DCShadow

The DCShadow is an attack which tries to modify existing data in the Active Directory by using legitimate API's which are used by domain controllers. This technique can be used in a workstation as a post-domain compromise tactic for establishing domain persistence bypassing most SIEM solutions...

DCSYNCMonitor - Monitors For DCSYNC And DCSHADOW Attacks And Create Custom Windows Events For These Events

This tool is an application/service that can be deployed on Domain controllers to alert on Domain Controller Syncronization attempts. When an attempt is detected, the tool will write an event to the Windows Event Log. These events can be correlated in a SIEM. In addition, this tool can take a lis...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to...

CVE-2015-2009

Cross-site request forgery CSRF vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to...

CVE-2015-2009

Cross-site request forgery CSRF vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to...

CVE-2015-2009

CVE-2015-2009 concerns IBM QRadar SIEM: a CSRF in the xmlrpc.cgi service allows an attacker to hijack user authentication for requests that insert XSS sequences. Affected: QRadar 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4. Impact described as authentication hijack via C...

CVE-2015-2009: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to...

PT-2018-4359

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.1 before MR2 Patch 11 Interim Fix 02 IBM QRadar SIEM versions 7.2.x before 7.2.5 Patch 4 Description A cross-site request forgery CSRF issue exists in the xmlrpc.cgi service, allowing remote attackers to hijack the...

My short review of “IDC Worldwide Security and Vulnerability Management Market Shares 2016”

On February 12 IDC published new report about Security and Vulnerability Management market. You can buy it on the official website for $4500. Or you can simply download free extract on Qualys website Thanks, Qualys!. I've read it and now I want to share my impressions. I think it's better start...

sigma - Generic Signature Format for SIEM Systems

Generic Signature Format for SIEM Systems. What is Sigma? Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this...

Building an incident response program: creating the framework

In part one of our series, our overview of Building an incident response plan, we discussed what regulations organizations will need to meet in order to address incident/breach response protocols laid out in the EU’s General Data Protection Regulation GDPR. This week, we’ll talk to you about step...

Security Glue Between the Silos of Endpoint, Server, Cloud and Network Security Gets More Critical

Endpoint and Host security techniques have diverged. There used to be considerable similarity between the techniques and tools used to secure desktops, servers, and even networks. Desktops evolved to become Endpoints, as mobile devices proliferated and they were assembled into a collective of bei...

Generic Signature Format for SIEM Systems: Sigma

Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers ...

ACE - Automated, Collection, and Enrichment Platform

The Automated Collection and Enrichment ACE platform is a suite of tools for threat hunters to collect data from many endpoints in a network and automatically enrich the data. The data is collected by running scripts on each computer without installing any software on the target. ACE supports...

The Automated Collection and Enrichment Platform: ACE

The Automated Collection and Enrichment ACE platform is a suite of tools for threat hunters to collect data from many endpoints in a network and automatically enrich the data. The data is collected by running scripts on each computer without installing any software on the target. ACE supports...

Microsoft security solutions against ransomware and APT

Last Tuesday I was invited to Microsoft business breakfast "Effective protection against targeted and multilevel attacks". Here I would like to share some of my thoughts on this. Need to mention that the food was delicious and the restaurant of Russian Geographical Society is a very lovely place...

Boost productivity of your DevOps teams and deliver superior digital experiences with Akamai Cloud Delivery Platform - Part 3

In the first and second part of this blog series, we discussed the challenges associated with cloud adoption and how you can leverage Akamai Cloud Delivery Platform, the world's largest and most trusted cloud delivery platform, to achieve the scalability, availability, reliability, security and...

IBM QRadar SIEM and QRadar Incident Forensics Input Validation Vulnerabilities

IBM QRadar SIEM and QRadar Incident Forensics are both products of IBM USA. The former is a suite of solutions that utilize security intelligence to protect assets and information from advanced threats; the latter is a suite of security forensic investigation software. An input validation...

Maximize security insights by integrating threat intelligence data from Akamai with your SIEM

Since 2005, when Gartner coined the term, SIEM Security Information and Event Management solutions have grown in importance for the security industry. SIEM solutions provide a centralized view to easily access and analyze security information from multiple sources, and then prioritize mitigation...

ISACA Moscow Vulnerability Management Meetup 2017

Last Thursday, I attended a very interesting event entirely dedicated to Vulnerability Management - open ISACA Moscow meetup. Me and my former colleague from Mail.Ru Group Dmitry Chernobaj presented there our joint report "Enterprise Vulnerability Management: fancy marketing brochures and the...