From Sigma to Scale: Enhancing SIEM Detection Engineering in Cloud Environments

- Posted in Hardenings by
Background: It's no surprise that even security tools require maintenance, especially when scaling. Based on your chosen strategy, security detection engineers should review their environment every [...] Read more

T1590.001: Exposed Domain Registration Records – A Tool for Both Threat Actors and Cyber Defenders

- Posted in Hardenings by
Background: Before coming across this shared article, I noticed an interesting correlation: sometimes, domain registrar customers forget to enable email privacy. Once this oversight is discovered, [...] Read more

Abusing Trusted Relationships (T1199): Delivering Malicious Emails by Compromising Historical Recipients

- Posted in Threat Analyze by
Background: From time to time, the infosec community observes trends where threat actors abuse Trusted Relationships (T1199) to deliver malware to known recipients. This technique exploits the fact [...] Read more

Silent Intrusion: Sophisticated Threat Actor Exploits Fake Job Offers and Video Calls for Malware Delivery

- Posted in Threat Analyze by
Background: In one of my previous articles, I covered the challenges associated with fake job interviews. This type of attack has also been leveraged by highly sophisticated groups. I would like to [...] Read more

Identifying the Root Cause of Cybersecurity Incidents Involving Exploit Detonation on Windows Machines

- Posted in Incident Response by
Background: During the incident response stage of "Log Collection," it is highly valuable to collect comprehensive data from the servers, especially when the affected system is running Windows OS. [...] Read more

Case Study: Tackling Extension Infections with a Budget-Friendly Scratch Project

- Posted in Threat Analyze by
Backgound: Following a notification from a company that fell victim to a supply chain attack, where attackers compromised their Chrome extension, I realized the importance of addressing this issue. [...] Read more

When APTs Knock on Your Wi-Fi: Real-World Lessons for Better Security

- Posted in Other by
Background: Recently, I came across a notification about a highly targeted attack against a U.S. company, where the attacker exploited a neighboring network to perform lateral movement into the [...] Read more

Strategies for Discovering C2 Servers During the Incident Response Log Collection and Analyze Stage

- Posted in Other by
Background: During malware analysis on assets, one of the best approaches is not only to focus on identifying the exact malware but also to look for signs of other malware based on external calls [...] Read more

Tracking Seized Domains: Checking Your Environment for Harmful Domain IOCs

- Posted in Threat Analyze by
Background: It’s no secret that international law enforcement agencies periodically seize domains linked to cyber threats, criminal activities, and other harmful purposes. Every cybersecurity [...] Read more

Weaponizing Trust: The Fight Against Signed Malicious Code

- Posted in Other by
Background: During the MITRE ATT&CK Initial Access stage (T1199), attackers often impersonate trusted sources to gain a foothold in the target environment. By originating their activities from [...] Read more
Page 8 of 11