osxcollector

OSXCollector 手册 OSXCollector 是一个面向 OS X 的取证证据收集与分析工具包。 取证收集 收集脚本在可能受感染的机器上运行，并输出描述目标机器的 JSON 文件。OSXCollector 从 plist、SQLite 数据库和本地文件系统中收集信息。 取证分析 借助取证收集的结果，分析师可以回答此类问题： 这台机器被感染了吗？ 那个恶意软件是怎么进入的？ 如何防止和检测进一步的感染？ Yelp 对大多数 OSXCollector 运行结果进行自动化分析，将其输出转换为易读且可操作的摘要，仅聚焦于可疑内容。请查看 OSXCollector Output...

An In-Kernel Forensics Engine for Investigating Evasive Attacks

Over the years, adversarial attempts against critical services have become more effective and sophisticated in launching low-profile attacks. This trend has always been concerning. However, an even more alarming trend is the increasing difficulty of collecting relevant evidence about these attack...

6 Steps to Effectively Threat Hunting: Safeguard Critical Assets and Fight Cybercrime

Finding threat actors before they find you is key to beefing up your cyber defenses. How to do that efficiently and effectively is no small task – but with a small investment of time, you can master threat hunting and save your organization millions of dollars. Consider this staggering statistic...

Enabling Clients to Cope with ASV Scans

Gathering evidence, applying patches, and configuring your systems in preparation for submitting your vulnerability disputes can be a nerve-wracking and daunting task. To better enhance your understanding of the Approved Scanning Vendor ASV process, Ive outlined some coping mechanisms and tools t...

Metasploit Pro 4.0 released - Enterprise Integration, Cloud Deployment & Automation

Metasploit Pro 4.0 released - Enterprise Integration, Cloud Deployment & Automation Rapid7 launched Metasploit Pro 4.0, a penetration testing solution that provides security professionals with a better view of their threat landscape by integrating with more than a dozen vulnerability management...