What's New in InsightIDR: Q3 2021 in Review

This post offers a closer look at some of the recent updates and releases in InsightIDR, our extended detection and response solution, from Q3 2021. Welcome IntSights to the Rapid7 Insight Platform family! As you may have seen in recent communications, Rapid7 acquired IntSights, a leading provide...

The Ransomware Killchain: How It Works, and How to Protect Your Systems

Much ado has been made by this very author on this very blog! about the incentives for attackers and defenders around ransomware. There is also a wealth of information on the internet about how to protect yourself from ransomware. One thing we want to avoid losing sight of, however, is just how w...

Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

ARCHIVED STORY Operation ‘Harvest’: A Deep Dive into a Long-term Campaign By Christiaan Beek · September 14, 2021 A special thanks to our Professional Services’ IR team, ShadowServer, for historical context on C2 domains, and Thomas Roccia/Leandro Velasco for malware analysis support. Executive...

Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

ARCHIVED STORY Operation ‘Harvest’: A Deep Dive into a Long-term Campaign By Christiaan Beek · September 14, 2021 A special thanks to our Professional Services’ IR team,ShadowServer, for historical context on C2 domains, and Thomas Roccia/Leandro Velasco for malware analysis support. Executive...

Command injection

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code...

Command injection

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code...

Holy Grail of Security: Answer to ‘Did X Work?’ – Podcast

Get a glass. Pour in one shot of VERIS, aka the Vocabulary for Event Recording and Incident Sharing engine that generates Verizon’s funny, well-written, incredibly useful, annual Database Investigations Report DBIR. Next, add a shot of MITRE ATT&CK: the curated knowledge repository of reported...

Optimize Your Incident Response Planning with the MITRE Framework

Threat research experts discuss the evolving landscape and how the MITRE ATT framework can help optimize incident response across your organization...

Tenacity – An Adversary Emulation Tool for Persistence

Persistence is one of the more sought-after techniques of an attacker or adversary. Persistence is achieved through a set of tactics or techniques that adversaries use to maintain their foothold on compromised systems across restarts, changed credentials, and other interruptions that could cut of...

Dorothy - Tool To Test Security Monitoring And Detection For Okta Environments

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

The evolution of a matrix: How ATT&CK for Containers was built

Note: The content of this post is being released jointly with the Center for Threat-Informed Defense. It is co-authored with Chris Ante and Matthew Bajzek. The Center post can be found here. As containers become a major part of many organizations’ IT workloads, it becomes crucial to consider the...

The evolution of a matrix: How ATT&CK for Containers was built

Note: The content of this post is being released jointly with the Center for Threat-Informed Defense. It is co-authored with Chris Ante and Matthew Bajzek. The Center post can be found here. As containers become a major part of many organizations’ IT workloads, it becomes crucial to consider the...

Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013

Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. Note: CISA released technical information, including indicators of compromise IOCs,...

Managed Detection and Response in Q4 2020

Download full report PDF As cyberattacks become more sophisticated, and security solutions require more resources to analyze the huge amount of data gathered every day, many organizations feel the need for advanced security services that can deal with this growing complexity in real time, 24/7...

Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department

Summary This Joint Cybersecurity Advisory was written by the Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA to provide information on a Chinese Advanced Persistent Threat APT group known in open-source reporting as APT40. This advisory provides...

capa 2.0: Better, Stronger, Faster

We are excited to announce version 2.0 of our open-source tool called capa. capa automatically identifies capabilities in programs using an extensible rule set. The tool supports both malware triage and deep dive reverse engineering. If you haven’t heard of capa before, or need a refresher, check...

CISA Releases Analysis of FY20 Risk and Vulnerability Assessments

CISA has released an analysis and infographic detailing the findings from the Risk and Vulnerability Assessments RVAs conducted in Fiscal Year FY 2020 across multiple sectors. The analysis details a sample attack path a cyber threat actor could take to compromise an organization with weaknesses...

This Week in Security News July 2, 2021

Nefilim ransomware attack through a MITRE Att lens and PoC exploit circulating for critical Windows Print Spooler bug, and more...

MITRE ATT&CK® mappings released for built-in Azure security controls

The Security Stack Mappings for Azure research project was published today, introducing a library of mappings that link built-in Azure security controls to the MITRE ATT&CK® techniques they mitigate against. Microsoft once again worked with the Center for Threat-Informed Defense and other Center...

MITRE ATT&CK® mappings released for built-in Azure security controls

The Security Stack Mappings for Azure research project was published today, introducing a library of mappings that link built-in Azure security controls to the MITRE ATT&CK® techniques they mitigate against. Microsoft once again worked with the Center for Threat-Informed Defense and other Center...