بررسی یک حمله گروه هکری APT28 از ابتدا تا تسلط کامل
#آکادمی_روزبه
https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf
#آکادمی_روزبه
https://medium.com/cyberscribers-exploring-cybersecurity/apt28-from-initial-damage-to-domain-controller-threats-in-an-hour-cert-ua-8399-1944dd6edcdf
Medium
APT28: From Initial Damage to Domain Controller Threats in an Hour (CERT-UA#8399)
Translation of the CERT-UA Alert and Technical Analysis
exploit.education provides a variety of resources that can be used to learn about vulnerability analysis, exploit development, software debugging, binary analysis, and general cyber security issues.
#آکادمی_روزبه
http://exploit.education/
#آکادمی_روزبه
http://exploit.education/
شرحی بر نحوه نفوذ به MITRE و نحوه مدیریت آن
#آکادمی_روزبه
https://medium.com/mitre-engenuity/technical-deep-dive-understanding-the-anatomy-of-a-cyber-intrusion-080bddc679f3
#آکادمی_روزبه
https://medium.com/mitre-engenuity/technical-deep-dive-understanding-the-anatomy-of-a-cyber-intrusion-080bddc679f3
Medium
Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion
MITRE’s experiences detecting and responding to a nation-state cyber threat actor incident in our research and experimentation network
رویداد های لینوکس را بهتر تحلیل کنیم
#آکادمی_روزبه
https://www.socinvestigation.com/linux-event-logs-and-its-record-types-detect-respond/
#آکادمی_روزبه
https://www.socinvestigation.com/linux-event-logs-and-its-record-types-detect-respond/
Security Investigation - Be the first to investigate
Linux Event Logs and Its Record Types – Detect & Respond - Security Investigation
The word "auditing" is used in most technologies in a variety of contexts. As a SOC analyst, I hear the term "log auditing" at least a dozen times throughout a work shift. Mostly it will be related to Linux audit logs. The Linux Audit system is a useful feature…
هانت حرکت عرضی با SMB
#آکادمی_روزبه
https://bherunda.medium.com/hunting-detecting-smb-named-pipe-pivoting-lateral-movement-b4382bd1df4
#آکادمی_روزبه
https://bherunda.medium.com/hunting-detecting-smb-named-pipe-pivoting-lateral-movement-b4382bd1df4
Medium
Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement)
Hunting & Detecting SMB Named Pipe Pivoting (Lateral Movement) With SMB traffic being ubiquitous in enterprise networks, adversaries and Offensive Security Tools can abuse pivoting over SMB named …
دستوری با کاربرد فراوان
#آکادمی_روزبه
خیلی در تیم CERT به کار میاد
https://evotec-pl.cdn.ampproject.org/c/s/evotec.pl/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/amp/
#آکادمی_روزبه
خیلی در تیم CERT به کار میاد
https://evotec-pl.cdn.ampproject.org/c/s/evotec.pl/the-only-powershell-command-you-will-ever-need-to-find-out-who-did-what-in-active-directory/amp/
Evotec
The only PowerShell Command you will ever need to find out who did what in Active Directory - Evotec
While the title of this blog may be a bit exaggeration, the command I'm trying to show here does it's best to deliver on the promise. What you're about to witness here is something I've worked on for a while now, and it meets my basic needs. If you don't…
مقاله ای جالب در خصوص تشخیص حملات در لینوکس با فعال سازی لاگ Auditd
#آکادمی_روزبه
https://izyknows.medium.com/linux-auditd-for-threat-detection-final-9d5173706b3f
#آکادمی_روزبه
https://izyknows.medium.com/linux-auditd-for-threat-detection-final-9d5173706b3f
Medium
Linux auditd for Threat Detection [Final]
Mapping behaviors to auditd log events
حواستان به خود سیسمون هم باشد و خرابی خودش را رسیدگی کنید
#آکادمی_روزبه
شماره رویداد ۲۵۵
https://systemweakness.com/list-of-sysmon-event-ids-for-threat-hunting-4250b47cd567
#آکادمی_روزبه
شماره رویداد ۲۵۵
https://systemweakness.com/list-of-sysmon-event-ids-for-threat-hunting-4250b47cd567
Medium
List of Sysmon Event IDs for Threat Hunting
Features of Sysmon:
قطعاتی از تصنیف پاورشل علیه اکتیو دایرکتوری
#آکادمی_روزبه
https://0xstarlight.github.io/posts/Offensive-powershell/
#آکادمی_روزبه
https://0xstarlight.github.io/posts/Offensive-powershell/
0xStarlight
Active Directory - Offensive PowerShell
Cyber security, Red Teaming and CTF Writeup’s
seven-best-practices-for-workstation-protection.pdf
2 MB
امروزه ایستگاههای کاری کاربران یکی از لبه های شبکه و خط دفاعی شما است .
پس امنیت آنرا جدی بگیرید
۷ بهروش برای امنیت دستگاههای کاربران
#آکادمی_روزبه
پس امنیت آنرا جدی بگیرید
۷ بهروش برای امنیت دستگاههای کاربران
#آکادمی_روزبه
عصر جدید هک و فارنزیک ویندوز با ظهور Recall در ویندوز ۱۱
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/microsoft/windows-11-recall-ai-feature-will-record-everything-you-do-on-your-pc/amp/
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/microsoft/windows-11-recall-ai-feature-will-record-everything-you-do-on-your-pc/amp/
www-bleepingcomputer-com.cdn.ampproject.org
Windows 11 Recall AI feature will record everything you do on your PC
Microsoft has announced a new AI-powered feature for Windows 11 called 'Recall,' which records everything you do on your PC and lets you search through your historical activities.
داشبورد زیبا برای خروجی Nmap
#آکادمی_روزبه
در همین لینک هم میتوانید لینک داشبورد زیک را هم ملاحظه فرمایید
https://hackertarget.com/nmap-dashboard-with-grafana/
#آکادمی_روزبه
در همین لینک هم میتوانید لینک داشبورد زیک را هم ملاحظه فرمایید
https://hackertarget.com/nmap-dashboard-with-grafana/
HackerTarget.com
Nmap Dashboard Using Grafana | HackerTarget.com
Visualise Nmap Results with a detailed Dashboard built using the powerful Open Source Grafana Analytics Software.
با پسورد ها هنگام کار با پاورشل چگونه برخورد کنیم ؟
#آکادمی_روزبه
https://www.script-example.com/en-powershell-password
#آکادمی_روزبه
https://www.script-example.com/en-powershell-password
دستورات دم دستی برای مراحل اولیه فارنزیک ( پاورشل و sysinternals)
#آکادمی_روزبه
https://medium.com/@rihanmujahid46/live-windows-forensics-using-powershell-and-sysinternals-c6997e869075
#آکادمی_روزبه
https://medium.com/@rihanmujahid46/live-windows-forensics-using-powershell-and-sysinternals-c6997e869075
Medium
Live Windows Forensics using Powershell and SysInternals
Hello everyone! I’m excited to share a blog post about the DFIR module, where I’ll explore different techniques and approaches for…