OSSEM

Open Source Security Event Metadata ! Data engineers! #ThreatHunting @OTR_Community

[Open Threat Research @OTR_Community]

@olafhartong @MITREattack @FDezeure @redcanary @mvelazco @jsecurity101 Thank you so much for sharing the @OSSEM_Project Detection Model 🙏 and all your contributions to it!
Very happy to see the project helping others in the community 🌎🎊

https://t.co/P9qgsP4UZn

[Thomas Garnier @mxatone]

@OSSEM_Project @Cyb3rPandaH Will be coming on Windows soon ;)

[OSSEM @OSSEM_Project]

🚀 Any NEW fields on the schemas for #SysmonForLinux events compared to Windows🤔?

@Cyb3rPandaH used our #Sysmon for Windows & Linux data dictionaries in a python 🐍 script to answer that😎

✅ ParentUser (ProcessCreate)
✅ User (EID 5,9,11)

🖇️ Script: https://t.co/vO1mjtvGnw

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🚨 Learning how to install #Sysmon for Linux 🐧 & send security events to #AzureSentinel in a research lab environment!! 🧪 #MSTIC #Microsoft

📡 Sysmon (SysinternalsEBPF) -> Syslog -> SIEM 🚀

✅ Scripts
✅ ARM templates
✅ Sysmon configs and more..

https://t.co/juoMCueKU5

[OSSEM @OSSEM_Project]

@Cyb3rWard0g 🚨 Thanks to @Cyb3rPandaH , we updated our #Linux data dictionaries to keep up with the event schemas from #SysmonForLinux and share them with the community 🚀 I see some new fields names 🙊👀

https://t.co/SQtaKTgXYp

@OTR_Community

[Microsoft Threat Intelligence @MsftSecIntel]

Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: https://t.co/B0G6BxUeaM

[Open Threat Research @OTR_Community]

🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻

Help us build the largest library of datasets for the InfoSec community! 🚀

Site: https://t.co/tpgVTJWNfL…
Repo: https://t.co/q5USTVMZCt

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🚨 New version of the Windows Security Events connector from #AzureSentinel reached public preview

Looking for a way to test & filter the collection of event logs via XPath queries? I got you! 💜🍻 @MSThreatProtect #MSTIC @OTR_Community @OSSEM_Project

https://t.co/kkxv4Lgftp

[Open Threat Research @OTR_Community]

🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike

🗒️Metadata: https://t.co/63RGi5RQ0u

😈Dataset: https://t.co/kRRl71Vrdc

[OSSEM @OSSEM_Project]

What started w/ talks at ATT&CKcon & analysis of event logs, We're happy to see @Cyb3rPandaH & @Cyb3rWard0g initial research helping ATT&CK users improve their data collection strategies. Join us to collab 🍻 @OTR_Community

🎙️ https://t.co/DaYoka1tgr

🛡️ https://t.co/veHNTVKBCT

[ATT&CK @MITREattack]

It has launched! ATT&CK v9 is now live with refactored data sources, ATT&CK for Containers, Google Workspace as a platform and more! Read about new data sources and the rest of the update at https://t.co/zooJ9LMn1M or https://t.co/Q1fQgtUGBb for new/changed groups/techniques/sw.

[Security Datasets @SecDatasets]

Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community

1⃣ Creation: https://t.co/ljZQuar0FD

2⃣ Update: https://t.co/IQyNC327JH

@HunterPlaybook Library Doc: https://t.co/HxIlW98DCo

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

💥😱 @tiraniddo added "named pipe RPC client transport" to NtObjectManager 🔥 Thank you very much James for all your work 👏!

I'll create PS scripts to cover a few scenarios 🍻 (Img 4)

If anyone would like to help me, let me know 😉 @OTR_Community

https://t.co/8paKivsLy9

[Security Datasets @SecDatasets]

Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜

[OSSEM @OSSEM_Project]

Thinking about contributing to an os project during the holidays? 😉The @OTR_Community have updated our Detection Model
1⃣Contribute security events to @MITREattack data sources https://t.co/GlHO88Tpf5
2⃣Provide feedback https://t.co/9uPyonlG0A
3⃣Have fun https://t.co/GMmmbNmi4p

[Ekoparty | Hacking everything @ekoparty]

#Eko2020 | @BlueSpaceSec | Roberto y Jose Luis Rodriguez: Open Threat Research (Keynote)

"Open Threat Research: Compartiendo herramientas Open Source con el mundo para el desarrollo de detecciones desde casa", una charla de @Cyb3rWard0g y @Cyb3rPandaH.

https://t.co/N0ZwJZei8L

[Open Threat Research @OTR_Community]

🚨 New version of our "attackcti" Python 🐍 library to query @MITREattack in STIX format via their public TAXII server has been released!

1⃣ ICS ATT&CK Integration ✅
2⃣ Basic Notebook to explore ICS Content ✅

📔 Binder: https://t.co/oCyHn1CABi

📦Repo: https://t.co/v538a68ulF

[SANS DFIR @sansforensics]

In their #THIRSummit talk, @Cyb3rPandaH & @jamieantisocial illustrates how we can avoid the typical cat and mouse games by modeling the data sources defined in ATT&CK to recognize, track, and even predict the malicious scent of adversaries.

Watch it now: https://t.co/mGP0hdNKA1

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

Thank you @jaredhaight 😊🙏 With the latest updates to @MITREattack data sources by @Cyb3rPandaH , we are translating that doc to YAML files to create additional documentation and hopefully get contributions from the InfoSec Community 😊

https://t.co/VqRdproc1C

[OSSEM @OSSEM_Project]

Formalizing the mapping of security events to the @MITREattack data source objects concepts 🍻 We would love to hear your feedback and see your contributions to this community-led effort!! 💜 Thank you @Cyb3rPandaH 💜

Blog: https://t.co/Nkl9fKeohY

[OSSEM @OSSEM_Project]

🙏So happy to see our initial data modeling concepts applied to enhance @MITREattack . This is a more practical & less subjective approach to map event logs ➡️ att&ck data sources. We hope this helps the community to improve their data collection strategy. Thanks @Cyb3rPandaH 🍻

[ATT&CK @MITREattack]

Coinciding with @jamieantisocial's and his #ThreatHuntingSummit talk, we've just released part 1 of a blog series by ATT&CK team member @Cyb3rPandaH on a proposed method of enhancing an often overlooked part of ATT&CK, data sources. Check it out at
https://t.co/9Yh74So4Kf.

[ATT&CK @MITREattack]

Coinciding with @jamieantisocial's and his #ThreatHuntingSummit talk, we've just released part 1 of a blog series by ATT&CK team member @Cyb3rPandaH on a proposed method of enhancing an often overlooked part of ATT&CK, data sources. Check it out at
https://t.co/9Yh74So4Kf.