SOAR (Security Orchestration Automation and Response)

SOAR — bu Security Orchestration Automation and Response iborasining qisqartmasi bo‘lib, muhitdagi xavfsizlik mahsulotlari va vositalarini bir-biri bilan integratsiyalashga imkon beradi. Bu SOC jamoasi a'zolarining vazifalarini soddalashtiradi. Masalan, SOAR SIEM alertidagi manba IP-ni VirusTotal orqali avtomatik ravishda tekshiradi va bu orqali SOC tahlilchisi ish yukini kamaytiradi.

Sanoatda keng qo‘llaniladigan ba'zi SOAR mahsulotlari:

Splunk Phantom
IBM Resilient
Logsign
Demisto

#BlueTeam #SOC #SOAR

Centralization (Kerakli hamma narsa uchun yagona platforma)

SOAR turli xavfsizlik vositalarini (sandbox, loglarni boshqarish, uchinchi tomon vositalari va boshqalar) birlashtiruvchi yagona dasturiy ta'minotni taqdim etadi. Ushbu vositalar SOAR yechimiga integratsiya qilinadi va bitta platformada ishlatilishi mumkin.

Playbooks
SOAR ichida turli vaziyatlar uchun yaratilgan playbooklar yordamida SIEM alertlarini osonlikcha tekshirishingiz mumkin. Agar barcha jarayonlarni bilmasangiz yoki eslay olmasangiz ham, playbooklarda ko‘rsatilgan bosqichlarni bajarib, tahlilni amalga oshirishingiz mumkin.

#BlueTeam #SOC #SOAR

LeakIX — это мощная платформа для поиска и мониторинга утечек данных, которая активно используется специалистами по информационной безопасности и OSINT-исследователями

https://leakix.net/

#OSINT #TOOLS #LEAKIX

29 Addresses to Analyze Malware Faster

Anlyz
Any.run
Comodo Valkyrie
Cuckoo
Hybrid Analysis
Intezer Analyze
SecondWrite Malware Deepview
Jevereg
IObit Cloud
BinaryGuard
BitBlaze
SandDroid
Joe Sandbox
AMAaaS
IRIS-H
Gatewatcher Intelligence
Hatching Triage
InQuest Labs
Manalyzer
SandBlast Analysis
SNDBOX
firmware
opswat
virusade
virustotal
malware config
malware hunter team
virscan
jotti

#BlueTeam #Malware #Analys

Registrlar Windows operatsion tizimlarida ma'lumot saqlash uchun ishlatiladigan ierarxik ma'lumotlar bazalaridir. Ularni hujumchilar ma'lumot o'g'irlash va davomiylikni ta'minlash kabi maqsadlarda ishlatishadi.

Windows operatsion tizimi ishga tushirilganda ishlashi kerak bo'lgan dasturlarni ba'zi registr kalitlarida saqlaydi. Hujumchilar operatsion tizimning bu xususiyatidan foydalanib, o'z zararli dasturlarini bu registr kalitlariga qo'shib, davomiylikni ta'minlashni reja qiladilar.

Ba'zi registr kalitlari quyidagilar:

- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Registrlar normal jarayonlar tomonidan ham ko'p ishlatiladi, shuning uchun ayniqsa zararli dastur(Malware) jarayonlari tomonidan qilingan registr o'zgarishlarini tekshirish kerak.

Zararli dastur registrlarga qilgan o'zgarishlarini aniqlash uchun Regshot nomli dasturdan foydalanishingiz mumkin.

https://sourceforge.net/projects/regshot/

#BlueTeam #SOC #Regedit

Windowsda Startup nomli katalog mavjud. Malware o'zini davomiy ravishda avtomatik ishga tushishini ta'minlash uchun, o'zini Startup katalogiga ham nusxalashi mumkin. Ushbu kataloglarda bajarilgan faoliyatlarga e'tibor qaratish kerak.

Ushbu kataloglarga kirish uchun "Win + R" tugmalarini bosib, keyin quyidagi komandalarni yozishingiz mumkin:

shell:startup
shell:common startup

#BlueTeam #Dynamic_Malware_Analys #Startup

https://habr.com/ru/companies/timeweb/articles/664048/

#OSINT #Geonit

https://docs.remnux.org/install-distro/get-virtual-appliance

Secure sandbox environment REMnux for Dynamic Malware Analys

#BlueTeam #Malware #Analys #Sandbox

Oletools — bu MS OLE2 fayllarini (Structured Storage, Compound File Binary Format) va MS Office hujjatlarini tahlil qilish uchun Python vositalari to‘plami bo‘lib, u zararli dasturlarni tahlil qilish, forensika va debugging uchun ishlatiladi.

https://github.com/decalage2/oletools?tab=readme-ov-file

#BlueTeam #Malware #Analys

#BlueTeam #Splunk

#Recon #Shodan

#Log #Types

#HTB #OSCP

Active Directory Penetration Tester by HTB Academy, 2024

Using TLDFinder with the Netlas Module 🔍

Check out our latest article, where we walk you through setting up ProjectDiscovery TLDFinder and using it alongside Netlas data for top-level domains and subdomains searching.

👉 Read now: https://netlas.io/blog/tldfinder_and_netlas/

Further reading
The following are important resources to improve technical skills and be well-prepared to start as a
bug hunter:

Books
OWASP testing guide: https://www.owasp.org/index.php/OWASP_Testing_Project
OWASP mobile testing guide: https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide

Writeups
Hackerone Hacktivity: https://hackerone.com/hacktivity
Google VRP Writeups: https://github.com/xdavidhu/awesome-google-vrp-writeups

Blogs and articles
Hacking articles: https://www.hackingarticles.in/
Vickie Li blogs: https://vickieli.dev/
Bugcrowd blogs: https://www.bugcrowd.com/blog/
Intigriti blogs: https://blog.intigriti.com/
Portswigger blogs: https://portswigger.net/blog

Capture the flag (CTF)
Hacker 101: https://www.hackerone.com/hackers/hacker101
Pico CTF: https://picoctf.org/
Try Hack Me: https://tryhackme.com/ (premium/free)
Hack the Box: https://www.hackthebox.com/ (premium)
VulnHub: https://www.vulnhub.com/
Hack This Site: https://hackthissite.org/
CTF Challenge: https://app.hackinghub.io/
Pentester Lab: https://pentesterlab.com/pro

Online labs
PortSwigger Web Security Academy: https://portswigger.net/web-security
OWASP Juice Shop: https://owasp.org/www-project-juice-shop/
XSS Game: https://xss-game.appspot.com/
Bug Bounty Hunter: https://www.bugbountyhunter.com/ (premium)
W3Challs: https://w3challs.com/

Offline labs
DVWA: https://github.com/digininja/DVWA
bWAPP: https://www.itsecgames.com/
Metasploitable 2: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/
Bug Bounty Hunter: https://www.bugbountyhunter.com/ (premium)
W3Challs: https://w3challs.com/

YouTube channels
IppSec: https://www.youtube.com/c/ippsec
Live Overflow: https://www.youtube.com/c/LiveOverflow
Pwn Function: https://www.youtube.com/channel/UCW6MNdOsqv2E9AjQkv9we7A
Bug Bounty Reports Explained: https://www.youtube.com/@BugBountyReportsExplained

Training
Udemy: https://www.udemy.com/courses/search/?src=ukw&q=bug+bounty
GPEN: https://www.giac.org/certifications/penetration-tester-gpen/
GWAPT: https://www.giac.org/certifications/web-application-penetration-tester-gwapt/
GXPN: https://www.giac.org/certifications/exploit-researcher-advanced-penetration-tester-gxpn/
OSCP: https://www.offsec.com/courses/pen-200/
OSWE: https://www.offsec.com/courses/web-300/
CEH: https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/

Congress
BlackHat: https://www.blackhat.com/
DefCON: https://defcon.org/index.html
RootedCON: https://www.rootedcon.com

#Pentest #Learn

 SOC Analyst Roadmap for 2025: Your Step-by-Step Self-Study Guide

https://infosecwriteups.com/soc-analyst-roadmap-for-2025-your-step-by-step-self-study-guide-f302841f36a0?source=rss----7b722bfd1b8d---4

#BlueTeam #SOC