If you are on the blue team side of the fence and mainly working in a financial institution, there is a high possibility that you have observed recent malspam campaigns from Qbot. This banking trojan is interesting because threat actors keep developing new Tactics, Techniques and procedures. However, with the…

During incident response, it is essential to establish a full context around the time of alert or when suspicious activity was identified. To connect the dots, a quick triage of suspected machines/hosts is required. Often within Enterprise, it’s not easy, mainly due to network complexity and multiple types of Operating…

This topic will be divided into 3 part series: Part 1 — Building the foundation (which will discuss setup splunk attack range local) Part 2 — Get one’s ducks in a row (setup linux client with osquery /basic Atomic red testing) Part 3 — Time to fly! (simulating standard techniques…

In recent times, identity service provider (IdP) attacks have surged, impacting even major providers like Okta, Cloudflare, and Microsoft Azure AD. Microsoft has shared a highly informative article that delves into various identity-based attacks and preventive measures. It’s a must-read: Read the article here. However, in this blog post, we’ll…