توصیه هایی سر راست!
قرار نیست آپولو هوا کنید تا از اکثر حملات در امان باشید. چنین کنترل هایی حتی برای پیشرفته ترین حملات ممکن است کارا باشند؛ یا از ابتدا جلوی حمله را می‌گیرند یا حلقه ای در زنجیره حمله را از هم می‌گسلند
#آکادمی_روزبه
تصویری از آخرین توصیه امنیتی CISA برای دفع یک حمله جدید
قرار نیست آپولو هوا کنید تا از اکثر حملات در امان باشید. چنین کنترل هایی حتی برای پیشرفته ترین حملات ممکن است کارا باشند؛ یا از ابتدا جلوی حمله را می‌گیرند یا حلقه ای در زنجیره حمله را از هم می‌گسلند
#آکادمی_روزبه
تصویری از آخرین توصیه امنیتی CISA برای دفع یک حمله جدید
این لینک برای هر متخصص SOC که SIEM آن اسپلانک است لازم است
#آکادمی_روزبه
https://www.splunk.com/en_us/blog/security/latest-splunk-security-content.html
#آکادمی_روزبه
https://www.splunk.com/en_us/blog/security/latest-splunk-security-content.html
Splunk
Splunk Security Content for Threat Detection & Response: November 2025 Update | Splunk
Learn about the latest security content from Splunk.
کاربران اندروئید هدف نفوذ
#آکادمی_روزبه
Chipmaker Qualcomm has released more information about three high-severity security flaws that it said came under "limited, targeted exploitation" back in October 2023.
https://thehackernews.com/2023/12/qualcomm-releases-details-on-chip.html
#آکادمی_روزبه
Chipmaker Qualcomm has released more information about three high-severity security flaws that it said came under "limited, targeted exploitation" back in October 2023.
https://thehackernews.com/2023/12/qualcomm-releases-details-on-chip.html
آخرین نمونه ها از تلاش برای جاسوسی توسط دولت ها از طریق گوگل و اپل روی گوشی کاربران
#آکادمی_روزبه
https://www-cnbc-com.cdn.ampproject.org/c/s/www.cnbc.com/amp/2023/12/06/apple-and-google-phone-users-spied-on-through-phone-push-notifications.html
#آکادمی_روزبه
https://www-cnbc-com.cdn.ampproject.org/c/s/www.cnbc.com/amp/2023/12/06/apple-and-google-phone-users-spied-on-through-phone-push-notifications.html
CNBC
Governments are spying on Apple and Google users through phone notifications, U.S. senator says
U.S. Sen. Ron Wyden warned that foreign governments are spying on smartphone users by compelling Apple and Google to turn over push notification records
تحلیل بد افزار ی هفته
کاری از تیم تحقیق اسپلانک
#آکادمی_روزبه
https://www.splunk.com/en_us/blog/security/unmasking-the-enigma-a-historical-dive-into-the-world-of-plugx-malware.html
کاری از تیم تحقیق اسپلانک
#آکادمی_روزبه
https://www.splunk.com/en_us/blog/security/unmasking-the-enigma-a-historical-dive-into-the-world-of-plugx-malware.html
Splunk
Unmasking the Enigma: A Historical Dive into the World of PlugX Malware | Splunk
The Splunk Threat Research Team (STRT) unravels the mystery of a PlugX variant, peeling back the layers of its payload, tactics, and impact on the digital realm.
شکسته شدن مکانیزم های حفاظتی ChatGPT-4 و نظایر آن و اخذ پاسخ به پرسش های حساس نظیر نحوه ساختن بمب !
#آکادمی_روزبه
https://www.robustintelligence.com/blog-posts/using-ai-to-automatically-jailbreak-gpt-4-and-other-llms-in-under-a-minute
#آکادمی_روزبه
https://www.robustintelligence.com/blog-posts/using-ai-to-automatically-jailbreak-gpt-4-and-other-llms-in-under-a-minute
مقاله کردنشیال دامپینگ از مایکروسافت
#آکادمی_روزبه
https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
#آکادمی_روزبه
https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
Microsoft News
Detecting and preventing LSASS credential dumping attacks
LSASS credential dumping is becoming prevalent, especially with the rise of human-operated ransomware. In May 2022, Microsoft participated in an evaluation conducted by AV-Comparatives specifically on detecting and blocking this attack technique and we’re…
اونهایی که میگن لینوکس ویروس نداره بخونن
A previously unknown Linux remote access trojan called Krasue has been observed targeting telecom companies in Thailand by threat actors to main covert access to victim networks at lease since 2021.
#آکادمی_روزبه
https://thehackernews.com/2023/12/new-stealthy-krasue-linux-trojan.html
A previously unknown Linux remote access trojan called Krasue has been observed targeting telecom companies in Thailand by threat actors to main covert access to victim networks at lease since 2021.
#آکادمی_روزبه
https://thehackernews.com/2023/12/new-stealthy-krasue-linux-trojan.html
انجام تنظیمات ایجنت های wazuh بصورت متمرکز با انسیبل
#آکادمی_روزبه
https://wazuh.com/blog/configuration-management-endpoints-using-ansible/
#آکادمی_روزبه
https://wazuh.com/blog/configuration-management-endpoints-using-ansible/
Wazuh
Configuration management of Wazuh endpoints using Ansible | Wazuh
Configuration management is the process of maintaining computer systems, servers, network devices, and software in a desired state.
آشنایی با CAPA ؛ ابزاری برای تحلیل بدافزار مقدماتی
#آکادمی_روزبه
https://medium.com/mii-cybersec/capa-for-triage-malware-analysis-4f99431ff08f
#آکادمی_روزبه
https://medium.com/mii-cybersec/capa-for-triage-malware-analysis-4f99431ff08f
Medium
CAPA for Triage Malware Analysis
What is Capa?
حمله ای جدید
از دست رفتن اکتیو دایرکتوری
#آکادمی_روزبه
These attacks could allow attackers to spoof sensitive DNS records, resulting in varying consequences from credential theft to full Active Directory domain compromise. The attacks don't require any credentials, and work with the default configuration of Microsoft DHCP server.
https://www.akamai.com/blog/security-research/spoofing-dns-by-abusing-dhcp?filter=123
از دست رفتن اکتیو دایرکتوری
#آکادمی_روزبه
These attacks could allow attackers to spoof sensitive DNS records, resulting in varying consequences from credential theft to full Active Directory domain compromise. The attacks don't require any credentials, and work with the default configuration of Microsoft DHCP server.
https://www.akamai.com/blog/security-research/spoofing-dns-by-abusing-dhcp?filter=123
Akamai
Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates | Akamai
Akamai researchers discovered a new set of attacks against Active Directory (AD) using Microsoft DHCP servers that can lead to full AD takeover.
استفاده IBM از GenAI در QRadar SIEM
#آکادمی_روزبه
https://www.darkreading.com/emerging-tech/generative-ai-takes-on-siem
#آکادمی_روزبه
https://www.darkreading.com/emerging-tech/generative-ai-takes-on-siem
Dark Reading
Generative AI Takes on SIEM
خطر
کد اثبات (POC) آسیب پذیری زیر منتشر شد
#آکادمی_روزبه
https://securityonline.info/poc-exploit-for-windows-ntlm-privilege-escalation-flaw-cve-2023-21746-published/
کد اثبات (POC) آسیب پذیری زیر منتشر شد
#آکادمی_روزبه
https://securityonline.info/poc-exploit-for-windows-ntlm-privilege-escalation-flaw-cve-2023-21746-published/
Daily CyberSecurity
PoC Exploit for Windows NTLM Privilege Escalation Flaw (CVE-2023-21746) Published
Two security researchers Andrea Pierini & Antonio Cocomazzi announced the release of PoC exploits code targeting the CVE-2023-21746 flaw