Threat Hunting

“CVE-2023–23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server on an untrusted network. No user interaction is required. …

“Hope is an expensive commodity. It makes better sense to be prepared.” 460 to 400 BCE Thucydides Why you need a Threat-Informed Defense Campaign Plan to operationalize your cybersecurity strategy based on Zero-Trust and Cyber Resiliency. Strategy — a plan of action or policy designed to achieve a major or…

This Windows forensics challenge is provided by the Let’sDefend platform. Happy Investigating and analyzing! Getting Started to LetsDefend Register to soc analyst/incident response training platformapp.letsdefend.io What is Windows Forensics Analysis? This is commonly used in the investigation of cybercrime, fraud, or other types of computer-related incidents. Windows Forensics involves an in-depth analysis of the Windows Operating System and Windows System artifacts…

By Laiali Kazalbach and Mohamed Elsayed Technical requirements VMware Workstation with at least 6 GB of RAM, 6 CPU cores, and a 70 GB SSD available to Virtual Machine (VM) guests. Build a CentOS VM (Will be called Elastic Machine) Use NAT as a Network Adapter NOTE: Before moving any forward run…

In this tutorial we will learn about TryHackMe room on OpenCTI. To practice OpenCTI you can visit the room. Room OverView This room is all about the basics of OpenCTI. OpenCTI is a free, open-source threat intelligence management & sharing platform. You have to have basic knowledge about MITRE ATT&CK Framework, TheHive…

By Cyborg Security Artificial Intelligence (AI) has been touted as the future of cybersecurity, and rightly so. With the growing volume and sophistication of cyber threats, cyber analysts are finding it challenging to keep up. As a result, AI has become an integral part of cybersecurity operations, providing faster and…

Part 1: Linux auditd for Threat Detection [Part 1] Part 2: Linux auditd for Threat Detection [Part 2] This will be the last of the series and IMO, the most interesting one. I highly recommend reading part 1 & 2 before reading this. The focus of this article will be…