RTFM

RTFM - Red Team Field Manual

[RTFM @redteamfieldman]

The time is almost here! The RTFM Video Library will be released in 6 days! The #RTFM is at its core, well a field manual, but if you want that extra guided support, the Video Library will walk through the most important #RedTeam references in the book.

https://t.co/zFvEVv0rbV

[RTFM @redteamfieldman]

RTFM Black Friday Sale + Giveaway! (First TEN orders get SWAG). The RTFM Video Library is now 25% OFF!

To celebrate the sale, Nick Downer and I are giving away 2 instances of the RTFM Video Library! Like, Comment, and Repost to enter!

https://t.co/EJM8COxt8t

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has observed a subset of Iran-based threat actor Mint Sandstorm (PHOSPHORUS) employing new TTPs to improve initial access, defense evasion, and persistence in campaigns targeting individuals at universities and research orgs. Read our analysis: https://t.co/GnqhGmRWH3

[Cyber Detective💙💛 @cyb_detective]

https://t.co/fJ8ZoTSxgY

A collection of links to public records databases for finding information on people and companies around the world.

Creator @osintearth

Thanks for tip @akaclandestine

#osint #geoint

[0xor0ne @0xor0ne]

Reliable exploit engineering and Linux kernel bug hunting
Presentation slides from OffensiveCon 2023
Credits @saidelike and @alexjplaskett (@NCCGroupInfosec)

https://t.co/P81V5uRT8k

#Linux #kernel #cybersecurity

[Andrew Morris (afk) @Andrew___Morris]

AWS HAS ENTERED THE HUGE HONEYPOT NETWORK GAME LETS GOOOOOOOOOOO

https://t.co/uEHfoynJTS

stoked to see @awscloud finding success with honeypots. I continue to carry an incredibly healthy respect for the excellent folks at @AWS_Security.

BLUF: huge, adaptive honeypot networks are effective where the rest of the cyber vuln mgmt, perimeter security, and cyber threat intel industries are failing miserably.

having spent the last six years building, expanding, tuning, and operating @GreyNoiseIO, I figured I'd share some thoughts in no particular order:

AWS is moving 5.5 billion events in one quarter, which is about 61m events on average per day (The average routable IP on the internet receives between 10k and 100k unsolicted packets per day)

we move about ~400m events per day at greynoise (receipts attached). averages are useful in some stats for honeypot networks, averages are misleading in others.

> "The sensors observe more than 100 million potential threat interactions and probes every day around the world, with approximately 500,000 of those observed activities advancing to the point where they can be classified as malicious."

^^^^ 0.5% malicious tag rate is a great place to start, but leaves a lot of wood left to chop. We've gotten up to between 30% and 50% malicious tag rate with high confidence (receipts attached). You're going to need to really really build up that corpus of detections.

if I were having a conversation with the leads/architects/product managers of AWS's MadPot, I'd give the following (very unsolicited) guidance:

- Get into every single other cloud provider. Collection from AWS is not enough. You need to be in every country and every provider.

- You're going to need to collect from non-cloud (residential, business, mobile) networks as well.

- Persona & state management (what the sensor looks like, and when) is going to become increasingly complex and challenging. Think about a strategy for this.

- You're going to have to allow sensors to be compromised eventually, and you're going to have to have solid data models for endpoint telemetry in addition to network telemetry

- You're going to need to eventually combine the sensor data with port scan/crawl data in order to achieve "malicious" or "compromised" verdicts.

- If you don't have a strategy for benign internet scanners, you'll need one

- Primitives for byte-level pattern matching in unstructured byte data in the state-of-the-art in datastores are very poor, you'll need to fill the gaps here

- If you don't have an opsec strategy (counter-fingerprinting) then you'll need one

- Prepare a strategy for dealing with spoofed TCP SYN noise storms

- off the shelf detections and IDS signatures are built for middling and detecting on traffic for networks that also do business things (service users and servers, etc). They will provide value but they *will not all work out of the box* on honeypots for a multitude of reasons.

- The right enrichments are crucial for decorating the data. Attacks will practically pop out of the computer screen when you enrich and lay the data out correctly.

- You're going to need to partner with the cybersecurity research community to win this game- think about how the rest of the world can contribute data or analysis.

- Don't let your eye off the ball on achieving high and tight, rapidly shifting block verdicts.

- Store *everything* *forever*.

I'm excited to see how AWS's MadDog honeypot evolves. Huge adaptive distributed honeypots are effective but hard to build and scale. Congrats team- this is one of the best writeups I've seen to date!

[Daniel Kelley @danielmakelley]

30 cybersecurity search engines for researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.

[Cyber Detective💙💛 @cyb_detective]

SANS Osint Summit 2023 resources

Wizards, Utilities and Helpers
Telegram
Web, Internet Infrastructure
Phone number
Backlinks
Social Media Analysis
Tracking
Maps And GIS
Legal and Govt. Public Records
Visualization
Mindmapping Tools

https://t.co/Uy8PIKIML1
Contributor @ranlocar

[0xor0ne @0xor0ne]

Series on Windows kernel drivers for red team tools development
Introduction by @Idov31

Part 1: https://t.co/gLIk9tGiEI
Part 2: https://t.co/ryrPfTLJrR
Part 3: https://t.co/l6C4j7TMte
Part 4: https://t.co/SONhXgCEp7

#windows #kernel #redteam #malware #infosec #cybersecurity

[DirectoryRanger @DirectoryRanger]

Pentesting Azure: Recon Techniques
https://t.co/yMLlcoXWxF

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Refreshed "pass the things" AD mindmap, the previous one was not in a dark theme (outrageous I know)

⏩ https://t.co/muRKiM1mre
💡 made with https://t.co/eEyNNIH3zs

[Hacking Articles @hackinarticles]

Wireshark Filter Cheat Sheet

🔴⚫️Full HD Image: https://t.co/gS49lvi2uM

#infosec #cybersecurity #cybersecuritytips #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

[SpecterOps @SpecterOps]

What is Tier Zero? 🤔

Read our latest blog post from @Jonas_B_K & @elad_shamir on the intricate world of critical identities and resources across Active Directory and Azure. https://t.co/ORrU9WznT6

[Microsoft Threat Intelligence @MsftSecIntel]

Beginning July 2023, Storm-0324, a financially motivated threat actor known to gain access to networks and then hand off access to other actors, was observed distributing payloads by sending phishing lures thru Microsoft Teams chats. Get TTPs, mitigation: https://t.co/gLeid8uwYG

[RTFM @redteamfieldman]

Less than 24 hours until the RTFM Video Library release. We will draw the 3 winners tomorrow morning. First 100 signs ups (and 3 winners) will get limited RTFM swag pack! https://t.co/zFvEVv0rbV #RTFM

[RTFM @redteamfieldman]

Some good basics. Hard to perform SQLi if you don’t understand SQL. Well unless you just blindly blast some automated tool.

[Hacking Articles @hackinarticles]

SQL Cheat Sheet

#infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

[RTFM @redteamfieldman]

Nick and I will be giving away 3 free subscriptions to the Video Library and a limited release swag pack. You’ll be entered for every like, comment, and repost. We’ll draw the winners the day before the release. Get a head start on the #RTFMChallenge, sign up for the email list.

[RTFM @redteamfieldman]

The time is almost here! The RTFM Video Library will be released in 6 days! The #RTFM is at its core, well a field manual, but if you want that extra guided support, the Video Library will walk through the most important #RedTeam references in the book.

https://t.co/zFvEVv0rbV

[RTFM @redteamfieldman]

If you are headed to @BsidesCLT you should find something in your conference swag kit. Be sure to find Nick Downer and say hey. Hope you enjoy the con! #RTFM #RedTeam

[Clandestine @akaclandestine]

GitHub - timb-machine/linux-malware: Tracking interesting Linux (and UNIX) malware. Send PRs https://t.co/HbsGCl5DBh

[RTFM @redteamfieldman]

9 new tools and major updates to Kali Autopilot

[Kali Linux @kalilinux]

Super excited to announce the release of Kali 2023.3! Check out the release blog post at https://t.co/aT5PSrM5a8!