I published an article on How to Defend With the Courses of Action Matrix and Indicator Lifecycle Management on the Security Intelligence blog.
This article describes the courses of action matrix to help you understand how to verify and validate indicators. The CoA matrix assists you in choosing the most useful action (“response”) to take with a an indicator.
I run a lab with a couple of Windows VMs on different laptops via VMware Workstation (for Linux). Some of these machines are “vulnerable” Windows systems (check out Microsoft Evaluation Center). I pretty much always use the same password for the administrator account to make management easy. This is bad practice for a real-life environment, but the purpose of these machines is to get compromised anyway.
However, sometimes it might seem like a good idea … Read more.
I published an article on How Pivoting Can Help Your Incident Response Process on the Security Intelligence blog.
This article describes what pivoting is about (mostly from a point of view of a defender, or during incident response), how to evaluate and track the links that you found, what domains are most useful to use for pivoting and what data points you can use for pivoting.
Getting Active Directory security right can be a challenging task. Individual groups of computers or user privileges will most likely be properly configured but there are always some trade-offs that have to be made. Attackers will try to find an attack path by abusing the weaknesses that are caused by these trade-offs. Jumping from one host to another, compromising user accounts and abusing active sessions might get them to their final objectives. Whether this is … Read more.
I recently had to explore MQTT. I had never heard of this protocol before. However some helpful resources provide a clear explanation what MQTT is about.
MQTT is a machine-to-machine (M2M)/”Internet of Things” connectivity protocol that uses a lightweight publish/subscribe messaging transport. MQTT works on top of TCP/IP and by default uses port tcp/1883.
A quick search on Shodan reveals that there are a lot of devices publicly available, primarily in the US and Asia. … Read more.
I published an article on IBM Security Intelligence on How Can an ISAC Improve Cybersecurity and Resilience?.
The article covers analysing the three common types of ISACs (information sharing and analysis centers), who creates ISACs, reasons for joining an ISAC and what drives ISACs.
Remote desktop protocol (RDP) is designed by Microsoft for remote management of Windows-based virtual desktops. It provides users a graphical interface to connect over the network to a remote computer. Having a remote access feature leaves the door open for attackers.
I’ll use this post to summarise some of the information and commands that I use when investigating an RDP incident.
Note that RDP connections are usually done via tcp/3389.
Investigating RDP goes best in … Read more.
I published an article on IBM Security Intelligence on What Are the Different Types of Cyberthreat Intelligence?.
The article covers analysing the The Different Types of Threat Intelligence and the prerequisites to Start With a Cyberthreat Intelligence Program.
Cisco Talos published an analysis on the new VPNFilter malware that targets at least 500K networking devices worldwide. The post describes how the stage 1 of the malware extracts IP coordinates from the GPS latitude and longitude fields in the EXIF information of images.
A post by Kaspersky further analysed the VPNFilter EXIF to C2 mechanism. Unfortunately all the photobucket.com galleries that were used by the malware as storage for the images have been deleted. … Read more.
I use an Apple MacBook as my primary work laptop. One of the nice features that are automatically included in OSX is Time Machine, allowing you to do automatic backups.
You can do the backups to an external disk (via USB) or to a network connected disk. I also have a Synology NAS with a volume (encrypted of course) configured for the backups. I have set a quota for this volume to prevent the backups … Read more.
Graphs made with cudeso posts stats
By continuing to use the site, you agree to the use of cookies. more information
An HTTP cookie, is a small piece of text sent from a website and stored in your web browser. Cookies are a reliable mechanism for websites to remember your preferences and improve your browsing experience.
If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.