A practical guide to enhancing digital defense.pdf
654.4 KB
نکات مهم در راه اندازی و نگهداری SOC
درمستند ۱۸ صفحه ای فوق ، ۱۱ نکته استراتژیک در مرکز عملیات امنیت را ببینید
#آکادمی_روزبه
#soc
درمستند ۱۸ صفحه ای فوق ، ۱۱ نکته استراتژیک در مرکز عملیات امنیت را ببینید
#آکادمی_روزبه
#soc
LOG4SHELL & AD.pdf.pdf
3.3 MB
با اینکه در اکتیو دایرکتوری خبری از جاوا نیست اما راهکارهای تسخیر اکتیو دایرکتوری با استفاده از Log4shell را در مستند فوق بخوانید .
#آکادمی_روزبه
#activedirectory
#آکادمی_روزبه
#activedirectory
📌انجام Syscall ( فراخوانی درخواست از فضای کرنل ) بدون برانگیختن حساسیت آنتی ویروس در لینک زیر
https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
#آکادمی_روزبه
✅رول کشف فراخوانی های Syscall به زبان EQL به همراه رفرنس ها به جدول مایتره ATT&CK در لینک زیر
https://www.elastic.co/guide/en/security/8.0/suspicious-process-access-via-direct-system-call.html
https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs
#آکادمی_روزبه
✅رول کشف فراخوانی های Syscall به زبان EQL به همراه رفرنس ها به جدول مایتره ATT&CK در لینک زیر
https://www.elastic.co/guide/en/security/8.0/suspicious-process-access-via-direct-system-call.html
www.ired.team
Calling Syscalls Directly from Visual Studio to Bypass AVs/EDRs | Red Team Notes
تکنیک و تاکتیک ها و روشهای(TTPs ) مورد استفاده در حمله ی $LAPSUS را در لینک زیر مطالعه کنید
📍نکته: دو تکنیک مهم مورد استفاده در این حمله عبارتند از
✳️TA0005: Defence Evasion
✳️T1553.002: Subvert Trust Controls: Code Signing
#آکادمی_روزبه
https://michaelkoczwara.medium.com/lapsus-ttps-431d1ca21e80
📍نکته: دو تکنیک مهم مورد استفاده در این حمله عبارتند از
✳️TA0005: Defence Evasion
✳️T1553.002: Subvert Trust Controls: Code Signing
#آکادمی_روزبه
https://michaelkoczwara.medium.com/lapsus-ttps-431d1ca21e80
Medium
LAPSUS$ TTPs
LAPSUSS TTPs & MITRE ATT&CK Mapping
روشهای دور زدن تعیین هویت چند عامله
مقاله ای که برای تقویت زبان انگلیسی امنیت ، توصیه میشود
#زبان_انگلیسی #امنیت #امنیت_سایبری
#cybersecurity
#آکادمی_روزبه
https://www.wired.com/story/multifactor-authentication-prompt-bombing-on-the-rise/?bxid=5c65ad7824c17c67f81949f1&cndid=49736174&esrc=mobileInterstitial&source=EDT_WIR_NEWSLETTER_0_DAILY_ZZ&utm_brand=wired&utm_campaign=aud-dev&utm_content=WIR_Daily_033122&utm_mailing=WIR_Daily_033122&utm_medium=email&utm_source=nl&utm_term=P1
مقاله ای که برای تقویت زبان انگلیسی امنیت ، توصیه میشود
#زبان_انگلیسی #امنیت #امنیت_سایبری
#cybersecurity
#آکادمی_روزبه
https://www.wired.com/story/multifactor-authentication-prompt-bombing-on-the-rise/?bxid=5c65ad7824c17c67f81949f1&cndid=49736174&esrc=mobileInterstitial&source=EDT_WIR_NEWSLETTER_0_DAILY_ZZ&utm_brand=wired&utm_campaign=aud-dev&utm_content=WIR_Daily_033122&utm_mailing=WIR_Daily_033122&utm_medium=email&utm_source=nl&utm_term=P1
Wired
A Sinister Way to Beat Multifactor Authentication Is on the Rise
Lapsus$ and the group behind the SolarWinds hack have utilized prompt bombing to defeat weaker MFA protections in recent months.
مقاله ای تقریبا جامع در خصوص مبانی دور زدن آنتی ویروس ها و EDR ها
خواندن آن به متخصصان SOC برای درک نحوه عملکرد نفوذ و کشف ، توصیه میگردد
#آکادمی_روزبه
https://www.optiv.com/insights/source-zero/blog/endpoint-detection-and-response-how-hackers-have-evolved
خواندن آن به متخصصان SOC برای درک نحوه عملکرد نفوذ و کشف ، توصیه میگردد
#آکادمی_روزبه
https://www.optiv.com/insights/source-zero/blog/endpoint-detection-and-response-how-hackers-have-evolved
Optiv
Endpoint Detection and Response: How Hackers Have Evolved
This post identifies systemic endpoint detection and response issues and examines how attackers can bypass any EDR product.
#استخدام
مرکز عملیات امنیت
Responsibility:
- Analyzing security logs and dashboards, tracing attacks.
- Ability to identify false-positive events and alerts.
- Motivation for improvements
- Ability to create shift and weekly reports.
- Preliminary investigation of violations, alert, incidents, collection of evidence, analysis of data
- Help us identify malicious activities within our network
- Create and follow-up tickets for incidents.
- Rotational work shift (day/night).
- Working as a team.
Requirement and Qualifications:
- 1-2 years of experience on SOC or Penetration Testing.
- Certifications such as CEH, SANS, … would be an advantage.
- Familiar with Logs such as Windows, Linux, Web server and services, IDS, … .
- Hands-on experience in Splunk and ES. (Strong skill would be an advantage)
- Familiar with Incident Handling Processes would be an advantage.
- Familiar with SOC workflows.
- Basic penetration test skills. (Seniority would be an advantage)
- Familiar understanding of security monitoring, detection, and analysis methodologies and technologies
Benefits:
- Competitive salary
- Health insurance
- Supplementary insurance
- Bonus based on performance
- Clear path for improvement
Please send your CV to this email: a.naderi@bluteam.ir
#دعوت_به_همکاری
مرکز عملیات امنیت
Responsibility:
- Analyzing security logs and dashboards, tracing attacks.
- Ability to identify false-positive events and alerts.
- Motivation for improvements
- Ability to create shift and weekly reports.
- Preliminary investigation of violations, alert, incidents, collection of evidence, analysis of data
- Help us identify malicious activities within our network
- Create and follow-up tickets for incidents.
- Rotational work shift (day/night).
- Working as a team.
Requirement and Qualifications:
- 1-2 years of experience on SOC or Penetration Testing.
- Certifications such as CEH, SANS, … would be an advantage.
- Familiar with Logs such as Windows, Linux, Web server and services, IDS, … .
- Hands-on experience in Splunk and ES. (Strong skill would be an advantage)
- Familiar with Incident Handling Processes would be an advantage.
- Familiar with SOC workflows.
- Basic penetration test skills. (Seniority would be an advantage)
- Familiar understanding of security monitoring, detection, and analysis methodologies and technologies
Benefits:
- Competitive salary
- Health insurance
- Supplementary insurance
- Bonus based on performance
- Clear path for improvement
Please send your CV to this email: a.naderi@bluteam.ir
#دعوت_به_همکاری
How to perform a Security Incident Response Tabletop Exercise
#آکادمی_روزبه
https://blog-rsisecurity-com.cdn.ampproject.org/c/s/blog.rsisecurity.com/how-to-perform-a-security-incident-response-tabletop-exercise/amp/
#آکادمی_روزبه
https://blog-rsisecurity-com.cdn.ampproject.org/c/s/blog.rsisecurity.com/how-to-perform-a-security-incident-response-tabletop-exercise/amp/
RSI Security
How to Perform a Security Incident Response Tabletop Exercise | RSI Security
Learn how to properly conduct a cybersecurity fire drill at your organization using the incident response tabletop exercise framework.
یکی از اهداف هکرها ایجاد ثبوت در دسترسی یا همان persistence است
در لینک زیر یکی از جدید ترین روشهای ایجاد ثبوت را بخوانیم
#آکادمی_روزبه
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/amp/
در لینک زیر یکی از جدید ترین روشهای ایجاد ثبوت را بخوانیم
#آکادمی_روزبه
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/amp/
Malwarebytes
Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
This blog post was authored by Ankur Saini, with contributions from Hossein Jazi and Jérôme Segura (2022-04-07): Added MITRE ATT&CK mappings...
THE COMPLETE GUIDE TO vCISO (VIRTUAL CHIEF INFORMATION SECURITY OFFICER SERVICES)
#آکادمی_روزبه
https://riela-cyber.com/what-is-a-vciso/
#آکادمی_روزبه
https://riela-cyber.com/what-is-a-vciso/
Riela Cyber
The Complete Guide to vCISO (virtual Chief Information Security Officer) Services - Riela Cyber
What is a vCISO? In this article, we dive into the detail of what a vCISO does, how this benefits an organisation and how much this will...
Study On DNS Abuse _EUC_Tech Report 2022.pdf
1.6 MB
مطالعه ای بر سوء استفاده از DNS و راهکارهای مقابله
SN1PER –
Most Advanced Automated Information Gathering & Penetration Testing Tool
#آکادمی_روزبه
https://gbhackers.com/sn1per-a-detailed-explanation-of-most-advanced-automated-information-gathering-penetration-testing-tool/amp/
Most Advanced Automated Information Gathering & Penetration Testing Tool
#آکادمی_روزبه
https://gbhackers.com/sn1per-a-detailed-explanation-of-most-advanced-automated-information-gathering-penetration-testing-tool/amp/
The_CISO's_Guide_to_Using_Attack_Graphs_and_MITRE_ATT&CK®.pdf
1.2 MB
Advanced purple teaming using multistage adversary emulations and Attack Flow research.
#آکادمی_روزبه
#آکادمی_روزبه
ContinuousAuditingMetricsAndCodeofPractice.zip
719 KB
The Continuous Audit Metrics Catalog
#آکادمی_روزبه
https://cloudsecurityalliance.org/artifacts/the-continuous-audit-metrics-catalog/
#آکادمی_روزبه
https://cloudsecurityalliance.org/artifacts/the-continuous-audit-metrics-catalog/
پیش به سوی نسخه ۱۱ جدول ATT&CK
با هم بخوانیم
#آکادمی_روزبه
https://medium.com/mitre-attack/attack-goes-to-v11-599a9112a025
با هم بخوانیم
#آکادمی_روزبه
https://medium.com/mitre-attack/attack-goes-to-v11-599a9112a025
Medium
ATT&CK Goes to v11: Structured Detections, Beta Sub-Techniques for Mobile, and ICS Joins the Band
Structured Detections, Beta Sub-Techniques for Mobile, and ICS Joins the Band