Andrew Macpherson on Intelligence Gathering with Maltego

Ryan Naraine talks with Operations Manager at Paterva Andrew Macpherson who outlines the details of the “Digital Intelligence Gathering using Maltego” course being offered at the SAS 2017 and talks about the benefits for data mining by pen testers, malware analysts and law enforcement agencies...

Free Open Source Scalable Incident Response Platform: The Hive

Free Open Source Scalable Incident Response Platform TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHi...

Windows Forensic Data Collection: IR-rescue

Windows Forensic Data Collection ir-rescue is a Windows Batch script that collects a myriad of forensic data from 32-bit and 64-bit Windows systems while respecting the order of volatility. It is intended for incident response use at different stages in the analysis and investigation process. It...

Analyzing the Malware Analysts – Inside FireEye’s FLARE Team

At the Black Hat USA 2016 conference in Las Vegas last week, I was fortunate to sit down with Michael Sikorski, Director, FireEye Labs Advanced Reverse Engineering FLARE Team. During our conversation we discussed the origin of the FLARE team, what it takes to analyze malware, Michael’s book...

Amazon Same Day Credential Shipping

FireEye has identified a campaign involving phishing websites that appear as legitimate Amazon sites. Amazon is the largest online retailer and threat actors frequently target its customers. In this attack, a person browsing the internet would be directed to authentic looking – yet fake – Amazon...

Amazon Same Day Credential Shipping

FireEye has identified a campaign involving phishing websites that appear as legitimate Amazon sites. Amazon is the largest online retailer and threat actors frequently target its customers. In this attack, a person browsing the internet would be directed to authentic looking – yet fake – Amazon...

Malware-Laced Porn Apps Behind Wave of Android Lockscreen Attacks

Incidents of Android lockscreen malware masquerading as porn apps are a growing concern to security analysts who are forecasting an uptick in attacks. Once infected, Android users bitten by this malware appear to be locked out of their device and are forced to undergo a complex extraction of the...

NSA & CIA Analysts Watching Porn, A Lot of Porn, More Than You Could Ever

U.S. National Security Agency NSA is infamous for conducting Global Mass Surveillance to snoop secretly on users' online communications, phone calls, private instant messages, and personal emails, but there is something shocking about it. The Security Agency also asked its employees to watch Porn...

Hackers' Op-Sec Failures Important Clues to Uncover APT Gangs

CANCUN – Sophistication, resourcefulness and ingenuity are characteristics usually associated with state-sponsored espionage hacker groups. But they’re certainly not infallible. Like most detective work, security analysts generally are able to toss back the covers on APT campaigns and major...

WiFi software Acrylic WiFi Free v2.1 - WiFi analyzer software and WLAN scanner for network analysts

Acrylic WiFi Professional is the best WiFi analyzer software to identify access points and wifi channels, and to analyze and resolve incidences on 802.11a/b/g/n/ac wireless networks in real time. It is a perfect tool for advanced users and professional WiFi network analysts and administrators to...

Driving a Collectively Stronger Security Community with Microsoft Interflow

Today, Microsoft is pleased to announce the private preview of Microsoft Interflow, a security and threat information exchange platform for analysts and researchers working in cybersecurity. Interflow uses industry specifications to create an automated, machine-readable feed of threat and securit...

Automater v2.0 - URL/Domain, IP Address, and Md5 Hash OSINT Tool

Automater is a URL/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts. Given a target URL, IP, or HASH or a file full of targets Automater will return relevant results from sources like the following: IPvoid.com, Robtex.com,...

Threat Outbreak Alert: Fake Product Purchase Order Request Email Messages on May 22, 2014

Medium Alert ID: 34332 First Published: 2014 May 22 12:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product purchase order request for the recipient. The email message attempts to convince the recipient to open t...

Threat Outbreak Alert: Fake Contract Delivery Notice Email Messages on May 21, 2014

Medium Alert ID: 34319 First Published: 2014 May 21 14:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to French-language spam email messages that claim to contain a contract notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bank Transfer Slip Email Messages on May 15, 2014

Medium Alert ID: 34250 First Published: 2014 May 16 13:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank transfer slip for the recipient. The text in the email message attempts to convince the recipient to open t...

Threat Outbreak Alert: Fake Malicious Attachment Notification Email Messages on March 1, 2014

Medium Alert ID: 33144 First Published: 2014 March 3 15:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain an attachment for the recipient. The text in the email message attempts to convince the recipient...

[Rhino] Java Script Deobfuscate Tool

Rhino is an open-source implementation of JavaScript written entirely in Java. It is typically embedded into Java applications to provide scripting to end users. It is embedded in J2SE 6 as the default Java scripting engine. Rhino-debugger is a Graphical User Interface GUI that enables to debug...

Threat Outbreak Alert: Fake Product Quotation Email Messages on November 21, 2013

Medium Alert ID: 31866 First Published: 2013 November 22 13:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a product quotation request for the recipient. The text in the email message attempts to convince the recipie...

Threat Outbreak Alert: Fake Tax Payment Failure Notification Email Messages on November 11, 2013

Medium Alert ID: 31722 First Published: 2013 November 12 14:35 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a tax payment failure notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Invoice Notification Email Messages on October 24, 2013

Medium Alert ID: 31493 First Published: 2013 October 25 14:19 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain an electronic invoice notification for the recipient. The text in the email message attemp...