Learn Kusto Query Language (KQL) for security analysis and incident response in a hyper-realistic lab environment with real logs!

Active C&C Detector. Contribute to Cyb3r-Monk/ACCD development by creating an account on GitHub.

It is possible to detect NTLM relaying using only logon events. No magic!

Contribute to awslabs/aws-automated-incident-response-and-forensics development by creating an account on GitHub.

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm. - Cyb3r-Monk/RITA-J

As I mentioned in my "detecting and responding to ransomware attacks" post, I created a hunting and detection guide using proxy logs…

Load any Beacon Object File using Powershell! Contribute to airbus-cert/Invoke-Bof development by creating an account on GitHub.

The TTPForge is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs). - facebookincubator/TTPForge

DLL hijacking (T1574) is one of the favorite techniques used by attackers. In this post, I’ll explain a method for hunting and detection

In this post, I’ll explain how to detect a successful PetitPotam or any attack in which the DC certificate is stolen and used.

As organizations continue to adopt new applications and services, more network traffic is beginning to resemble beaconing activity. Furthermore, threat actor...

DLL hijacking (T1574) is one of the favorite techniques used by attackers. In this post, I’ll explain a method for hunting and detection

Looking to advance your knowledge in Workbooks? You'll find some great content here.    

It is possible to detect NTLM relaying using only logon events. No magic!

Day 2 of the InfoSec Jupytertthon 2021 edition!An open community event for security researchers to share their experience and favorite notebooks with the inf...

Simple PowerShell script to enable process scanning with Yara. - BinaryDefense/YaraMemoryScanner

Elevate your threat hunting, detection engineering, and incident response skills with transformative KQL training courses, featuring hands-on experience in a hyper-realistic lab environment using...

Using MITRE ATT&CK framework for a better threat detection coverage

Adversarial Tradecraft in Cybersecurity: Offense versus defense in real-time computer conflict

In this post, I’ll explain how to perform threat hunting for detecting phishing links using Sysmon and KQL

Window functions can take your threat hunting and DFIR skills to a next level!

An easy and generic approach for detecting cloud account takeover attacks using KQL

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm. - Cyb3r-Monk/RITA-J

Learn Kusto Query Language (KQL) for security analysis and incident response in a hyper-realistic lab environment with real logs!

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques. Powered by Wiz Research.

In this post, I’ll explain how to detect a successful PetitPotam or any attack in which the DC certificate is stolen and used.

Mandiant conducted multiple investigations and observed techniques that attackers preferred as they conducted privilege escalation to move laterally, persist...

For enhancing digital defense by security operations center (SOC) operators, MITRE offers free downloads of 11 Strategies for a World-Class Cybersecurity Operations Center.

Using MITRE ATT&CK framework for a better threat detection coverage

This article discusses a mindset on building production-ready machine learning solutions when applied to cyber-security needs

Incorporating some behavioral analysis into threat hunting to increase the effectiveness.

This blog teaches security practitioners how attackers abuse legitimate Windows functionalities to move laterally and compromise Active Directory domains....

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm. - Cyb3r-Monk/RITA-J

Microsoft Incident ResponseDuring incident response, the investigators aims to find all traces of threat actor activity in forensic logs. We introduce a new..

Detecting Kerberos relaying attacks published by cube0x0 (KrbRelay) and by Dirk-jan (krbrelayx)

Using sliding window functions in KQL for better detection.

I believe that automating analysis is a challenge that all malware analysts are working on for more efficient daily incident investigations. Cloud-based technologies (CI/CD, serverless, IaC, etc.)...

In this post, I’ll explain how RITA beacon analyzer works and implement the algorithm in Azure Sentinel using KQL…

Open Threat Informed Detection Engineering is the European Commission DIGIT.S2 (Security Operations) open source initiative to build a rich ecosystem of tooling and data supporting Cyber Threat...

We’ve gotten really good at collecting piles of data. Our customers send us plenty of it and they think every event from every device is being monitored. Are...

Endpoint Detection & Response systems (EDR), delivered by in-house teams or as part of a managed service, are a feature of modern intrusion detection and remediation operations. This success is a...

Initial Access and Post-Exploitation Tool for AAD and O365 with a browser-based GUI - RedByte1337/GraphSpy

This post is perhaps a little basic for true SIEM literati, but it covers an interesting idea about SIEM’s role in today’s security. I…

RITA is an open-source network traffic analysis tool for detecting C2. In this post, I'll explain how its beacon analyzer works and implement the same algorithm in Azure Sentinel using KQL.

Research by: Golan Cohen Introduction Last seen in August 2021, Zloader, a banking malware designed to steal user credentials and private information, is back with a simple yet sophisticated infect...

Detection of EDR Bypass where a malicious driver is used for removing kernel callbacks.

Learn Kusto Query Language (KQL) for security analysis and incident response in a hyper-realistic lab environment with real logs!

For security reasons, I want to diable the Windows 10 functionality mounting ISO image files. Is there any GPO to deactivate the possibility of mounting an image as a drive?

Day 2 of the Infosec Jupyterthon 2022 Conference

Incorporating some behavioral analysis into threat hunting to increase the effectiveness.