Mitre Attack

In the “New Hire Old Artifacts” TryHackMe room, we can investigate a cyber incident using SIEM software — Splunk. The logs provided to Splunk were generated by a utility called Sysmon. This article explores the methodology of investigating action performed by malicious binaries on a SIEM platform through Sysmon Event…

Besides tracking and analyzing new threats, an important task threat intelligence analysts work on is that of ‘attribution’, i.e. figuring out which hacker group may be most likely responsible for a certain attack by checking their ‘modus operandi’, which is Latin for identifying someone’s working style and patterns. …

Hi Medium! Here we are again with a new article about Sentinel this is the follow-up (part 2) to the previous article Detect FIN6 on Sentinel Part 1: Run FIN6 exploit. This article To give a summary of the previous article, we created our lab environment and simulated the FIN6…

Why Bugs Can Reappear After A Patch — Patches can be incomplete (band aid) i.e patched released in rush, lack of resources, old software not designed to be secure Vulnerability may exist elsewhere in code but has not been discovered e.g patch may break the execution flow of the exploit that was found but doesn’t get to root cause of Vulnerability so there may be other paths to trigger the exploit.

ATT&CK + D3FEND = D.E.A.T.H Detection Engineering And Threat Hunting The MITRE D3FEND matrix explains terminology of defensive cybersecurity techniques and how they relate to offensive methods. MITRE is a world-renowned research organization that aims to help build a safer world. It is probably best known in the information security…

A Roadmap of 2023’s key efforts: From ICS Assets to more Linux and ATT&CKcon 4.0. — It’s 2023 and we’re all a little older, including ATT&CK, which will be celebrating its 8th (!) release anniversary in a few short months. Last year we matured, expanded, deconflicted, and renovated the knowledge base, persevering through challenges to meet our 2022 goals. Some of our most notable efforts including…

Cyber Security Basics: Attack Frameworks Attack Frameworks are publicly available models from public/private organisations that identify and highlight attacks and attackers methods. This article will focus on three different attack frameworks: the Lockheed Martin Kill Chain, the MITRE ATT&CK Framework and the Diamond Model of Intrusion Analysis. Kill Chain Developed…