SmoothDeploy

A bug walks in a bar... 🐛

[SmoothDeploy @SmoothDeploy]

Check out our latest blog post on #SummaryRules and #DataLake in #MicrosoftSentinel.

An introduction on Summary Rules in Microsoft Sentinel on optimizing #SIEM costs without compromising #threatdetection & monitoring capabilities. #detectionengineering

https://t.co/6MygPyaWFd

[St0pp3r @_st0pp3r_]

Just published a new post in my Detection & Response Chronicles series.

This time I explore how adversaries abuse QEMU to run covert operations inside VMs, evading traditional host-based detection.

Read more: https://t.co/gkIubKGOwB

#QEMU #DetectionEngineering

[St0pp3r @_st0pp3r_]

Check out my latest blog post on #ConsentFix (a.k.a. #AuthCodeFix).

We go through, the attack flow and mechanics, detection and hunting opportunities and mitigations.

https://t.co/G9hZA3IXNV

[St0pp3r @_st0pp3r_]

Back with a new blog post!

#DetectionEngineering: Practicing #DetectionAsCode – Tuning - Part 8

👉 https://t.co/UGJUeeelN6

If you missed the rest of the parts you can find them here: https://t.co/ZYy8Qqu8C4

[St0pp3r @_st0pp3r_]

Check out our latest post on #DetectionEngineering: Practicing #DetectionAsCode

[St0pp3r @_st0pp3r_]

Check out my latest blog post of the series #DetectionEngineering: Practicing #DetectionAsCode for @NVISO_Labs. In this part we are exploring Continuous Delivery pipelines to deploy our detections to the target platform.

[NVISO Labs @NVISO_Labs]

This is the follow-up you've been waiting for: The #DetectionEngineering Blog Post Part 6 by @_st0pp3r_
https://t.co/4OvjvsHrK8

You'll gain insights on manual, release-based, automatic and multitenant deployments to optimize #ContinuousDeployment processes and more.

[St0pp3r @_st0pp3r_]

Part 5 of the #DetectionEngineering #DetectionAsCode series is now available: https://t.co/0QQkml8Uno

In this part we are exploring versioning schemes for the content packs and detections in the repository.

[St0pp3r @_st0pp3r_]

Check out my latest blog for the series #DetectionEngineering - Practicing #DetectionAsCode

In this part we are looking into ways of automating documentation and the generation of a change log to track updates in the repository!

Coming up next is applying versioning schemas!

[St0pp3r @_st0pp3r_]

Check out part 3 of our blog post series #DetectionEngineering - Practicing Detection-as-Code.

[St0pp3r @_st0pp3r_]

Check out part 2 of our #DetectionEngineering - Practicing #DetectionAsCode series is out! This part is all about laying the groundwork for a scalable and efficient detection repository.

[St0pp3r @_st0pp3r_]

Check out my latest blog for @NVISO_Labs on #detectionengineering and Detection-as-Code.

[Agapios Tsolakis @KwaLeeTea]

🚨 BLOG ALERT 🚨

I dove into maintenance in #DetectionEngineering - why it matters so much and the paradox that won’t let me sleep at night.

This is the first post in a new series:

[NVISO Labs @NVISO_Labs]

New blog post!

Title: Detecting Teams Chat Phishing Attacks (Black Basta)
by Stamatios Chatzimangou

Link: https://t.co/zPpc6rxCDi

#SOC #BlueTeam #Phishing #Sentinel #KustoQueryLanguage #SIEM #BlackBasta

[NVISO Labs @NVISO_Labs]

New blog post!

Title: Validate your Windows Audit Policy Configuration with KQL
| By Stamatis Chatzimangou

Link: https://t.co/8gzltQsFPV

#AuditPolicy #Azure #KQL #KUSTO #Sentinel #SIEM #SOC #Windows

[Nasreddine Bencherchali @nas_bench]

🦸#SigmaHQ release r2024-01-29 is here.

🌟7 New Rules
🛡️30 Rule updates
🔬11 Rule Fixes

This release includes

- #Pikabot uncommon DLL loading and updates to older Pikabot related rules.
- CodePage modification via the built-in MODE utility as seen in the wild.
- CLI and Metadata based rules for #EDRSilencer and #SharpMove

and much more included🔥You can read about this by checking the release highlight blog -> https://t.co/1flOHn6goe

Or check the full change log and start exploring this, by downloading the latest release -> https://t.co/O1rcmkiRdQ

Thanks to the many contributors that helped shape this release, specifically

@CrimpSec @frack113 @Joseliyo_Jstnk @phantinuss @qasimqlf Stephen Lincoln, Swachchhanda Shrawan Poudel, t-pol, tr0mb1r, xiangchen96

@sigma_hq

[Shiroe @TheRealShiroe]

https://t.co/XPTXCj9opT

[St0pp3r @_st0pp3r_]

I recently looked into the creation of a rule for the #NoFilter #PrivilegeEscalation #hacktool by leveraging Event IDs 5447 & 5449.
The detection is based on the static value "RonPolicy" of the PolicyName variable in the code of the tool. https://t.co/W1OK8cXXBM
#CyberSecurity

[Shiroe @TheRealShiroe]

https://t.co/XPTXCj9opT

My first blogpost ! Really happy that I finally found the time to finish it. Hope you enjoy and suggestions are welcome.

[Doomdesire @DoomdesireEU]

New post: Hunting for PurpleFox Exploit Kit

https://t.co/F0j4ptZlRf