مروری کوتاه بر لاگهای لینوکس

#آکادمی_روزبه

دو مقاله ی خوش نوشت از فورستر در مورد بحران CrowdStrike

#آکادمی_روزبه

https://www.forrester.com/blogs/the-crowdstrike-moment-calls-for-a-redefinition-of-business-resilience/

خلاصه ای از دست نوشته ها از مفاهیم SOC

#آکادمی_روزبه

در مصاحبه تیم قرمز چه میپرسند؟

#آکادمی_روزبه

https://github.com/HadessCS/Red-team-Interview-Questions

گزارش خوب بخوانیم

دور زدن اسمارت اسکرین ویندوز توسط گروه های APT


#آکادمی_روزبه

**مطالعه این گزارشات یکی از روتین های لایه ۲ و ۳ مرکز عملیات است

https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed

good template for BCP & DRP

@Kasysco

پیشنهاد برای آموزش دوره های ISMS و BCP

از جمله روشهای آنتی فارنزیک

پراکسی کردن سیستم کال

**البته هنوز ردپاهایی باقی می‌ماند


#آکادمی_روزبه

https://medium.com/@nisaprmst/syscall-proxy-a-way-to-minimize-footprint-e7305efbfc5b

آزمایشگاه امنیت

امنیت در کوبرنتیس


#آکادمی_روزبه

https://madhuakula.com/kubernetes-goat/docs/

آنتی فارنزیک در حافظه

از جناب علیرضا تقی خانی

#آکادمی_روزبه

https://medium.com/@alirezataghikhani1998/memory-analysis-against-anti-forensics-methods-22dd2c37f2a

سرتیفیکیت بیش از ۸۳ هزار دامین چرا باطل می‌شود؟


#آکادمی_روزبه

https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html

از chatGPT بهینه استفاده کنیم

مثال : سوال

As a forensic expert , Explain system call

جواب :

A system call is an essential mechanism that allows user-level processes to request services from the operating system's kernel. These services can include tasks like accessing hardware, managing files, allocating memory, or creating and managing processes. Here’s a detailed breakdown of system calls from a forensic expert's perspective:

### Basic Concept

1. Definition: A system call is a controlled entry point that allows a program to request a service from the operating system's kernel.
2. Purpose: It provides an interface between user-space applications and the kernel, enabling them to perform operations that require higher privileges.

### Categories of System Calls

System calls can be broadly categorized based on their functionality:

1. Process Control: Creating and managing processes (e.g., fork(), exec(), wait(), exit()).
2. File Management: Handling files and directories (e.g., open(), read(), write(), close(), unlink()).
3. Device Management: Interacting with hardware devices (e.g., ioctl(), read(), write()).
4. Information Maintenance: Gathering and setting system information (e.g., getpid(), alarm(), sleep()).
5. Communication: Facilitating inter-process communication (e.g., pipe(), shmget(), msgsnd(), recv()).

### System Call Lifecycle

1. Invocation: A system call is typically invoked by a user-level process through a library function (e.g., the C standard library).
2. Transition to Kernel Mode: The CPU switches from user mode to kernel mode to execute the system call. This transition is often triggered by a software interrupt or trap.
3. Kernel Execution: The kernel executes the requested service using its internal resources and privileged instructions.
4. Return to User Mode: The results of the system call are returned to the user process, and the CPU switches back to user mode.

### Forensic Relevance

From a forensic perspective, understanding system calls is crucial for several reasons:

1. Activity Monitoring: System calls provide insights into what a process is doing. By monitoring system calls, forensic experts can track file access, process creation, and other critical activities.
2. Malware Analysis: Malicious software often relies on system calls to perform its actions. By analyzing the sequence of system calls, experts can understand the behavior of malware.
3. Incident Response: During an incident, system call logs can help reconstruct the events leading up to the security breach.
4. Digital Evidence: System call traces can serve as digital evidence in investigations, revealing unauthorized access or data manipulation.

### Tools and Techniques

1. Strace: A widely used tool in Unix-like systems to trace system calls made by a process.
2. Auditd: The Linux Auditing System, which can log system calls for security monitoring and compliance purposes.
3. Sysmon: A Windows system service that logs system calls and other system events for detailed monitoring.

### Example

Here’s a simple example of how a system call works:

#include <unistd.h>
#include <stdio.h>

int main() {
    char buffer[128];
    int bytesRead;

    // System call: read from standard input (file descriptor 0)
    bytesRead = read(0, buffer, 128);

    // System call: write to standard output (file descriptor 1)
    write(1, buffer, bytesRead);

    return 0;
}

In this C program:
- The read() system call reads data from the standard input.
- The write() system call writes data to the standard output.

By understanding and analyzing such system calls, forensic experts can gain insights into the actions performed by processes on a system.

#آکادمی_روزبه

گزارش خوب و فنی بخوانیم

تحلیل رفتاری گروه UNC4393


#آکادمی_روزبه

https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight?linkId=10528541

پیرو مقالات هانت

تغییر نام پراسس ها در لینوکس برای غیر مشکوک سازی

#آکادمی_روزبه

https://doubleagent.net/process-name-stomping/

راهنمای مرور امنیت کد از OWASP

#آکادمی_روزبه

فارنزیک و داکر


قسمت ۴

#آکادمی_روزبه

https://youtu.be/jvSVwGzvMhM

برای رسیدن به محرمانگی هنگام استفاده از LLM ها
میتوانید از لینک زیر برای خود لوکال LLM بالا بیاورید
حوزه استفاده : مهندسی معکوس

Core Features

Offline Operation: Runs LLMs entirely on local CPU/GPU, ensuring data privacy and security.

Automatic Function Naming: Automatically suggests semantically meaningful function names from decompiler output.

Binary Ninja Integration: Seamlessly integrates as a plugin with Binary Ninja.

Modular Architecture: Designed for easy extension to support other reverse engineering tools like IDA and Ghidra.

Consumer Hardware Compatibility: Optimized to run on consumer-grade hardware, such as Apple silicon architectures.

Enhanced AI with Static Analysis: Improves AI-based analysis and suggestions by incorporating insights from static analysis, providing a richer context and more accurate results.


https://github.com/mrphrazer/reverser_ai

تهدیدات ریز پرنده ها


#آکادمی_روزبه

https://www.asisonline.org/security-management-magazine/articles/2023/05/uncrewed-aerial-systems/security-implications-drones/

چند دستور جالب از سوریکاتا

#آکادمی_روزبه