Attack Surface Analysis Part 3: Red and Purple Teaming

Part 3: Red and Purple Teaming This is the third and final installment in our 2021 series around attack surface analysis. In part 1 I offered a description and the value and challenge of vulnerability assessment. Part 2 explored the why and how of conducting penetration testing and gave some tips...

WeLeakInfo Leaked Customer Payment Info

A little over a year ago, the FBI and law enforcement partners overseas seized WeLeakInfo.com, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to...

Talkin’ SMAC: Alert Labeling and Why It Matters

If you’ve ever worked in a Security Operations Center SOC, you know that it’s a special place. Among other things, the SOC is a massive data-labeling machine, and generates some of the most valuable data in the cybersecurity industry. Unfortunately, much of this valuable data is often rendered...

CVE-2015-1341

creationtimestamp| type| source ---|---|--- 2019-04-22 20:30:40+00:00| seen| https://t.me/cibsecurity/3855 2019-04-29 18:27:21+00:00| seen| https://t.me/cibsecurity/3995...

CB ThreatHunter: Now Available on the CB Predictive Security Cloud (PSC)

Today Carbon Black is announcing the general availability of CB ThreatHunter, our newest offering on the CB Predictive Security Cloud PSC, which delivers powerful threat hunting and incident response IR capabilities on the same platform. The release of CB ThreatHunter marks the fourth service...

Iron Rain: Cybersecurity Is an Ever-Changing Battlefield

Editor's Note: This is the final blog in a three-part series, "Iron Rain" from Tom Kellermann and Rick McElroy. Part 1: Iron Rain: What Defines a Cyber Insurgency? Part 2: Iron Rain: Gaining Situational Intelligence to Make Rapid Decisions Part 3: The ever-changing battlefield. Just like in comba...

So you’ve been asked to start a threat intel program

Ever since the Mandiant APT1 report landed like a bomb in private sector security reporting, threat intelligence has been a hot buzzword many companies have been chasing over. But what is threat intelligence? What do you need to execute it well? And how many new tools do you need to buy? The...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

Suppressing the Adversary via Threat Hunt Teams

What a brave new world. Global cyber insurgencies continue unabated. Decreasing dwell time is imperative in 2018. In order to achieve this goal, we must embrace the hunt. Every organization should stand up a threat hunt team. The team must be multidisciplinary with experience in e-forensics and...

sigma - Generic Signature Format for SIEM Systems

Generic Signature Format for SIEM Systems. What is Sigma? Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this...

Serverless, Low Cost, Threat Intel Aggregation: ElasticIntel

ElasticIntel is serverless, low cost, threat intel aggregation for enterprise or personal use, backed by ElasticSearch. It is an alternative to expensive threat intel aggregation platforms which ingest the same data feeds you could get for free. ElasticIntel is designed to provide a central,...

Generic Signature Format for SIEM Systems: Sigma

Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers ...

Guest Post: Bamm Visscher on Detection

Yesterday my friend Bamm Visscher published a series of Tweets on detection. I thought readers might like to digest it as a lightly edited blog post. Here, then, is the first ever as far as I can remember guest post on TaoSecurity Blog. Enjoy. When you receive new threat intel and apply it in you...

Automated Malware Incident Response & Analysis: AMIRA

Automated Malware Incident Response & Analysis AMIRA is a service for automatically running the analysis on the OSXCollector output files. The automated analysis is performed via OSXCollector Output Filters, in particular The One Filter to Rule Them All : the Analyze Filter. AMIRA takes care of...

CBS Sports App Transmitted Data Unencrypted

CBS recently fixed a vulnerability in its popular Sports application that could have exposed users to man-in-the-middle attacks and inadvertently leaked personal data. According to researchers, upon registration, users’ names, email addresses, account passwords, dates of birth, and zip codes were...

Microsoft Remote Desktop Services - Web Proxy IE Sandbox Escape (MS15-004) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape', 'Description' = %q This module abuses a process creation...

MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape

This module abuses a process creation policy in Internet Explorer's sandbox; specifically, Microsoft's RemoteApp and Desktop Connections runtime proxy, TSWbPrxy.exe. This vulnerability allows the attacker to escape the Protected Mode and execute code with Medium Integrity. At the moment, this...