ThreatHunting

The ThreatHunting Project An informational repo about hunting for adversaries in your IT environment. Be sure to visit ThreatHunting.net for more info about this repo. License Here's the deal, in plain English: This repo is here for the community. You are free to use it for personal or commercial...

columbo

Columbo Columbo는 손상된 데이터셋에서 특정 패턴을 식별하고 단순화하는 데 사용되는 컴퓨터 포렌식 분석 도구입니다. 데이터를 작은 섹션으로 나누고 패턴 인식 및 머신 러닝 모델을 사용하여 손상된 Windows 플랫폼에서 공격자의 행동과 가능한 위치를 제안 형태로 식별합니다. 현재 Columbo는 Windows 플랫폼에서 작동합니다. 종속성 및 고수준 아키텍처 Columbo는 데이터를 추출하기 위해 volatility 3, autorunsc.exe 및 sigcheck.exe에 의존합니다. 따라서 사용자는 이러한 종속...

Optimal Routing and Link Configuration for Covert Heterogeneous Wireless Networks in the Presence of a Friendly Jammer

In modern radio networks, nodes frequently access multiple communication interfaces such as WiFi, cellular, LoRa, and Zigbee. Optimal utilization of such heterogeneous networks HetNets at link and network levels is essential for ensuring efficient and secure communication. Some applications requi...

BEC-ware the phish (part 1). Investigating incidents in M365

TL;DR Review the key artefacts to ensure the best possible telemetry is available in the case of a Business Email Compromise BEC. Keep an eye on data retention, where necessary export or forward data for investigations longer than 30 days. Verify and enable Unified Audit Logging, its free and giv...

How an incident response retainer can drive proactive security

Weve written before about the importance of taking a proactive approach to cybersecurity. Whether it be threat hunting, an active defense posture or just improving security instrumentation alerts and logs an organization keeps, its best for every user -- no matter the size -- to be prepared for...