shennina

Shennina Automating Host Exploitation with AI Abstract Shennina is an automated host exploitation framework. The mission of the project is to fully automate the scanning, vulnerability scanning/analysis, and exploitation using Artificial Intelligence. Shennina is integrated with Metasploit and Nm...

ThreatActors-TTPs

脅威アクターとランサムウェア - TTPs このリポジトリは、アクティブまたは非アクティブなランサムウェア事業者/グループ やその他の脅威アクター が採用している戦術、技術、手順（TTPs）を、MITRE ATT &CKフレームワークに基づいて研究する際に、企業 や独立した研究者を支援する目的で作成されました。 このコンテンツには、TTPマッピング、活動の履歴 、悪用されたCVE（Common Vulnerabilities and Exposures）の記録が含まれています。さらに、DFIR/CTI分野における コマンド、ツール 、およびアーティファクト調査に有用な場所...

Red-Teaming-TTPs

!CAUTION このリポジトリには、特にレッドチーミング分野におけるサイバーセキュリティ学習に関連したチートシート、メモ、スクリプトが含まれています。長年にわたってまとめたさまざまなリソースがあります。 チートシート : 一般的なツールやテクニックのクイックリファレンスガイド ガイド : さまざまなサイバーセキュリティトピックに関する詳細な解説と洞察 スクリプト : タスクの自動化と効率向上に役立つスクリプト これらのTTPの更新されたPDFはこちらからも入手できます。 これらのリソースを自由に探索、使用、貢献してください。メモ、改善、追加コンテンツがあれば歓迎します！ 目次...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

PoC-Malware-TTPs

PoC-Malware-TTPs マルウェアTTP（戦術・技術・手順）の概念実証コードリポジトリ...

SentinelOne-ATTACK-Queries

ATT&CK マッピング済み SentinelOne クエリ MITRE ATT&CK にマッピングされた SentinelOne Deep Visiblity 用クエリ 開発終了 このプロジェクトは、共有可能なシグネチャとツールでの利用を目指すSentinelOne-Queries リポジトリに置き換えられました。新しいリポジトリはこのリポジトリ内の作業を基に構築されており、テストのほとんどは依然として Atomic Red Team に対して実施されています。これらのクエリは、エージェントのバージョン間などで検出内容が変化するため、更新されません。 このプロジェクトは、Red...

honeypot

🍯 ハニーポット研究プロジェクト ハニーポットとは ハニーポットとは、潜在的なセキュリティ脅威を検出・分析・対応するために、意図的にハッカーに対して脆弱な状態にしておくコンピュータシステムまたはネットワークです。ハニーポットの目的は、悪意のある攻撃者が使用する戦術、技術、手順に関する情報を収集し、ネットワーク全体のセキュリティ向上に役立てることです。 alt text 利点 脅威インテリジェンスの向上: ハニーポットは攻撃者の戦術、技術、手順TTPに関する貴重な洞察を提供し、セキュリティチームの防御力向上を支援します。 早期検出と対応:...

APT trends report Q3 2024

Kaspersky's Global Research and Analysis Team GReAT has been releasing quarterly summaries of advanced persistent threat APT activity for over seven years now. Based on our threat intelligence research, these summaries offer a representative overview of what we've published and discussed in more...

Transforming Threat Actor Research into a Strong Defense Strategy

Transforming Threat Actor Research into a Strong Defense Strategy By James Murphy, Ale Houspanossian, Leandro Velasco LV and Ilya Kolmanovich · November 14, 2024 What does it take to transform threat actor research into detection engineering? If we look at threat intelligence at its core, then we...

Unwrapping the emerging Interlock ransomware attack

Cisco Talos Incident Response Talos IR recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Our analysis uncovered that the attacker used multiple components in the delivery chain including a Remote Access Tool RAT...

Threat Brief: Understanding Akira Ransomware

Overview Akira is a prolific ransomware that has been operating since March 2023 and has targeted multiple industries, primarily in North America, the UK, and Australia. It functions as a Ransomware as a Service RaaS and exfiltrates data prior to encryption, achieving double extortion. According ...

China-Backed Earth Baku Expands Cyber Attacks to Europe, Middle East, and Africa

The China-backed threat actor known as Earth Baku has diversified its targeting footprint beyond the Indo-Pacific region to include Europe, the Middle East, and Africa starting in late 2022. Newly targeted countries as part of the activity include Italy, Germany, the U.A.E., and Qatar, with...

How “professional” ransomware variants boost cybercrime groups

Introduction Cybercriminals who specialize in ransomware do not always create it themselves. They have many other ways to get their hands on ransomware samples: buying a sample on the dark web, affiliating with other groups or finding a leaked ransomware variant. This requires no extraordinary...

Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs

Given the recent slate of massive ransomware attacks that have disrupted everything from hospitals to car dealerships, Cisco Talos wanted to take a renewed look at the top ransomware players to see where the current landscape stands. Based on a comprehensive review of more than a dozen prominent...

Suspected CoralRaider continues to expand victimology using three information stealers

By Joey Chen, Chetan Raghuprasad and Alex Karkins. Cisco Talos discovered a new ongoing campaign since at least February 2024, operated by a threat actor distributing three famous infostealer malware, including Cryptbot, LummaC2 and Rhadamanthys. Talos also discovered a new PowerShell command-lin...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400 Compromise Checker A very simple bash script to...

Unveiling Earth Freybug’s New TTPs Adoption with UNAPIMON

...

New details on TinyTurla’s post-compromise activity reveal full kill chain

Cisco Talos is providing an update on its two recent reports on a new and ongoing campaign where Turla, a Russian espionage group, deployed their TinyTurla-NG TTNG implant. We now have new information on the entire kill chain this actor uses, including the tactics, techniques and procedures TTPs...

SVR Cyber Actors Adapt Tactics for Initial Cloud Access

How SVR-Attributed Actors are Adapting to the Move of Government and Corporations to Cloud Infrastructure OVERVIEW This advisory details recent tactics, techniques, and procedures TTPs of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear. The UK National...

PurpleKeep - Providing Azure Pipelines To Create An Infrastructure And Run Atomic Tests

With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running...