مقاله زیبای امشب برای تیمهای آبی
#آکادمی_روزبه
**اجباری برای هرکه در SOC کار میکند
https://medium.com/foxio/ja4t-tcp-fingerprinting-12fb7ce9cb5a
#آکادمی_روزبه
**اجباری برای هرکه در SOC کار میکند
https://medium.com/foxio/ja4t-tcp-fingerprinting-12fb7ce9cb5a
Medium
JA4T: TCP Fingerprinting
And How to Use It to Identify Malicious Traffic
دور خوردن وف که سازمان به داشتن آن افتخار میکند و لاگ آنرا در SOC پایش میکند
#آکادمی_روزبه
برای کشف درخصوص این نفوذ ها چه میکنید؟
https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2
#آکادمی_روزبه
برای کشف درخصوص این نفوذ ها چه میکنید؟
https://medium.com/@allypetitt/5-ways-i-bypassed-your-web-application-firewall-waf-43852a43a1c2
Medium
5 Ways I Bypassed Your Web Application Firewall (WAF)
Introduction
وقتی سرتیفیکیت سرویس اکتیو دایرکتوری مورد سوء استفاده قرار گیرد
#آکادمی_روزبه
https://posts.specterops.io/adcs-attack-paths-in-bloodhound-part-2-ac7f925d1547
#آکادمی_روزبه
https://posts.specterops.io/adcs-attack-paths-in-bloodhound-part-2-ac7f925d1547
Medium
ADCS Attack Paths in BloodHound — Part 2
In this blog post, we will cover how we have incorporated the Golden Certificates and the ADCS ESC3 abuse technique in BloodHound.
اگر در SOC این روزها شاهد ترافیک بالای NTLM هستید بدانید بخاطر یک بروزرسانی مایکروسافت است که مایکروسافت در تلاش است این به روزرسانی را به روزرسانی کند !!
#آکادمی_روزبه
https://learn.microsoft.com/en-gb/windows/release-health/status-windows-server-2022#3292msgdesc
#آکادمی_روزبه
https://learn.microsoft.com/en-gb/windows/release-health/status-windows-server-2022#3292msgdesc
Docs
Windows Server 2022 known issues and notifications
View announcements and review known issues and fixes for Windows Server 2022
لینک های آموزشی در حوزه مهندسی معکوس
#آکادمی_روزبه
https://www.linkedin.com/posts/felipe-carvalho-01a8b1280_pentesting-bugbounty-bugbountytips-activity-7192123403032494080-eIo2?utm_source=share&utm_medium=member_android
#آکادمی_روزبه
https://www.linkedin.com/posts/felipe-carvalho-01a8b1280_pentesting-bugbounty-bugbountytips-activity-7192123403032494080-eIo2?utm_source=share&utm_medium=member_android
Linkedin
#pentesting #bugbounty #bugbountytips #kalilinux #hacking #hacker #share… | Felipe Carvalho
Reverse Engineering Tools and Study Guide.
SHARE. Don't be selfish, don't think only of yourself
✔ X86 Architecture.
1-https://lnkd.in/eT5knGmh
2-https://lnkd.in/eSA4YZHK
3-https://lnkd.in/eMjWJTzV
4-https://lnkd.in/eHp8GsUW
✔X64 Architecture
1-htt…
SHARE. Don't be selfish, don't think only of yourself
✔ X86 Architecture.
1-https://lnkd.in/eT5knGmh
2-https://lnkd.in/eSA4YZHK
3-https://lnkd.in/eMjWJTzV
4-https://lnkd.in/eHp8GsUW
✔X64 Architecture
1-htt…
یکی از مدرن ترین C2 ها همراه با دور زدن آنتی ویروس و EDR
#آکادمی_روزبه
https://medium.com/@sam.rothlisberger/havoc-c2-with-av-edr-bypass-methods-in-2024-part-1-733d423fc67b
#آکادمی_روزبه
https://medium.com/@sam.rothlisberger/havoc-c2-with-av-edr-bypass-methods-in-2024-part-1-733d423fc67b
Medium
Havoc C2 with AV/EDR Bypass Methods in 2024 (Part 1)
Havoc C2 with AV/EDR Bypass Methods in 2024 (Part 1) DISCLAIMER: Using these tools and methods against hosts that you do not have explicit permission to test is illegal. You are responsible for any …
بررسی یک حمله گروه هکری APT28 از ابتدا تا تسلط کامل
#آکادمی_روزبه
https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf
#آکادمی_روزبه
https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf
Medium
APT28: From Initial Damage to Domain Controller Threats in an Hour (CERT-UA#8399)
Translation of the CERT-UA Alert and Technical Analysis
exploit.education provides a variety of resources that can be used to learn about vulnerability analysis, exploit development, software debugging, binary analysis, and general cyber security issues.
#آکادمی_روزبه
http://exploit.education/
#آکادمی_روزبه
http://exploit.education/
شرحی بر نحوه نفوذ به MITRE و نحوه مدیریت آن
#آکادمی_روزبه
https://medium.com/mitre-engenuity/technical-deep-dive-understanding-the-anatomy-of-a-cyber-intrusion-080bddc679f3
#آکادمی_روزبه
https://medium.com/mitre-engenuity/technical-deep-dive-understanding-the-anatomy-of-a-cyber-intrusion-080bddc679f3
Medium
Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion
MITRE’s experiences detecting and responding to a nation-state cyber threat actor incident in our research and experimentation network
رویداد های لینوکس را بهتر تحلیل کنیم
#آکادمی_روزبه
https://www.socinvestigation.com/linux-event-logs-and-its-record-types-detect-respond/
#آکادمی_روزبه
https://www.socinvestigation.com/linux-event-logs-and-its-record-types-detect-respond/
Security Investigation - Be the first to investigate
Linux Event Logs and Its Record Types – Detect & Respond - Security Investigation
The word "auditing" is used in most technologies in a variety of contexts. As a SOC analyst, I hear the term "log auditing" at least a dozen times throughout a work shift. Mostly it will be related to Linux audit logs. The Linux Audit system is a useful feature…
هانت حرکت عرضی با SMB
#آکادمی_روزبه
https://bherunda.medium.com/hunting-detecting-smb-named-pipe-pivoting-lateral-movement-b4382bd1df4
#آکادمی_روزبه
https://bherunda.medium.com/hunting-detecting-smb-named-pipe-pivoting-lateral-movement-b4382bd1df4
Medium
Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement)
Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement) With SMB traffic being ubiquitous in enterprise networks, adversaries and Offensive Security Tools can abuse pivoting over SMB named …