چرا در طراحی ساختار امنیتی سازمان باید برنامه هوش تهدید سایبری جدی گرفته شود؟
#آکادمی_روزبه
https://correlatedsecurity.com/why-cyber-threat-intelligence-informed-security-operations-is-important/
#آکادمی_روزبه
https://correlatedsecurity.com/why-cyber-threat-intelligence-informed-security-operations-is-important/
نسل جدید WAF با قابلیت یادگیری ماشینی
#آکادمی_روزبه
https://youtu.be/al0Cua8FPp8?si=NFpuLQbiLjGBLIDn
#آکادمی_روزبه
https://youtu.be/al0Cua8FPp8?si=NFpuLQbiLjGBLIDn
YouTube
open-appsec WAF machine learning deep dive
In this video Christopher Lutat, open-appsec Product Manager provides a deep deep dive into the inner mechanics of open-appsec contextual machine learning engine.
For additional details refer to the White Paper - https://www.openappsec.io/whitepaper
For additional details refer to the White Paper - https://www.openappsec.io/whitepaper
مایند مپ وایرشارک
با کیفیت
#آکادمی_روزبه
https://github.com/Ignitetechnologies/Mindmap/tree/main/Wireshark
با کیفیت
#آکادمی_روزبه
https://github.com/Ignitetechnologies/Mindmap/tree/main/Wireshark
GitHub
Mindmap/Wireshark at main · Ignitetechnologies/Mindmap
This repository will contain many mindmaps for cyber security technologies, methodologies, courses, and certifications in a tree structure to give brief details about them - Ignitetechnologies/Mindmap
خروجی اکسل از ATT&CK را تجربه کنید
#آکادمی_روزبه
https://attack.mitre.org/resources/working-with-attack/
#آکادمی_روزبه
https://attack.mitre.org/resources/working-with-attack/
چطور مشکلات آموزش سایبری و آموزش کاربران رو بهتر کنیم ؟
#آکادمی_روزبه
https://securityintelligence.com/articles/why-cybersecurity-training-isnt-working-and-how-to-fix-it/
#آکادمی_روزبه
https://securityintelligence.com/articles/why-cybersecurity-training-isnt-working-and-how-to-fix-it/
Security Intelligence
Why cybersecurity training isn’t working (and how to fix it)
Don’t look now, but cybersecurity training isn’t good enough. Here's what it tends to get wrong, and how to get it right.
سرمایه گذاری ۵ بیلیون دلاری مایکروسافت در استرالیا برای ارتقای امنیت
#آکادمی_روزبه
https://www-csoonline-com.cdn.ampproject.org/c/s/www.csoonline.com/article/656781/microsoft-leads-the-build-of-australias-cyber-shields.html/amp/
#آکادمی_روزبه
https://www-csoonline-com.cdn.ampproject.org/c/s/www.csoonline.com/article/656781/microsoft-leads-the-build-of-australias-cyber-shields.html/amp/
CSO Online
Microsoft leads the build of Australia’s cyber shields
Microsoft announced a $5 billion investment over two years in Australia that will see the vendor collaborate with the Australian Signals Directorate on the cyber shields’ initiative.
In-depth investigation and analysis of the Active Directory with ADRecon!
https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting/blob/main/Different_hunting_methods/In-depth_investigation_active_directory.md
https://github.com/tomwechsler/Active_Directory_Advanced_Threat_Hunting/blob/main/Different_hunting_methods/In-depth_investigation_active_directory.md
GitHub
Active_Directory_Advanced_Threat_Hunting/Different_hunting_methods/In-depth_investigation_active_directory.md at main · tomwec…
This repo is about Active Directory Advanced Threat Hunting - tomwechsler/Active_Directory_Advanced_Threat_Hunting
بدافزاری برای لینوکس و ویندوز
بنا بر نظر کسپرسکی ، با توجه به پیچیده بودن آن ، احتمالا APT میباشد
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/stripedfly-malware-framework-infects-1-million-windows-linux-hosts/amp/
بنا بر نظر کسپرسکی ، با توجه به پیچیده بودن آن ، احتمالا APT میباشد
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/stripedfly-malware-framework-infects-1-million-windows-linux-hosts/amp/
www-bleepingcomputer-com.cdn.ampproject.org
StripedFly malware framework infects 1 million Windows, Linux hosts
A sophisticated cross-platform malware platform named StripedFly flew under the radar of cybersecurity researchers for five years, infecting over a million Windows and Linux systems during that time.
دات نت ۷ و تعامل بهتر در حوزه رمزنگاری
#آکادمی_روزبه
https://medium.com/asecuritysite-when-bob-met-alice/c-net-7-and-aes-gcm-a9ba34b49369
#آکادمی_روزبه
https://medium.com/asecuritysite-when-bob-met-alice/c-net-7-and-aes-gcm-a9ba34b49369
Medium
C# (.NET 7) and AES GCM
.NET is a standard software platform that manages executable code. With .NET 7, Microsoft further advanced their .NET Core infrastructure…
حفاظت در برابر حمله DCSync
اکتیو دایرکتوری خود را مقاوم بسازید
#آکادمی_روزبه
https://www.sentinelone.com/blog/active-directory-dcsync-attacks/
اکتیو دایرکتوری خود را مقاوم بسازید
#آکادمی_روزبه
https://www.sentinelone.com/blog/active-directory-dcsync-attacks/
SentinelOne
DCSync Attack Protection Against Active Directory
A well-known credential dumping technique allows attackers to siphon Active Directory credentials. Learn how this attack works & how to detect it.
یک رایت آپ بخوانیم
سطح : متوسط
تهیه و اجرای C2 با استفاده از HTA فایل
**بدلیل همین استفاده های نابجا از VBscript، مایکروسافت پشتیبانی از آنرا دیگر انجام نمیدهد
** این رایت آپ امکان پیچیده تر شدن در چند مرحله دارد نظیر درهم سازی دستور پاورشل
https://bhaveshl.medium.com/cobalt-strike-hta-files-b06f778570df
سطح : متوسط
تهیه و اجرای C2 با استفاده از HTA فایل
**بدلیل همین استفاده های نابجا از VBscript، مایکروسافت پشتیبانی از آنرا دیگر انجام نمیدهد
** این رایت آپ امکان پیچیده تر شدن در چند مرحله دارد نظیر درهم سازی دستور پاورشل
https://bhaveshl.medium.com/cobalt-strike-hta-files-b06f778570df
Medium
Cobalt Strike & .HTA files
As per Mitre ATT&CK, ID S0154 tracks Cobalt Strike as a “commercial, full-featured, remote access tool that bills itself as “adversary…
گزارش تحلیلی بدافزار
#آکادمی_روزبه
https://securityscorecard.com/research/apt28s-stealer-called-credomap/
#آکادمی_روزبه
https://securityscorecard.com/research/apt28s-stealer-called-credomap/
SecurityScorecard
A Deep Dive Into the APT28’s stealer called CredoMap
Initially discovered by Google and CERT-UA, CredoMap is a stealer developed by the Russian APT28/Sofacy/Fancy Bear that was used to target users in Ukraine in the context of the ongoing war between Russia and Ukraine. Learn more about this malware and how…
ویدئو هایی جدید و رایگان درخصوص SOC و IR
#آکادمی_روزبه
https://youtube.com/playlist?list=PLQ8_y8jaKwSWlkxqnEZUOihOuieN3gvbe&si=G7SU1VKDwMRuxa4L
#آکادمی_روزبه
https://youtube.com/playlist?list=PLQ8_y8jaKwSWlkxqnEZUOihOuieN3gvbe&si=G7SU1VKDwMRuxa4L
Detect WS_FTP Server Exploitation with Splunk Attack Range
recently disclosed CVE-2023-40044, which targets Progress Software WS_FTP Server Ad Hoc module, highlights the importance of providing detection developer environments where they can replicate, validate, and produce data of ongoing exploitations campaigns with the purpose of developing detections to protect their organizations.
https://www.splunk.com/en_us/blog/security/detect-ws-ftp-server-exploitation-with-splunk-attack-range.html
recently disclosed CVE-2023-40044, which targets Progress Software WS_FTP Server Ad Hoc module, highlights the importance of providing detection developer environments where they can replicate, validate, and produce data of ongoing exploitations campaigns with the purpose of developing detections to protect their organizations.
https://www.splunk.com/en_us/blog/security/detect-ws-ftp-server-exploitation-with-splunk-attack-range.html
Splunk
Detect WS_FTP Server Exploitation with Splunk Attack Range | Splunk
The Splunk Threat Research Team shares how they used Splunk Attack Range to develop detection content related to CVE-2023-40044.