH and a Detailed Look at FIN8’s Tooling
https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling
@BlueTeamLibrary
https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling
@BlueTeamLibrary
Finding Evil in Windows 10 Compressed Memory, Part One: Volatility and Rekall Tools
https://www.fireeye.com/blog/threat-research/2019/07/finding-evil-in-windows-ten-compressed-memory-part-one.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/07/finding-evil-in-windows-ten-compressed-memory-part-one.html
@BlueTeamLibrary
Mandiant
Finding Evil in Windows 10 Compressed Memory, Part One: Volatility and Rekall Tools | Mandiant
Getting Started with ATT&CK Series:
Part 1 - Threat Intelligence
https://medium.com/mitre-attack/getting-started-with-attack-cti-4eb205be4b2f
Part 2 - Detection and Analytics
https://medium.com/mitre-attack/getting-started-with-attack-detection-a8e49e4960d0
Part 3 - Adversary Emulation and Red Teaming
https://medium.com/mitre-attack/getting-started-with-attack-red-29f074ccf7e3
Part 4 - Assessments and Engineering
https://medium.com/mitre-attack/getting-started-with-attack-assessment-cc0b01769cb4
@BlueTeamLibrary
Part 1 - Threat Intelligence
https://medium.com/mitre-attack/getting-started-with-attack-cti-4eb205be4b2f
Part 2 - Detection and Analytics
https://medium.com/mitre-attack/getting-started-with-attack-detection-a8e49e4960d0
Part 3 - Adversary Emulation and Red Teaming
https://medium.com/mitre-attack/getting-started-with-attack-red-29f074ccf7e3
Part 4 - Assessments and Engineering
https://medium.com/mitre-attack/getting-started-with-attack-assessment-cc0b01769cb4
@BlueTeamLibrary
Medium
Getting Started with ATT&CK: Threat Intelligence
Getting Started with ATT&CK from a Cyber Threat Intelligence Perspective
Enter Mordor: Pre-recorded Security Events from Simulated Adversarial Techniques
https://posts.specterops.io/enter-mordor-pre-recorded-security-events-from-simulated-adversarial-techniques-fdf5555c9eb1
@BlueTeamLibrary
https://posts.specterops.io/enter-mordor-pre-recorded-security-events-from-simulated-adversarial-techniques-fdf5555c9eb1
@BlueTeamLibrary
Medium
Enter Mordor 😈: Pre-recorded Security Events from Simulated Adversarial Techniques 🛡
It is Monday and you want to start your week by learning about a new adversarial technique and build detections around it. What is the…
w0rk3r's Blue team Library
Enter Mordor: Pre-recorded Security Events from Simulated Adversarial Techniques https://posts.specterops.io/enter-mordor-pre-recorded-security-events-from-simulated-adversarial-techniques-fdf5555c9eb1 @BlueTeamLibrary
AWS knocked and The Gates of Mordor have answered
(Recreating the environment used on Mordor on aws)
https://posts.specterops.io/aws-knocked-and-the-gates-of-mordor-have-answered-58540d8e3995
@BlueTeamLibrary
(Recreating the environment used on Mordor on aws)
https://posts.specterops.io/aws-knocked-and-the-gates-of-mordor-have-answered-58540d8e3995
@BlueTeamLibrary
Medium
AWS knocked and The Gates of Mordor have answered
Objectives
APT41: A Dual Espionage and Cyber Crime Operation
https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
@BlueTeamLibrary
Google Cloud Blog
APT41 Chinese Cyber Threat Group | Espionage & Cyber Crime | Google Cloud Blog
APT41 is a prolific Chinese cyber threat group that carries out state-sponsored espionage activity in parallel with financially motivated operations.
Showing Vulnerability to a Machine: Automated Prioritization of Software Vulnerabilities
https://www.fireeye.com/blog/threat-research/2019/08/automated-prioritization-of-software-vulnerabilities.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2019/08/automated-prioritization-of-software-vulnerabilities.html
@BlueTeamLibrary
Mandiant
Showing Vulnerability to a Machine: Automated Prioritization of Software Vulnerabilities | Mandiant
The Windows Sysmon Logging Cheat Sheet
https://www.malwarearchaeology.com/s/Windows-Sysmon-Logging-Cheat-Sheet_Aug_2019-pthx.pdf
@BlueTeamLibrary
https://www.malwarearchaeology.com/s/Windows-Sysmon-Logging-Cheat-Sheet_Aug_2019-pthx.pdf
@BlueTeamLibrary
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Enriching Domain Names with Frequency Analysis and ASN Information
https://opensecgeek.blogspot.com/2018/07/enriching-domain-names-with-frequency.html
@BlueTeamLibrary
https://opensecgeek.blogspot.com/2018/07/enriching-domain-names-with-frequency.html
@BlueTeamLibrary
Blogspot
Enriching Domain Names with Frequency Analysis and ASN Information
I write about SecOps and InfoSec. I'm usually inefficient and give bad advice.
Analyzing Network Packets with Wireshark, Elasticsearch, and Kibana
https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana
@BlueTeamLibrary
https://www.elastic.co/blog/analyzing-network-packets-with-wireshark-elasticsearch-and-kibana
@BlueTeamLibrary
Elastic Blog
Analyzing network packets with Wireshark, Elasticsearch, and Kibana
Learn how to architect a real-time data pipeline for network packet analysis using Wireshark, Filebeat, Logstash, Ingest Pipelines, Elasticsearch, and Kibana....