Hello everyone, I hope everything is going well in your life journey!!! Here is my research and writeup, let’s analyze malware traffic DNS tunnelling, which is provided by Activecountermeasures LAB environment: Seed Ubuntu 20.04 Security Tools: Wireshark, Brim Security, RITA (Real Intelligence Threat Analytics), Zeek Network Security Monitor Framework: MITRE…

Let’s analyze a compromised system infected by the uncovered worm “Stuxnet” in 2010. The infect memory is provided here. What is Stuxnet? In MITRE ATT&CK S0603, Stuxnet exploited vulnerabilities in the Windows operating system and Siemens software used in industrial control systems. Its discovery caused a major controversy, as it was the first…

Let’s hunt threats within an Active Directory, which utilizes Splunk SIEM solution to uncover the attacker’s steps and techniques while creating a timeline of their activities. FalconEye Blue team challenge. CyberDefenders is a blue team training platform for SOC analysts, threat hunters, DFIR, and security blue teams to…cyberdefenders.org Threats involve DCsync attack and Pass the Hash attack. How does a DCsync attack work?

The purpose of building the fake network is to capture malware C & C server communication or behaviour for dynamic malware analysis purposes. The fake network allows the malware to connect to the designated machine without connecting to the Internet. Environment: REMnux (Monitor Machine), Flare VM (Malware Machine) Configuration: We…

This article shows how to install Flare VM, a Windows-based security distribution, which includes a comprehensive collection of Windows security tools such as debuggers, disassemblers, decompilers, static and dynamic analysis utilities, network analysis and many others. Installation Flare VM over Windows Image Step 1: We can get multiple Windows version images from this official…

Hey Cyber Warriors!!! Hope everyone is doing and keeping well. This article explains my journey for this Blue Team Level 1, which is provided by Security Blue Team Blue Team Level 1 is a 24-hour incident response exam that is completed with 20 task-based/CTF-like questions via a cloud environment. Blue Team Level 1 (BTL1) was issued by the Security Blue Team to Wen Lun Hsu. Earners of the Blue Team Level 1 Certification have showcased their practical ability to defend networks and systems…www.credly.com

Hello everyone, we’re going to investigate a digital forensics challenge provided by the Cyberdefender platform. CyberCorp Case 1 Blue team challenge. CyberDefenders is a blue team training platform for SOC analysts, threat hunters, DFIR, and security blue teamscyberdefenders.org LAB Environment: Windows Sandbox, Eric Zimmerman, oletools, MiTeC WRR, Volatility Why and what is DFIR? Digital Forensics and Incident Response is to uncover and understand the nature and extent of security breaches, data breaches, cyberattacks…

I hope everyone goes well, let’s investigate the network traffic provided by the Cyberdefenders platform. I then do reverse engineering with malware within the PCAP file and analyze malware further via the tools. HawkEye Blue team challenge. CyberDefenders is a blue team training platform for SOC analysts, threat hunters, DFIR, and security blue teams to…cyberdefenders.org LAB Environment: REMnux, Wireshark, BrimSecurity, NetworkMiner

Let’s hunt a real case of a cybersecurity incident. Threat hunting is a proactive action to identify threats within organizations. CyberCorp Case 2 Blue team challenge. Instructions: Unzip the VM (pass: cyberdefenders.org), import to VirtualBox, login to VM with (pass: cyberpolygon), and…cyberdefenders.org Scenario After a cybersecurity incident, CyberCorp’s management decided to purchase and deploy EDR (Endpoint Detection and Response) solution. …