#استخدام
مرکز عملیات امنیت
Responsibility:
- Analyzing security logs and dashboards, tracing attacks.
- Ability to identify false-positive events and alerts.
- Motivation for improvements
- Ability to create shift and weekly reports.
- Preliminary investigation of violations, alert, incidents, collection of evidence, analysis of data
- Help us identify malicious activities within our network
- Create and follow-up tickets for incidents.
- Rotational work shift (day/night).
- Working as a team.
Requirement and Qualifications:
- 1-2 years of experience on SOC or Penetration Testing.
- Certifications such as CEH, SANS, … would be an advantage.
- Familiar with Logs such as Windows, Linux, Web server and services, IDS, … .
- Hands-on experience in Splunk and ES. (Strong skill would be an advantage)
- Familiar with Incident Handling Processes would be an advantage.
- Familiar with SOC workflows.
- Basic penetration test skills. (Seniority would be an advantage)
- Familiar understanding of security monitoring, detection, and analysis methodologies and technologies
Benefits:
- Competitive salary
- Health insurance
- Supplementary insurance
- Bonus based on performance
- Clear path for improvement
Please send your CV to this email: a.naderi@bluteam.ir
#دعوت_به_همکاری
مرکز عملیات امنیت
Responsibility:
- Analyzing security logs and dashboards, tracing attacks.
- Ability to identify false-positive events and alerts.
- Motivation for improvements
- Ability to create shift and weekly reports.
- Preliminary investigation of violations, alert, incidents, collection of evidence, analysis of data
- Help us identify malicious activities within our network
- Create and follow-up tickets for incidents.
- Rotational work shift (day/night).
- Working as a team.
Requirement and Qualifications:
- 1-2 years of experience on SOC or Penetration Testing.
- Certifications such as CEH, SANS, … would be an advantage.
- Familiar with Logs such as Windows, Linux, Web server and services, IDS, … .
- Hands-on experience in Splunk and ES. (Strong skill would be an advantage)
- Familiar with Incident Handling Processes would be an advantage.
- Familiar with SOC workflows.
- Basic penetration test skills. (Seniority would be an advantage)
- Familiar understanding of security monitoring, detection, and analysis methodologies and technologies
Benefits:
- Competitive salary
- Health insurance
- Supplementary insurance
- Bonus based on performance
- Clear path for improvement
Please send your CV to this email: a.naderi@bluteam.ir
#دعوت_به_همکاری
How to perform a Security Incident Response Tabletop Exercise
#آکادمی_روزبه
https://blog-rsisecurity-com.cdn.ampproject.org/c/s/blog.rsisecurity.com/how-to-perform-a-security-incident-response-tabletop-exercise/amp/
#آکادمی_روزبه
https://blog-rsisecurity-com.cdn.ampproject.org/c/s/blog.rsisecurity.com/how-to-perform-a-security-incident-response-tabletop-exercise/amp/
RSI Security
How to Perform a Security Incident Response Tabletop Exercise | RSI Security
Learn how to properly conduct a cybersecurity fire drill at your organization using the incident response tabletop exercise framework.
یکی از اهداف هکرها ایجاد ثبوت در دسترسی یا همان persistence است
در لینک زیر یکی از جدید ترین روشهای ایجاد ثبوت را بخوانیم
#آکادمی_روزبه
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/amp/
در لینک زیر یکی از جدید ترین روشهای ایجاد ثبوت را بخوانیم
#آکادمی_روزبه
https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/amp/
Malwarebytes
Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
This blog post was authored by Ankur Saini, with contributions from Hossein Jazi and Jérôme Segura (2022-04-07): Added MITRE ATT&CK mappings...
THE COMPLETE GUIDE TO vCISO (VIRTUAL CHIEF INFORMATION SECURITY OFFICER SERVICES)
#آکادمی_روزبه
https://riela-cyber.com/what-is-a-vciso/
#آکادمی_روزبه
https://riela-cyber.com/what-is-a-vciso/
Riela Cyber
The Complete Guide to vCISO (virtual Chief Information Security Officer) Services - Riela Cyber
What is a vCISO? In this article, we dive into the detail of what a vCISO does, how this benefits an organisation and how much this will...
Study On DNS Abuse _EUC_Tech Report 2022.pdf
1.6 MB
مطالعه ای بر سوء استفاده از DNS و راهکارهای مقابله
SN1PER –
Most Advanced Automated Information Gathering & Penetration Testing Tool
#آکادمی_روزبه
https://gbhackers.com/sn1per-a-detailed-explanation-of-most-advanced-automated-information-gathering-penetration-testing-tool/amp/
Most Advanced Automated Information Gathering & Penetration Testing Tool
#آکادمی_روزبه
https://gbhackers.com/sn1per-a-detailed-explanation-of-most-advanced-automated-information-gathering-penetration-testing-tool/amp/
The_CISO's_Guide_to_Using_Attack_Graphs_and_MITRE_ATT&CK®.pdf
1.2 MB
Advanced purple teaming using multistage adversary emulations and Attack Flow research.
#آکادمی_روزبه
#آکادمی_روزبه
ContinuousAuditingMetricsAndCodeofPractice.zip
719 KB
The Continuous Audit Metrics Catalog
#آکادمی_روزبه
https://cloudsecurityalliance.org/artifacts/the-continuous-audit-metrics-catalog/
#آکادمی_روزبه
https://cloudsecurityalliance.org/artifacts/the-continuous-audit-metrics-catalog/
پیش به سوی نسخه ۱۱ جدول ATT&CK
با هم بخوانیم
#آکادمی_روزبه
https://medium.com/mitre-attack/attack-goes-to-v11-599a9112a025
با هم بخوانیم
#آکادمی_روزبه
https://medium.com/mitre-attack/attack-goes-to-v11-599a9112a025
Medium
ATT&CK Goes to v11: Structured Detections, Beta Sub-Techniques for Mobile, and ICS Joins the Band
Structured Detections, Beta Sub-Techniques for Mobile, and ICS Joins the Band
تحلیل بخوانیم
گزارش بد افرار RedLine
#آکادمی_روزبه
https://muha2xmad.github.io/malware-analysis/fullredline/
گزارش بد افرار RedLine
#آکادمی_روزبه
https://muha2xmad.github.io/malware-analysis/fullredline/
حمله علیه سیستم های هوش مصنوعی
#آکادمی_روزبه
https://www.bloomberg.com/opinion/articles/2022-04-24/ai-poisoning-is-the-next-big-risk-in-cybersecurity
#آکادمی_روزبه
https://www.bloomberg.com/opinion/articles/2022-04-24/ai-poisoning-is-the-next-big-risk-in-cybersecurity
Bloomberg.com
The Next Cybersecurity Crisis: Poisoned AI
A lot of machine learning relies on massive data sets of unknown provenance. That’s a problem when digital defenses are on the line.
اجرای برنامه پایتون در مرورگر
#آکادمی_روزبه
https://www.bleepingcomputer.com/news/technology/new-pyscript-project-lets-you-run-python-programs-in-the-browser/amp/
#آکادمی_روزبه
https://www.bleepingcomputer.com/news/technology/new-pyscript-project-lets-you-run-python-programs-in-the-browser/amp/
BleepingComputer
New PyScript project lets you run Python programs in the browser
The project was announced this weekend at PyCon US 2022 and acts as a wrapper around the Pyodide project, which loads the CPython interpreter as a WebAssembly browser module.
Red Team Operation Course (Online).pdf
1 MB
پروتکل WDigest پسوردها را بصورت غیررمز شده نگهداری میکند
ببینیم هنگامی که این پروتکل فعال است، چطور رمزها را از ویندوز بیرون بکشیم
#آکادمی_روزبه
look into the event logs on your domain controllers and servers. Server event ID 4624 and Domain Controller event ID 4776 will highlight users logging in with the ‘Authentication Package: WDigest’.
ببینیم هنگامی که این پروتکل فعال است، چطور رمزها را از ویندوز بیرون بکشیم
#آکادمی_روزبه
look into the event logs on your domain controllers and servers. Server event ID 4624 and Domain Controller event ID 4776 will highlight users logging in with the ‘Authentication Package: WDigest’.