Alla Yurchenko

[Andrii Bezverkhyi @andriinb]

my last tweet
new posts on #sigma https://t.co/dShHefHhBI and anything #infosec related which reflects my personal views will be published here https://t.co/ri0CjpMg0Q
story in the thread below

[Andrii Bezverkhyi @andriinb]

https://t.co/jF05nid39z
Join the largest open-source community for collective cyber defense!

p.s. we’ve got cookies and #uncoder AI

#greenteam

[Andrii Bezverkhyi @andriinb]

I guess I'll suspend access to our freemium for #Tesla and #SpaceX as a form of protest? o.O not like anyone will notice...

[Andrii Bezverkhyi @andriinb]

bleeping computer is under control of FSB and spreading ru propaganda. more details coming soon

[SOC Prime @SOC_Prime]

#Sigma rules to detect #LV #ransomware, an alleged #REvil successor actively targeting Europe & North America.

https://t.co/Kq6fcV1wuA

650+ rules to detect ransomware threats are right at hand! Get 30+ for free or reach all with On-Demand at https://t.co/KijuduKmwO #BlueTeam

[Andrii Bezverkhyi @andriinb]

#ThePrimeHunt v 1.0.2 is out, despite blackouts and drone terror, massive thanks to our R&D team in #Ukraine. What's new?
https://t.co/lXZ93GmOXw
+ #Splunk is now supported!
+ EchoTrail integration for file rep context
+ https://t.co/dSGlOr4Uhd for context
improvements:

[SOC Prime @SOC_Prime]

SOC Prime is attending IT-SA 2022 on October 25-27 in Nürnberg. Meet us and learn how to boost the effectiveness of your security operations with Collective Cyber Defense and Detection as Code.

Interested? Reach out to @TillsTweet for more details. @itsa_ITSecurity #itsaexpo

[SOC Prime @SOC_Prime]

#Sigma rules to detect #Text4shell (CVE-2022-42889), a critical #RCE #vulnerability in Apache Commons Text. Potential #Log4Shell situation.

https://t.co/2jR5XYCYio

#CVE #CVE202242889 #exploit #BlueTeam #DFIR #PoC #ThreatHunting #CTI #mitre #cyberattack #infosec #cybersec #SOC

[Andrii Bezverkhyi @andriinb]

Do we plan to support more SIEM / EDR? Well, since it started with #sigma, the goal would be to support all sigmacs / sigma backends out there.
Ideas? Suggestions? Issues? PR? https://t.co/sXZ2dhd0jW

[Andrii Bezverkhyi @andriinb]

Today one of my dreams came to life. The Prime Hunt, one UI for platform agnostic threat hunting is out: https://t.co/sXZ2dgUR5O
An #opensource LGPL browser add-on that extends the success of #sigma as platform agnostic language for threat hunting to one UI. Waaaat? read on!

[Andrii Bezverkhyi @andriinb]

https://t.co/kCd6unuwUR 2 #sigma rules so far re #bruteratel

[Andrii Bezverkhyi @andriinb]

Initial #sigma rules for @elastic stack for #proxynotshell. We're working on something special together so stay tuned!

[SOC Prime @SOC_Prime]

14 #Sigma rules for #Snowflake to detect #ProxyNotShell: https://t.co/4vInHPyRK6

Exploitation patterns, ATT&CK mapping, strategic & tactical recommendations, logging details: https://t.co/tXLb90JhxW

Learn more: https://t.co/nN5jQaXTSn

#CVE202241040 #CVE202241082 #GTSCExchange

[Alla Yurchenko @AllaYurch]

15 #ProxyNotShell detections for Humio are here
https://t.co/ULjE9Xm2Eu

[Alla Yurchenko @AllaYurch]

#ProxyNotShell 13 detection rules for #ChronicleSecurity:
https://t.co/nN8BS5pqr0

Exploitation patterns, ATT&CK mapping, strategic & tactical recommendations, logging details: https://t.co/BSJmnuVpNt
#ProxyNotShell #CVE202241040 #CVE202241082 #0day #GTSCExchange #Sigma

[Alla Yurchenko @AllaYurch]

Immediate detection is essential as exploitation of public-facing Exchange servers is used by russian threat actors against Ukraine and allies.

Defence Intelligence of Ukraine: https://t.co/uVXAevuR7F

CERT-UA on Exchange Exploitation as Initial Access: https://t.co/SJCtUmeIvT

[Andrii Bezverkhyi @andriinb]

To defend Ukrainian organisations using IBM #QRadar, we are sharing pro bono 124 #Sigma rules on #ProxyNotShell and relevant vulnerabilities on Initial Access tactics as reported by #CERTUA division of @dsszzi

Full post
https://t.co/4ow4N6r5yH

[Andrii Bezverkhyi @andriinb]

12 Sigma rules for CVE-2022-41040 & CVE-2022-41082 aka #ProxyNotShell for Microsoft Sentinel along with MITRE ATT&CK Mapping, strategic, tactical and technical recommendations including logging. Search here, no registration:
https://t.co/d4rQqc1DYK

[Alla Yurchenko @AllaYurch]

@Gi7w0rm If you google them here, you get lists of Sigma rules https://t.co/2wcCbxE7n0