Why Cool Dashboards Don’t Equal Effective Security Analytics

Mark Twain once said, “Data is like garbage. You’d better know what you are going to do with it before you collect it.” This statement rings true in todays cybersecurity landscape. Security professionals are inundated with a flood of data, and often, they dont know how to make sense of it. To add...

CVE-2023-34034

creationtimestamp| type| source ---|---|--- 2023-07-19 18:21:56+00:00| seen| https://t.me/cibsecurity/67011 2023-08-08 21:07:53+00:00| published-proof-of-concept| https://t.me/proxybar/1662 2023-08-08 23:19:26+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/7629 2023-08-09...

Managed Detection and Response in 2022

Kaspersky Managed Detection and Response MDR is a service for 24/7 monitoring and response to detected incidents based on technologies and expertise of Kaspersky Security Operations Center SOC team. MDR allows detecting threats at any stage of the attack – both before anything is compromised and...

CVE-2023-26067

creationtimestamp| type| source ---|---|--- 2023-04-11 00:22:46+00:00| seen| https://t.me/cibsecurity/61798 2023-09-19 08:50:09+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/lexmarkfaxtracesettings.rb 2024-01-26 17:05:27+00:00|...

CVE-2015-2291

creationtimestamp| type| source ---|---|--- 2023-01-12 18:05:06+00:00| exploited| https://t.me/truesecator/3932 2023-02-10 11:10:31+00:00| seen| MISP/9170cfc5-2232-445c-bca8-923516dfdd3f 2023-02-13 12:15:03+00:00| exploited| https://t.me/itsecnews/2187 2023-06-14 21:10:03+00:00| seen|...

Talos Year in Review 2022

This report represents an unprecedented effort within Cisco to tell a comprehensive story of our work in the past year, relying on a wide variety of data and expertise. Download the Report As a large security organization with global reach, the data we use as the basis for our research presents u...

Attack Analytics Helps You Find the Monsters Under the Bed

Alert fatigue kills data breach detection efforts Is there anything more frightening than missing a cyber attack? For most organizations, the answer is no. However, for many security teams, it’s challenging to tune alerts properly to minimize false positives and still be alerted to potential...

CVE-2022-31137

creationtimestamp| type| source ---|---|--- 2022-07-09 00:22:27+00:00| seen| https://t.me/cibsecurity/45849 2022-07-25 21:30:57+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/roxywiexec.rb 2022-12-26 15:30:06+00:00| seen|...

Business Logic Errors

Description In Dolibarr v14.0.5, any low privileged users could update their login name which should only be updated by admin. Proof of Concept POST /dolibarr/user/card.php?id=2 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:97.0 Gecko/20100101 Firefox/97.0...

Threat Source Newsletter (Jan. 27, 2022)

Newsletter compiled by Jon Munshaw.Good afternoon, Talos readers. It's great to have New Year's resolutions and all. But we don't want you taking the wrong lessons away from 2021, either. Like just because Log4j happened doesn't mean you should stop logging or stop using open-source... This is on...

CVE-2021-27860

creationtimestamp| type| source ---|---|--- 2021-12-08 20:22:49+00:00| seen| https://t.me/cibsecurity/33616 2023-05-25 16:46:30+00:00| seen| MISP/7544e906-dfda-47ae-ae7b-3ec0d5e26b56 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 17:04:48+00:00| seen|...

CVE-2018-2380

creationtimestamp| type| source ---|---|--- 2021-11-08 08:58:19+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-04 00:07:44+00:00| seen| https://t.me/arpsyndicate/1065 2024-12-24 20:22:01+00:00| seen|...

Threat hunting in large datasets by clustering security events

By Tiago Pereira. Security tools can produce very large amounts of data that even the most sophisticated organizations may struggle to manage. Big data processing tools, such as spark, can be a powerful tool in the arsenal of security teams.This post walks through threat hunting on large...

Siemens Desigo CC Series CCOM Communication Component Deserialization Vulnerability

Cerberus DMS is a hazard management station that helps users manage fire safety and security incidents.Desigo CC is an integrated building management platform for managing high-performance buildings.Desigo CC Compact expands the portfolio with solutions tailored for small and medium-sized...

Sharing the first SimuLand dataset to expedite research and learn about adversary tradecraft

Last month, we introduced the SimuLand project to help security researchers around the world deploy lab environments to reproduce well-known attack scenarios, actively test detections, and learn more about the underlying behavior and implementation of adversary techniques. Since the release of th...

Fortinet FortiManager and Fortinet FortiAnalyzer Environment Issue Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. Fortinet FortiAnalyzer is a centralized network security reporting solution that allows for centralized management of any number of Fortinet devices and the ability to group devices into different...

CVE-2021-3490

creationtimestamp| type| source ---|---|--- 2021-07-30 07:13:19+00:00| published-proof-of-concept| https://t.me/linkersec/98 2021-07-30 19:51:20+00:00| seen| https://t.me/ctinow/37820 2021-08-31 23:56:20+00:00| seen|...

CVE-2021-30563

creationtimestamp| type| source ---|---|--- 2021-07-16 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=613 2021-07-16 07:11:18+00:00| exploited| https://t.me/thehackernews/1372 2021-07-16 10:57:01+00:00| exploited| https://t.me/cKure/6187 2021-07-20 04:00:00+00:00| seen|...

CVE-2021-33771

creationtimestamp| type| source ---|---|--- 2021-07-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=608 2021-07-14 22:25:09+00:00| seen| https://t.me/cibsecurity/26158 2021-07-15 10:13:10+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus21/2021...

RATCF 授权问题漏洞

RATCF is an open source framework for hosting Cyber-Security Capture the Flag events. RATCF suffers from an authorization issue vulnerability that originates from the fact that a user with multi-factor authentication enabled can log in without a valid token...