Michel Chbeir 🌐

An absolutely great video presentation from Meisam Eslahi, Ph.D., about practical data analysis and threat detections techniques ! "Cyber Threat Hunt 101: Part 7 - Practical Data Analysis and Threat Detection Techniques!" Definitely worth a watch and bookmarking if you start in cyber, and even if you work in cyber but are less used to practice threat hunting, it would be refreshing. Good video, nice presentation and integrations with examples. Love it ! I hope you'll enjoy the resource. #cybersecurity #cybersecurityawareness #threathunting #youtube #learningvideo https://lnkd.in/edfiHt-c

11

4 commentaires

📚𝐁𝐎𝐎𝐊 𝐑𝐄𝐕𝐈𝐄𝐖: Cyber Wargaming: Research and Education for Security in a Dangerous Digital World. The contributors to this book explain ⭐⭐𝐰𝐡𝐚𝐭 𝐜𝐲𝐛𝐞𝐫 𝐰𝐚𝐫𝐠𝐚𝐦𝐞𝐬 𝐚𝐫𝐞, 𝐡𝐨𝐰 𝐭𝐡𝐞𝐲 𝐰𝐨𝐫𝐤, 𝐚𝐧𝐝 𝐰𝐡𝐲 𝐭𝐡𝐞𝐲 𝐨𝐟𝐟𝐞𝐫⭐⭐ insights that other methods cannot match. The lessons learned are not merely artifacts of these games―they also shed light on how people interpret and interact with cyberspace in real life. --- 𝐀 𝐦𝐮𝐬𝐭 𝐡𝐚𝐯𝐞!  🛒 𝐆𝐞𝐭 𝐲𝐨𝐮𝐫 𝐜𝐨𝐩𝐲 𝐡𝐞𝐫𝐞: https://lnkd.in/eyqtauy6 Frank L. Smith III, Nina A. Kollars, and Benjamin H. Schechter, three scholars associated with the ⚓ U.S. Naval War College🇺🇸, have collected essays from authors who have contributed to the creation of cyber wargames. 🎮 Games can extend the role of cyber well beyond the boundaries ordinarily given to the domain. Some of the games included physical attacks as well as pure cyber-attacks across a network. Two games included influence operations, a rarity in U.S considerations of cyber. 𝐑𝐞𝐜𝐞𝐧𝐭 𝐬𝐜𝐞𝐧𝐚𝐫𝐢𝐨𝐬 𝐨𝐟 𝐭𝐡𝐞 𝐂𝐲𝐛𝐞𝐫 𝟗/𝟏𝟐 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞 𝐡𝐚𝐯𝐞 𝐟𝐨𝐜𝐮𝐬𝐞𝐝 𝐨𝐧 𝐜𝐲𝐛𝐞𝐫𝐜𝐮𝐫𝐫𝐞𝐧𝐜𝐲 𝐚𝐧𝐝 𝐬𝐩𝐲𝐰𝐚𝐫𝐞. Cyber Security Forum Initiative #csfi #wargaming Atlantic Council CYBER RANGES

122

6 commentaires

The "Threat Hunting 101" document is a guide that could help organizations proactively search for malware and attackers within their network. Instead of relying solely on automated alerts, threat hunting involves actively looking for potential threats using a Security Information and Event Management (#SIEM) system. This system collects and analyzes log data from various sources to identify suspicious activities. Threat hunting includes several key techniques. Recognizing suspicious software is one method, which involves monitoring #endpoints for unusual software using process names or hashes. Another technique is observing behavior changes, such as unexpected processes being initiated by unusual users or parent processes, which can indicate malicious activity. Additionally, threat hunters watch for #scripting abuse, particularly the misuse of scripting languages like #PowerShell for harmful purposes. Following up on antivirus alerts is also important. By examining antivirus logs, threat hunters can understand where and how malware was detected and cleaned, providing insights into potential weaknesses in the system. Persistence monitoring helps identify attempts by attackers to maintain access to systems by observing changes to registry keys and scheduled tasks. Detecting lateral movement is essential for spotting attackers moving from one endpoint to another within the network. This is done by tracking unusual logon attempts and network connections. #DNS abuse monitoring involves watching for changes or abnormal activities in DNS traffic, which attackers might exploit to redirect or exfiltrate data. Another advanced technique is setting up #honeypots or bait systems to attract and identify attackers without risking the actual environment. Effective threat hunting relies on collecting log data from various sources, such as network devices, servers, endpoints, and security systems, to provide a holistic view of potential threats. Using tools and automation can help identify and respond to threats efficiently, with SIEM solutions playing a crucial role in automating parts of the threat hunting process and providing timely alerts.

12

1 commentaire

France’s cybersecurity agency, ANSSI, issues a warning regarding cyber attacks targeting French diplomatic interests. The agency reveals that state-sponsored actors linked to Russia, particularly the SVR, are behind these threats. The hacking group, known as Midnight Blizzard (also referred to as Nobelium by Microsoft), has been identified as the culprit. ANSSI distinguishes Midnight Blizzard from APT29, BlueBravo, Cloaked Ursa, Cozy Bear, and The Dukes, despite them often being used interchangeably. Additionally, Dark Halo, responsible for the SolarWinds attack in 2020, is another related threat group. Stay informed and vigilant in the face of escalating cybersecurity risks. #Cybersecurity #ThreatIntelligence #ANSSI #MidnightBlizzard #APT29 #DarkHalo https://lnkd.in/eCkTTJ8m

2

"These claims and their freshness are among the observable elements allowing to estimate the impact of Cronos and the Alphv exit-scam on the cybercriminal ecosystem of  ransomware. Added to this are the cross-claims. These claims – or  crossclaims  in English –  essentially reflect  a  cyberattack  conducted by the same actor using two banners to conduct its activities: ransomware franchises are increasingly used as simple brands, smokescreens  behind which the affiliates hide. Recently, Anastasia Sentsova, an analyst at Analyst1 looked into the subject as part of an  investigation into RansomHouse." A great analysis by Valery Rieß-Marchive on the aftermath of #OperationCronos and the role of crossclaims in ransomware. Read here 👇 https://lnkd.in/eWF67gmt

17

🚨 Important news about the critical #CrushFTP security flaw... CVSS 9.8! The team at Airbus #CERT has published Python scripts on #GitHub that can be used to scan for the #CrushFTP file read vulnerability, as well as search for #IoCs in a CrushFTP server installation directory🔥 Thank you!!! Check this out: https://lnkd.in/e6sN7szg If you are still vulnerable (versions below 11.1), your top three priorities today should be: 1️⃣ Patch!! 2️⃣ Patch!! 3️⃣ Patch!! ;-) #SimpleActionPlan This flaw has been exploited as a zero-day to target multiple U.S. entities...

72

CVE-2023-49606 - CVSS 9.8 - EPSS 0.09% - A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. Ref.1: https://lnkd.in/e7G3a3RW Ref.2: https://lnkd.in/ejAm7ekx

3

Interesting move from Qnap, are we slowly moving toward security (and privacy ? ) by design and by default ? "QNAP adds NAS ransomware protection to latest QTS version" Is it perfect ? We'll see, but it's a good move. #cybersecurity #qnap https://lnkd.in/gCNaBg5e

19

3 commentaires

CVE-2024-3661 - CVSS 8.8 - EPSS We don't have an EPSS score for this CVE yet - By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Ref.1: https://lnkd.in/eXEskBcn Ref.2: https://lnkd.in/e_KwDMtH

1

Article Accepted in Elsevier Computers & Security Title : OSTIS-Organization-Specific Threat Intelligence System We've developed a framework for generating and managing Cyber Threat Intelligence (CTI) data, tailored specifically for organizations. Key Features: - Custom Web Crawler: Gathers CTI data from reliable security blogs. - Automated Deep-Learning Models: Extracts relevant content and maps it to specific domains like education, finance, and healthcare. -Explainable AI (XAI): Uses the SHAP tool to validate and interpret our models. -OSTIKG: Our Organization-Specific Threat Intelligence Knowledge Graph visualizes attack patterns and incidents by linking diverse entities such as malware groups and attack types.

54

Cybersecurity Word of the Day : Obfuscation Obfuscation refers to the practice of making code or data difficult to understand, aiming to protect intellectual property and prevent reverse engineering. While it serves legitimate purposes, attackers also use obfuscation to hide malicious code. Impact of Obfuscation In 2020, the SolarWinds attack targeted IT giant SolarWinds, embedding the SUNBURST malware in software updates distributed globally. Employing advanced obfuscation, SUNBURST evaded detection, allowing attackers to steal data, move laterally, and escalate privileges undetected. Discovered by FireEye, this breach highlighted supply chain vulnerabilities, causing widespread data breaches and raising global cybersecurity concerns How Obfuscation Works Obfuscation techniques include: 1. Variable Renaming: Changing variable names to obscure their purpose and functionality. 2. Code Packing: Compressing or encrypting code to hinder analysis and detection. 3. Control Flow Transformation: Rearranging program instructions to disrupt logical flow. 4. Dummy Code Insertion: Introducing meaningless code to confuse analysts and automated tools. These methods aim to make code appear convoluted without altering its functionality, posing challenges for cybersecurity analysts and detection systems. Precautions - Implement robust code review processes. - Use advanced threat detection tools capable of identifying obfuscated code. - Regularly update and patch systems to prevent exploitation of vulnerabilities. #Cybersecurity #Obfuscation #MalwareProtection #InfoSec #SolarWinds #CyberDefense #TechSecurity #StaySecure #ITSecurity #CyberAware #Supplychain

5

#Alhamduillah Personally, my contribution is available in the MITRE Attack Framework for the April version. Update Links : https://lnkd.in/eciN4YZ4 Contribution List : https://lnkd.in/erMWn_rh Contribution Links : 1 - https://lnkd.in/eK58f2W9 2- https://lnkd.in/e8drJfm7 #mitre #attack #framework

3

1 commentaire

[ #Cybersecurity ] ⚡️ 12. The Art of Prevention ⚡️ In cybersecurity, Prevention is an #Art. Are you mastering it? It’s important to Reacting to threats and attacks, but Best is : Anticipating them, Identifying where Vulnerabilities lie, and Addressing them before they become problems. " Prevention for the Best Protection " This proactive approach is what separates those who merely respond from those who are truly secure. 🏆 Concerning SQL injection that are one of the top and most dangerous cyber threats, this is the same. Now an automated AI-driven solution exist and provide the most effective line of defense. #SQLiFixer is designed to master the art of prevention against SQL injection. It’s a strategy, a solution, and a commitment to staying ahead of the threats. Because the best defense is one that prevents the attack from happening in the first place. 🏆 "Master the art of prevention with SQLiFixer." 🔗 For more information on how to be secure, immediately, seamlessly and effectively : https://lnkd.in/eEFNYAxG 🔗 Other Benefits :  1. The Trust Your Customers Deserve : https://lnkd.in/eT-pvFx7 2. The True Cost of a Data Breach : https://lnkd.in/egxEjjdH 3. The Weight of Responsibility : https://lnkd.in/e-YHdAa6 4. The Power of a Safe Night’s Sleep : https://lnkd.in/ekqRqKAP 5. The Legacy You Leave Behind : https://lnkd.in/etBbfH_J 6. More Than Just a Defense - A Commitment : https://lnkd.in/ec_SYucz 7. Turning Fear into Confidence : https://lnkd.in/e4wGRX_t 8. A Future Without Regrets: https://lnkd.in/evkNbchW 9. Turn Past Challenges into Future Strength :  https://lnkd.in/exBhe8XA 10. The Power of Proactive Protection #Innovation #SQLinjection #AI #DataProtection

1