resources

Cisco Talos 2023 Year in Review

China

Russia

Middle Eastbased APTs

LockBit

MITRE ATT&CK

The Cisco Talos 2023 Year in Review report provides insights into the current threat landscape, including top threats, attacker trends, and notable malware. Key findings include the prevalence of the LockBit ransomware group, defense evasion tactics in the top 20 MITRE ATT&CK techniques, and publicfacing application exploits and compromised credentials as common initial access vectors. The report offers more indepth analysis and can be downloaded from the provided link.

CVE Crowd | Currently Discussed CVEs in the Fediverse

CVEs

Fediverse

Monitoring

IT security

CVE Crowd is a website that lists currently discussed CVEs on the Fediverse, providing valuable information for IT security professionals. Inspired by http//cvetrends.com/, it monitors CVE mentions in realtime on platforms like Mastodon. Users can join the discussion on infosec.exchange and are encouraged to tag posts with CveCrowdDeny or NoBot to exclude them from the website. The developer is Konstantin, and questions or bug reports can be sent to @kpwn or reported on GitHub.

GreyNoise is the source for understanding internet noise

Understanding

Internet

Noise

Security

Threats

GreyNoise is a trusted source for understanding internet noise. They collect, analyze, and label data on IPs that scan the internet, helping analysts focus on real threats. Their services include maximizing SOC efficiency, defending against mass exploitation, and contextualizing and automating threat hunting. GreyNoise offers insight through their API, integrations, and Visualizer. They have integrations with tools like Splunk and XSOAR, and their customers have reported significant reductions in noisy alerts. Sign up or contact GreyNoise to start using their services.

CISA Releases Joint Guide for Software Manufacturers The Case for Memory Safe Roadmaps | CISA

Secure by Design

Memory Safe Roadmaps

CSuite Executives

Technical Experts

Memory Safe Coding

CISA, in collaboration with several partners, has released a joint guide titled “The Case for Memory Safe Roadmaps,” which highlights the importance of memory safe coding for software manufacturers. The guide provides steps for transitioning to memory safe programming languages (MSLs) to eliminate memory safety vulnerabilities. CISA and its partners encourage software manufacturers to implement memory safe roadmaps to enhance security and prevent cyber attacks.

Cybersecurity & Infrastructure Security Agency (CISA)

Splunk Cheat Sheet Search and Query Commands

Logging

Splunk

This document is a cheat sheet for using Splunks search and query commands. It provides examples and explanations for various commands, including basic filtering, statistical and graphing functions, and configuration settings. It also includes information on capacity planning and frequently asked questions about Splunk. The cheat sheet covers a wide range of topics to help users navigate and utilize Splunk effectively.

AWS Kill Switch Open-source incident response tool - Help Net Security

AWS

IAM

IR

AWS Kill Switch is an open-source incident response tool designed to lock down AWS accounts and IAM roles during security incidents. The tool includes a Lambda function and a proof of concept client, allowing for quick containment and detachment of policies and roles. The creator, Jeffrey Lyon, plans to improve the tool over time and expand its capabilities based on community feedback. The tool can be accessed for free on GitHub.

helpnetsecurity.com

Essential SSPM | Wing Security

IAM

Wing Security requires Admins/Super Admins to grant permissions for accessing and monitoring SaaS applications connected to your Google or Microsoft environment. For Google, Wing Security can discover applications, permissions, and user actions, while for Office 365, it can discover applications and monitor user actions. Specific permissions and steps for connecting are provided for each platform.

Sysmon for Linux

Sysmon

Linux

Microsoft

MSTIC-Sysmon for Linux is an open-source system monitor tool that collects security events from Linux environments using eBPF and sends them to Syslog. It allows programmers to write code executed in kernel space for added capabilities and event-driven programs. Resources include Sysmon configurations and event schemas.

Parse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation

Citrix

Netscaler

Perl

This script parse citrix netscale syslog files and looks for session reconnects that might be the result of a CVE-2023-4966 exploitation.

CERT.at - national CERT of Austria

Scripts to scan for Microsoft Exchange Vulnerabilities

Exchange

Microsoft

Python

In 2021 several dangerous and widely exploited vulnerabilities for Microsoft Exchange servers have been published. This repository provides scripts to scan for CVE-2021-26855: The SSRF vulnerability which is the entry point for the ProxyLogon exploit chain. CVE-2021-34473: The pre-auth path confusion which is the entry point for the ProxyShell exploit chain. CVE-2021-33766: The ProxyToken vulnerability which enables an unauthenticated attacker to perform configuration actions on mailboxes belonging to arbitrary users.

CERT.at - national CERT of Austria

Logging Made Easy

Logging

Microsoft

Windows

Elasticsearch

Initially created by NCSC and now maintained by CISA, Logging Made Easy is a self-install tutorial for small organizations to gain a basic level of centralized security logging for Windows clients and provide functionality to detect attacks. It’s the coming together of multiple free and open software platforms, where LME helps the reader integrate them together to produce an end-to-end logging capability. We also provide some pre-made configuration files and scripts, although there is the option to do it on your own.

Cybersecurity & Infrastructure Security Agency (CISA)