Mitre's Center Releases FIN6 Adversary Emulation Plan
Blogpost: https://medium.com/mitre-engenuity/center-releases-fin6-adversary-emulation-plan-775d8c5ebe9b
Github: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/fin6
@BlueTeamLibrary
Blogpost: https://medium.com/mitre-engenuity/center-releases-fin6-adversary-emulation-plan-775d8c5ebe9b
Github: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/fin6
@BlueTeamLibrary
Medium
Center Releases FIN6 Adversary Emulation Plan
Written by Jon Baker and Forrest Carver.
Micropatch for Zerologon, the "perfect" Windows vulnerability (CVE-2020-1472)
https://blog.0patch.com/2020/09/micropatch-for-zerologon-perfect.html
@BlueTeamLibrary
https://blog.0patch.com/2020/09/micropatch-for-zerologon-perfect.html
@BlueTeamLibrary
0patch - Better Security Patches
Micropatch for Zerologon, the "perfect" Windows vulnerability (CVE-2020-1472)
Tiny reboot-less security patches for critical vulnerabilities in Windows, Microsoft Office, and other Windows products
The OSCD Sprint #2: "Simulation, Detection & Response" starts tomorrow!
https://oscd.community/sprints/sprint_2.html
@BlueTeamLibrary
https://oscd.community/sprints/sprint_2.html
@BlueTeamLibrary
Introduction to Threat Intelligence ETW
A quick look into ETW capabilities against malicious API calls.
https://undev.ninja/introduction-to-threat-intelligence-etw
@BlueTeamLibrary
A quick look into ETW capabilities against malicious API calls.
https://undev.ninja/introduction-to-threat-intelligence-etw
@BlueTeamLibrary
undev.ninja
Introduction to Threat Intelligence ETW
A quick look into ETW capabilities against malicious API calls.
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Active Directory (AD) Attacks & Enumeration at the Network Layer
https://www.lares.com/blog/active-directory-ad-attacks-enumeration-at-the-network-layer
@WindowsHackingLibrary
https://www.lares.com/blog/active-directory-ad-attacks-enumeration-at-the-network-layer
@WindowsHackingLibrary
Lares
Active Directory (AD) Attacks & Enumeration at the Network Layer
Intro Defending an Active Directory environment, particularly a large one, is a daunting task. Telemetry generated by Active Directory itself as well as the hosts connected to it are critical…
Att&ck v8 is out!
Bringing PRE into Enterprise
https://medium.com/mitre-attack/the-retirement-of-pre-attack-4b73ffecd3d3
@BlueTeamLibrary
Bringing PRE into Enterprise
https://medium.com/mitre-attack/the-retirement-of-pre-attack-4b73ffecd3d3
@BlueTeamLibrary
Medium
Bringing PRE into Enterprise
Integrating the scope of PRE-ATT&CK into Enterprise ATT&CK
Testing adversary technique variations with AtomicTestHarness
https://redcanary.com/blog/introducing-atomictestharnesses
@BlueTeamLibrary
https://redcanary.com/blog/introducing-atomictestharnesses
@BlueTeamLibrary
Red Canary
Testing Threat Technique Variation with AtomicTestHarnesses
For behavior-based detection, it’s important to ensure that detection logic is resilient against attack technique variations.
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
STAR Webcast: Spooky RYUKy: The Return of UNC1878
https://www.youtube.com/watch?v=BhjQ6zsCVSc
@SecTalks
https://www.youtube.com/watch?v=BhjQ6zsCVSc
@SecTalks
YouTube
STAR Webcast: Spooky RYUKy: The Return of UNC1878
Earlier this year, Mandiant published a blog on a fast-moving adversary deploying RYUK ransomware, UNC1878. Shortly after its release, there was a significant decrease in observed UNC1878 intrusions and RYUK activity overall almost completely vanishing over…
Easily Identify Malicious Servers on the Internet with JARM
https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
@BlueTeamLibrary
https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a
@BlueTeamLibrary
Salesforce Engineering Blog
Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog
JARM is an active Transport Layer Security server fingerprinting tool that provides the ability to identify and group malicious servers.
Detection as Code (DaC) challenges, automation, maintenance and SIEGMA
https://blog.3coresec.com/2020/12/detection-as-code-dac-challenges.html
@BlueTeamLibrary
https://blog.3coresec.com/2020/12/detection-as-code-dac-challenges.html
@BlueTeamLibrary
DebUNCing Attribution: How Mandiant Tracks Uncategorized Threat Actors
https://www.fireeye.com/blog/products-and-services/2020/12/how-mandiant-tracks-uncategorized-threat-actors.html
@BlueTeamLibrary
https://www.fireeye.com/blog/products-and-services/2020/12/how-mandiant-tracks-uncategorized-threat-actors.html
@BlueTeamLibrary
Identifying UNC2452(Solarigate)-Related Techniques for ATT&CK
https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714
@BlueTeamLibrary
https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714
@BlueTeamLibrary
Medium
Identifying UNC2452-Related Techniques for ATT&CK
Tracking UNC2452-related reporting as we look to update ATT&CK.
How to Design Abnormal Child Processes Rules without Telemetry
https://blog.menasec.net/2021/01/how-to-design-abnormal-child-processes.html
@BlueTeamLibrary
https://blog.menasec.net/2021/01/how-to-design-abnormal-child-processes.html
@BlueTeamLibrary
Microsoft Defender Attack Surface Reduction recommendations by Palantir
"This blog post provides a set of recommendations based on the audit data Palantir’s Infosec team has collected from the Windows Defender Attack Surface Reduction (ASR) family of security controls over the past two years."
https://medium.com/palantir/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8
@BlueTeamLibrary
"This blog post provides a set of recommendations based on the audit data Palantir’s Infosec team has collected from the Windows Defender Attack Surface Reduction (ASR) family of security controls over the past two years."
https://medium.com/palantir/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8
@BlueTeamLibrary
Medium
Microsoft Defender Attack Surface Reduction recommendations
Palantir’s Infosec team shares their tips and best practices
Hunting in the Sysmon Call Trace
https://www.lares.com/blog/hunting-in-the-sysmon-call-trace
@BlueTeamLibrary
https://www.lares.com/blog/hunting-in-the-sysmon-call-trace
@BlueTeamLibrary
Lares
Hunting in the Sysmon Call Trace
Intro The Sysmon ProcessAccess event has been used in threat hunting and detection efforts in order to alert on techniques such as process injection and credential access. According to the…
RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986
https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986
@BlueTeamLibrary
https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986
@BlueTeamLibrary
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
Trapdoor - The serverless HTTP honeypot
https://blog.3coresec.com/2021/03/trapdoor-serverless-http-honeypot.html
@BlueTeamLibrary
https://blog.3coresec.com/2021/03/trapdoor-serverless-http-honeypot.html
@BlueTeamLibrary
3Coresec
Trapdoor - The serverless HTTP honeypot
Today we are announcing the release of Trapdoor , our AWS-based serverless honeypot. The idea of a serverless honeytoken isn't new. Adel ...
Mapeando na prática a visibilidade e detecção do seu ambiente com ATT&CK usando DeTT&CT
*Toda a renda do evento será convertida em Cestas Básicas para caridade*
https://www.sympla.com.br/mapeando-na-pratica-a-visibilidade-e-deteccao-do-seu-ambiente-com--attck-usando-dettct__1171217
@BlueTeamLibrary #temp
*Toda a renda do evento será convertida em Cestas Básicas para caridade*
https://www.sympla.com.br/mapeando-na-pratica-a-visibilidade-e-deteccao-do-seu-ambiente-com--attck-usando-dettct__1171217
@BlueTeamLibrary #temp
www.sympla.com.br
Mapeando na prática a visibilidade e detecção do seu ambiente com ATT&CK usando DeTT&CT
<p dir="ltr" style="line-height:1.38;text-indent: 36pt;margin-top:0pt;margin-bottom:0pt;" id="docs-internal-guid-6777275f-7fff-76ad-15af-350b99ebcec3"><b><span style="font-size: 14px;">Toda a renda do evento será convertida em Cestas Básicas para caridad…
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Pushing the Barriers of Unique YARA Uses
Tom Ueltschi at REVERSING 2020
https://youtu.be/bha-TpjXwwg
@SecTalks
Tom Ueltschi at REVERSING 2020
https://youtu.be/bha-TpjXwwg
@SecTalks
YouTube
REVERSING 2020 - Pushing the Barriers of Unique YARA Uses
Request a DEMO today → https://register.reversinglabs.com/demo ← and we'll show you how ReversingLabs detects more advanced file based threats faster than anybody in the industry!
YARA has become one of the most flexible and customized security tools used…
YARA has become one of the most flexible and customized security tools used…
Malware Theory - Imphash algorithm explained
https://www.youtube.com/watch?v=fWV8Dh_RBZU
@BlueTeamLibrary
https://www.youtube.com/watch?v=fWV8Dh_RBZU
@BlueTeamLibrary
YouTube
Malware Theory - Imphash algorithm explained
The imphash or import hash by Mandiant has been widely adopted by malware databases, security software and PE tools. What is it used for? How does it work? And can it be improved?
My malware analysis course for beginners: https://www.udemy.com/course/windows…
My malware analysis course for beginners: https://www.udemy.com/course/windows…