Sources & Methods Newsletter

Monthly newsletter for cyber threat intelligence (CTI) information sources, tools, and articles — avatar by smashingstocks

[Sources & Methods Newsletter @srcmtd]

Happy Holidays! Issue 004 is here 🎁 https://t.co/kVvopjiYkg

[Tony Lambert @ForensicITGuy]

I'm so proud of things my teammates have published and worked on this year. Stuff like the monthly @redcanary Intel Insights: https://t.co/aoc4BGvrWp

[Alexandre Dulaunoy @[email protected] @adulau]

Maybe something important for your next year calendar, the https://t.co/J5YOkRvWjW 2023 and https://t.co/zuFtxtw2ub 2023 will take place in Luxembourg next year from Monday 16th October until Thursday 19th October.

[Katie Nickels @likethecoins]

This is a very cool process for creating intelligence requirements from the Red Hat infosec team! I'm a big fan of the Venn Diagram approach to explaining threat modeling. (h/t @cocaman)

✍️ Process: https://t.co/oMeqKK4WRV
📊 Spreadsheet: https://t.co/7KM4M1CS0J

[SpecterOps @SpecterOps]

ICYMI: @_wald0 dropped a new blog post today: Passwordless Persistence and Privilege Escalation in Azure

You can read it here: https://t.co/AWzutPqdgF

[Jon Bateman @JonKBateman]

Russian cyber operations in Ukraine: I’ve spent months collating and analyzing data on…

» Their military effectiveness
» Reasons why they weren’t more impactful
» Lessons for other states

The result is a very long paper and this 🧵... https://t.co/GX3TdoYryW

[Chris Sanders 🔎 🧠 @chrissanders88]

Investigation Scenario 🔎

A user reported their mouse moving around on the screen by itself for a few minutes. The cursor appeared to open and close a few documents on the desktop.

What do you look for to investigate whether an incident has occurred?

#InvestigationPath #DFIR

[MISP (@[email protected]) @MISPProject]

MISP Training Video December Edition - Best Practices for Encoding Threat Intelligence and Leveraging the information in MISP to Make Threat Landscape Report.

#threatintel #threatintelligence #misp #opensource

https://t.co/wyNPZjdhpy

[Julian-Ferdinand @JulianVoeg]

We just published our yearly study of malicious #C2 infrastructure identified using proactive scanning and other collection methods throughout 2022. Key findings include:

[Josh Smith @joshjonsmith]

North Korean cyber spies deploy new tactic: tricking foreign experts into writing research for them. With experiences from @DanDePetris & @j3nnyt0wn, and insight from @MsftSecIntel & @BAES_Digital https://t.co/vKpH0ijibt

[Team Cymru Research @teamcymru_S2]

BLOG POST: An update on some of our Iranian #APT tracking, showing continued victim connections to 107.173.231.114 (🇺🇸), a longstanding C2 server.

H/T @ChicagoCyber for the course correct on attribution. 🤜🤛

https://t.co/5Yh0kIX92g

[Filigran @FiligranHQ]

🔔DING! DING!🔔#OpenCTI 5.4.0 is out! Huge joint effort from the #Filigran team and all community contributors 🙏! Bulk search, custom workflow, analyst workbench, performances improvement, #STIX grouping... #CTI #CyberSecurity #ThreatIntelligence

➡️https://t.co/TOxDjyCBvP

[SentinelOne @SentinelOne]

👇Our favorite tools for hunting and tracking malicious infrastructure. A Thread 🧵👇
1/9

[The DFIR Report @TheDFIRReport]

BumbleBee Zeros in on Meterpreter

➡️Initial Access: Contact Forms/Stolen Images/ISO
➡️PrivEsc: WSReset & Slui UAC Bypass, Zerologon CVE2020-1472
➡️Cred Access: Procdump LSASS, reg dump SAM/SEC/SYS hives
➡️C2: BumbleBee, Meterpreter, CobaltStrike

https://t.co/Obm5cNospg

1/X

[Matthew Conway @svcghost]

That's a wrap for #BRUNCHCON! Sure I missed the start (sleeping—no reason) but this was a great set of talks in a short time. See you next year 😄👋

[Matthew Conway @svcghost]

This was my favorite talk in @CYBERWARCON or #BRUNCHCON—as a dev and former red teamer that loves the infra and tooling side, and because of the ample and clear evidence given to relate the two loaders. I learned a lot from it 👏

[Matthew Conway @svcghost]

Now @tiskimber and Genevieve Stark on the SHELLSTING loader, which could be a replacement for BazarLoader

[Matthew Conway @svcghost]

Up next at #BRUNCHCON, Ransomware Sommelier @uuallan on the De-RaaS'ing of Ransomware

[💻 Sherrod @sherrod_im]

My new number one consumer security tip: never, ever move a conversation to WhatsApp.

#CYBERWARCON