Threat-Hunting

위협 헌팅 | 탐지 엔지니어링 위협 헌팅 및 탐지 쿼리 모음: CrowdStrike Falcon CQL – CrowdStrike Query Language 사용 Microsoft Defender XDR KQL – Kusto Query Language 사용 의심스러운 프로세스, 비정상적인 네트워크 동작, LoLBinsLiving-off-the-Land 바이너리, 지속성 메커니즘, 자격 증명 액세스, 측면 이동, C2 활동, 잠재적 APT 행위를 표면화하는 것을 목표로 합니다. 가능한 경우 모든 내용은 MITRE ATT &CK 기...

redsun-bluehammer-undefend-detection-pack

RedSun、BlueHammer、UnDefend、およびCrossFamily検出パック 重要:...

Unified security operations with Microsoft Sentinel and Microsoft Defender XDR

Numerous cybersecurity tools exist to help organizations protect their data, people, and systems. There are different tools that check emails for phishing attempts, secure infrastructure and cloud, and provide generative AI to detect threats and uplevel response beyond human ability. While each o...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...