Network Security Channel

#CTI #STIX #TAXII #MAEC
اطلاعات تهدید ساختار یافته یا Structured Threat Information Expression یک استاندارد است در خصوص اشتراک گذاری اطلاعات یک تهدید و حمله APT بر پایه شاخه ها (#IoC) و رفتار تاکتیکی و تکنیکی حمله (#TTP).

اما در کنار ساختار STIX یک مکانیزم Transport هم وجود دارد با نام Trusted Automated Exchange of Intelligence Information است که به معنی تبادل اطلاعات قابل اعتماد بصورت اتوماتیک است که برای استانداردسازی فرایند های اشتراک گذاری بواسطه یک مکانیزم مشخص تا کلیه ابزارها و محصولات مرتبط با مقوله #CTI با هم ارتباط گیرند.

مورد بعدی Malware Attribute Enumeration and Characterization است به معنی سرشماری خصوصیات و ویژگی های بدافزار که برای توسعه زیرساخت های #CTI در راستای پالایش منابع بدافزارها طراحی شده است.

اما مورد آخر Cyber Observable eXpression است به معنی ساختارمند کردن داده های قابل مشاهده در فضای سایبر، که در راستای استفاده در پایگاه داده های #CTI نقش آفرینی میکند.

https://oasis-open.github.io/cti-documentation/
@Engineer_Computer

97 views16:36

#Cybersecurity #Israel #Azerbijan
اساسا استراتژی مدیریتی کشورها برای بوجود آوردن خدمات امنیت سایبری، این است که مبتنی بر شرکت های دانش بنیان نیازمندی ها تامین شود، چرا که بحث رقابت پذیری و ارزیابی بدون تعارف را به همراه خواهد داشت.

اما در ایران وضعیت چگونه است؟ در ایران هم شرکت های متعددی فعالیت دارند اما با دو فرق با کل جهان:

اول اینکه در هیچ یک از کشور های دنیا شرکتی بدون اخذ نمایندگی معتبر، نمیتواند اقدام به فروش محصولات خارجی کند، اما در ایران اینگونه نیست و شرکت های دلال در ایران به چندین برابر قیمت دلاری محصولات خارجی را بدون اخذ نمایندگی به دستگاه ها فروخته و قرارداد میبندند، که این موضوع موجب میشود شرکت ها نیازی به فعالیت های R&D نداشته باشند چرا که محصولی تولید نمیکنند.

دوم، کیفیت سنجی، اصالت سنجی در خصوص محصولات بومی نیز انجام نمیشود و عموما محصولات بظاهر بومی به ارگان های دولتی به فروش میرسد، مانند ماجرای ایمیل سرور بومی سازمان انرژی اتمی که بعد از هک شدن مشخص شد محصول فروخته شده در اصل برای شرکت Zimbra بوده و شرکت ایرانی آنرا صرفا فارسی سازی کرده است.

https://fna.ir/3cb2u4
@Engineer_Computer

117 views16:36

Network Security Channel

🔍 مقایسه کارکرد EDR های مختلف بر روی سیستم عامل ویندوز

🔗 https://docs.google.com/spreadsheets/d/1ZMFrD6F6tvPtf_8McC-kWrNBBec_6Si3NW6AoWf3Kbg/edit#gid=1993314609

🔗https://github.com/tsale/EDR-Telemetry

@Engineer_Computer

Google Docs

EDR Telemetry Tracking for Windows

145 views16:58

Network Security Channel

⚙️ آزمایشگاه تحلیل بدافزار خودتون رو بسازید🔎

🔬 اگر میخواهید مهارت های تحلیل بدافزار ، RE و مهندسی نرم افزار خودتون رو افزایش بدید آزمایشگاه Arch Cloud Labs میتونه گزینه مناسبی برای شما باشه...

🦠 آزمایشگاه Arch Cloud Labs یک بازسازی از تجزیه و تحلیل بدافزار شرکت های بزرگ رو برای شما فراهم میکنه و همچنین شمارو تشویق میکنه که همان تجزیه و تحلیل رو انجام دهید.هر بخش به گونه ای طراحی شده که تحلیل رو به همراه شما آغاز میکنه و در آخر سوالاتی را برای شما باقی گذاشته که خودتان آن ها را کاوش کنید.

🔗https://github.com/archcloudlabs/HackSpaceCon_Malware_Analysis_Course

@Engineer_Computer

167 views16:58

Network Security Channel

flutsis.apk

66 MB

hint :
Found out the differences between Debug & Release Modes in Flutter!

@Engineer_Computer

166 viewsedited 19:37

Network Security Channel

www.comptia.org

A+ Certification | CompTIA

Begin your tech career with CompTIA A+, the go-to certification for IT support roles. Opt for V15 to access the latest content or complete V14 before it retires on September 25, 2025.

165 views15:02

Network Security Channel

Extensive Recon Guide For Bug Hunting

https://hacklido.com/blog/398-extensive-recon-guide-for-bug-hunting

@Engineer_Computer
@Engineer_Computer

HACKLIDO

Extensive Recon Guide For Bug Hunting

WHAT IS RECONNAISSANCE? Reconnaissance is one of the most important aspects of penetration testing. It’s also known as Recon. Recon will help you to incr...

100 views15:02

Network Security Channel

INCIDENT RESPONSE FOR COMMON ATTACK TYPES
1. Brute Forcing Details:
Attacker trying to guess a password by attempting several different passwords
Threat Indicators:
Multiple login failures in a short period of time
Where To Investigate:
• Active directory logs
• Application logs
• Operational system logs
• Contact user
Possible Actions:
If not legit action, disable the account and investigate/block attacker
2. Botnets Details:
Attackers are using the victim server to perform DDoS attacks or other malicious activities
Threat Indicators:
• Connection to suspicious IPs
• Abnormal high volume of network traffic
Where To Investigate:
• Network traffic
• OS logs (new processes)
• Contact server owner
• Contact support team
Possible Actions:
If confirmed:
• Isolate the server
• Remove malicious processes
• Patch the vulnerability utilized for infection
3. Ransomware
Details:
A type of malware that encrypts files and requests a ransom (money payment) from the user to decrypt the files
Threat Indicators:

• Anti-Virus alerts
• Connection to suspicious Ips
Where To Investigate:
• AV logs
• OS logs
• Account logs
• Network traffic
Possible Actions:
• Request AV checks
• Isolate the machine
4. Data Exfiltration Details:
Attacker (or rogue employee) exfiltrate data to external sources
Threat Indicators:
• Abnormal high network traffic
• Connection to cloud -storage solutions (Dropbox, Google Cloud)
• Unusual USB Sticks
Where To Investigate:
• Network traffic
• Proxy logs
• OS logs
Possible Actions:
• If employee: Contact manager, perform full forensics
• If external threat: Isolate the machine, disconnect from network
5. Compromised Account Details:
Attackers get access to one account (via social engineering or any other method)
Threat Indicators:
• Off-hours account logins
• Account group changes
• Abnormal high network traffic
Where To Investigate:
• Active directory logs
• OS logs
• Network traffic
• Contact user for clarifications
Possible Actions:

If confirmed:
• Disable account
• Password changes
• Forensic investigations
6. Denial Of Service (Dos/DDoS)
Details:
When attacker can cause interference in a system by exploiting DoS vulnerabilities or by generating a high volume of traffic
Threat Indicators:
Abnormal high network traffic in public facing servers
Where To Investigate:
• Network traffic
• Firewall logs
• OS logs
Possible Actions:
• If DoS due to vulnerabilities: Contact patching team for remediation
• If DDoS due to network traffic: Contact network Support or ISP
7. Advanced Persistent Treats (APTs)
Details:
Attackers get access to the system and create backdoors for further exploitation. Usually hard to detect
Threat Indicators:
• Connection to suspicious IPs
• Abnormal high volume of network traffic
• Off-hours access logs
• New admin account creations
Where To Investigate:
• Network traffic
• Access logs
• OS logs (new processes, new connections, abnormal users)
• Contact server owner/support teams
Possible Actions:
If confirmed:
• Isolate the machine
• Start formal forensics process
• Start escalation/communication plan

@Engineer_Computer
@Engineer_Computer

128 views15:02

Network Security Channel

Open Source cyber security tools:

1. Zeek: https://zeek.org/
Network Security Monitoring
2. ClamAV: https://www.clamav.net/
Antivirus
3. OpenVAS: https://www.openvas.org/
Vulnerability Scanner
4. TheHive: https://lnkd.in/e7aVCRUZ
Incident Response
5. PFSense: https://www.pfsense.org/
Security appliance (firewall/VPN/router)
6. Elastic: https://www.elastic.co/de/
Analytics
7. Osquery: https://www.osquery.io/
Endpoint visibility
8. Arkime: https://arkime.com/
Packet capture and search
9. Wazuh: https://wazuh.com/
XDR and SIEM
10. Alien Vault Ossim: https://lnkd.in/eShQt29h
SIEM
11. Velociraptor: https://lnkd.in/eYehEaNa
Forensic and IR
12. MISP project: https://lnkd.in/emaSrT57
Information sharing and Threat Intelligence
13. Kali: https://www.kali.org/
Security OS
14. Parrot: https://www.parrotsec.org/
Security OS
15. OpenIAM: https://www.openiam.com/
IAM
16. Yara: https://lnkd.in/eEJegEak
Patterns
17. Wireguard: https://www.wireguard.com/
VPN
18. OSSEC: https://www.ossec.net/
HIDS
19. Suricata: https://suricata.io/
IDS/ips
20. Shuffler: https://shuffler.io/
SOAR
21. Phish Report: https://phish.report/
Anti Phishing
22. Graylog: https://lnkd.in/eAFuUmuw
Logmanagement
23. Trivy: https://lnkd.in/e7JxXStY
DevOps/IaC Scanning
24. OpenEDR: https://openedr.com/
EDR
25. Metasploit: https://lnkd.in/e4ECX-py
Pentest
26. NMAP: https://nmap.org/

@Engineer_Computer
@Engineer_Computer

130 views15:02

Network Security Channel

What Is a Red Teamer?
A Red Teamer is a professional who simulates cyberattacks, physical security breaches, or other types of adversarial activity against a company or organization, in order to identify vulnerabilities and weaknesses in their security posture.
Red Teamers typically work alongside Blue Teamers to help them improve their defenses and ensure that they are adequately prepared to prevent and respond to real-world attacks.
Red Teamers use various techniques, such as social engineering, penetration testing, and physical security testing, to simulate attacks and provide feedback on how to improve security.
Their goal is to uncover weaknesses that an attacker might exploit and provide recommendations to address them.
As you probably already understand, red team member is someone, that in simple words, can compromise an organization using a large arsenal that includes many tactics and tools; and when choosing the wrong side, we get highly dangerous individuals.

@Engineer_Computer
@Engineer_Computer

89 views15:02

Network Security Channel

What Job Titles Suite to a Red Teamer?
A red teamer can go through many types of titles and work positions. Given the ideal scenario where a red teamer only uses his/her power to do good, they can go through work jobs such as:
• Red Team OperatorThis one is pretty obvious by the name but nonetheless – A Red Team Operator is responsible for conducting offensive security operations and simulating adversarial attacks on an organization’s infrastructure, applications, and people.This is the more “classic” role for a red teamer, as the use tactics such as social engineering, penetration testing, and other techniques to identify vulnerabilities and weaknesses in an organization’s security landscape.
• Penetration Tester:A Penetration Tester, also known as a “pentester,” is a cybersecurity professional who performs simulated attacks on an organization’s network and applications to identify vulnerabilities and weaknesses that could be exploited by attackers.They use a variety of tools and techniques to simulate real-world attacks and provide detailed reports on their findings.At first glance, it seems that pentester and red teamer is the same position. However, this is not the case. Pentester is mostly focusing on specific software failpoints such as certain apps and services the organization use, while red teamer is in charge of the whole operation and is targeting not only vulnerabilites but also, as mentioned, people, by using social engineering techniques. In addition, red teamer simulate and ongoing attack and not just setting a foot in the victim’s infrastructure, but also in charge of other steps such as lateral movement and data exfiltration.Overall, we can look at red team operator as a more “broad” position than a pentester.
• Security Auditor:A Security Auditor is responsible for reviewing an organization’s security policies, procedures, and controls to ensure that they meet industry standards and regulatory requirements.They may also perform security assessments and audits to identify vulnerabilities and weaknesses in an organization’s security posture, and provide recommendations for improvements.

@Engineer_Computer
@Engineer_Computer

105 views15:02

Network Security Channel

⭕️ RADAR: How DevSecOps is Revolutionizing Security at Snapp

در این مقاله یکی از AppSec Engineer های Snapp به بررسی جزئیات DevSecOps توی اسنپ پرداخته.

به طور خیلی خلاصه فریمورک رادار اسنپ که ترکیب Security Testing در CI/CD هست شامل ابزار های زیر میشه:
1. SAST:‌ semgrep
2. SCA, SBOM: Grype, Syft
3. Secret Detection: Gitleaks
4. IaC: KICS
5. Container Scanning: Trivy
6. DAST: ZAP
7. Vulnerability Management: DefectDojo, OWASP Dependency-Track

مقاله:
https://medium.com/@mohammadkamrani7/radar-how-devsecops-is-revolutionizing-security-at-snapp-5f496fd08e79

#DevSecOps #AppSec #DAST #SAST
@Engineer_Computer

👍1

287 views15:04

Network Security Channel

Phishing.pdf

11.8 MB

#کتاب Phishing پیرامون موضوع مهندسی اجتماعی
@Engineer_Computer

165 views15:46

Network Security Channel

#Windows
#Time
@Engineer_Computer

❤1

132 views15:47

Network Security Channel

Analyst1_ Ransomware Diaries v2.pdf

9.7 MB

#Ransomware
@Engineer_Computer

140 views15:48

Network Security Channel

Offensive security
1. burpgpt - Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities, and enables running traffic-based analysis of any type
https://github.com/aress31/burpgpt

2. LDAP shell - AD ACL abuse
https://github.com/PShlyundin/ldap_shell

@Engineer_Computer

GitHub

GitHub - aress31/burpgpt: A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering…

A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities and enables running traffic-based analysis of any ty...

126 views14:26

Network Security Channel

DFIR
PowerShell script to help Incident Responders discover adversary persistence mechanisms
https://github.com/joeavanzato/Trawler

@Engineer_Computer

GitHub

GitHub - joeavanzato/Trawler: PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.

PowerShell script helping Incident Responders discover potential adversary persistence mechanisms. - joeavanzato/Trawler

102 views14:26

Network Security Channel

Malware analysis
1. ROKRAT Malware
https://research.checkpoint.com/2023/chain-reaction-rokrats-missing-link

2. Decoy Dog Malware
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/dog-hunt-finding-decoy-dog-toolkit-via-anomalous-dns-traffic

@Engineer_Computer

Check Point Research

Chain Reaction: ROKRAT’s Missing Link - Check Point Research

Key findings Introduction From the many reports on APT37 in recent months, to Mandiant’s announcement on APT43, a lot of attention is currently focused on North Korean threat actors – and with good reason. North Korea has a long history of attacking its southern…

99 views14:26

Network Security Channel

Heads up, everyone!

CISA has issued an advisory warning of active exploitation of three known vulnerabilities, including CVE-2023-1389 (TP-Link Archer AX-21), CVE-2021-45046 (Apache Log4j2) and CVE-2023-21839 (Oracle WebLogic).
Details: https://thehackernews.com/2023/05/active-exploitation-of-tp-link-apache.html

Critical flaw affecting ME RTU remote terminal units!
CISA has issued an advisory about the security vulnerability tracked as CVE-2023-2131, which has received the highest severity rating of 10.0 on the CVSS scoring system.
Details: https://thehackernews.com/2023/05/cisa-issues-advisory-on-critical-rce.html

@Engineer_Computer

113 views14:26

Network Security Channel

Inciden Response playbook and Workflows.pdf

3.8 MB

#راهنمای IR جهت تهیه playbook
@Engineer_Computer

122 views14:27

Network Security Channel

#Cyber #Police #Spyware #BouldSpy
به گزارش آزمایشگاه تحلیل بدافزار های موبایلی شرکت Lookout، یک جاسوس افزار با نام BouldSpy در ایران منتشر شده است که گفته میشود از سوی پلیس سایبری ایران طراحی شده و مرکز کنترل و فرمان این جاسوس افزار، مراکز فرماندهی پلیس استانها بوده است.

همچنین ذکر شده است که این جاسوس افزار در قالب نرم افزار هایی مانند Psiphon ، Fake Call ، Currency Converter Pro و Call Service و CPU-Z و برخی دیگر، قرار گرفته و منتشر شده است.

در این گزارش مطرح شده است که متهمانی که دستگیر می شده اند، بر روی گوشی آنها این جاسوس افزار نصب می شده و اقدام به جاسوسی میکرده است، اطلاعات مورد جاسوسی، موقعیت مکانی، تاریخچه تماس ها، لیست مخاطبین، ضبط کلید های کیبورد، تاریخچه مرورگر ها، ضبط صدا از میکروفون، تهیه اسکرین شات و ضبط مکالمات VoIP از گوشی های اندرویدی بوده است.

در بررسی تکنیکال این جاسوس افزار مشخص شده است که یک تابع با نام onDestroy تعریف شده است که در صورت راه اندازی مجدد، فراخوانی شده و یک Broadcast را اجرا و سرویس خود را آغاز می نماید.

@Engineer_Computer

🤯2👍1🔥1

333 views14:32

About

Blog

Apps

Platform