Bharath Narayanasamy

MCSE, CCSA, eJPTv2, Security+, CCNA, Azure Certified

Detection Engineering vs Threat Hunting

by
This entry is part 4 of 17 in the series Threat Detection Engineering

Views: 22DETECTION ENGINEERING: REINFORCING THE KNOWN Threat detection is the process of identifying threats in an organization that is actively trying to attack the endpoints, networks, devices and systems. Unlike threat hunting, a threat detection is a reactive approach: threat mitigation mechanisms activate only when the organization’s security system receives alerts on potential security breaches. … Read more

Linux System Hardening

by

Views: 10Create a GRUB password PBKDF2 stands for Password-Based Key Derivation Function 2. It is important to note that adding a password for GRUB is not available for systems deployed using cloud service providers (such as our Linux VM); a GRUB password does not make sense as you don’t have access to the physical terminal. Encryption There … Read more

Yara 101

by
This entry is part 5 of 17 in the series Threat Detection Engineering

Views: 12YARA is a powerful pattern-matching tool and rule format used for identifying and classifying files based on specific patterns, characteristics, or content. SOC analysts commonly use YARA rules to detect and classify malware samples, suspicious files, or indicators of compromise (IOCs). Yara is an essential tool used by SOC analysts to enhance their threat detection … Read more

NetworkMiner

by

Views: 34NetworkMiner is an open source network forensics tool that extracts artifacts, such as files, images, emails and passwords, from captured network traffic in PCAP files. NetworkMiner can also be used to capture live network traffic by sniffing a network interface. It’s a popular tool among incident response teams as well as law enforcement.  Detailed information about … Read more

TCPView

by

Views: 14TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the … Read more

High-Risk Vulnerabilities in ConnectWise ScreenConnect and Remediation procedure

by

Views: 64On February 19, 2024 ConnectWise disclosed two vulnerabilities in their ScreenConnect remote access software. Both vulnerabilities affect ScreenConnect 23.9.7 and earlier. Affected Products: ScreenConnectSeverity: CriticalPriority: 1 – High ScreenConnect is popular remote access software used by many organizations globally. There appear to be some 8,500+ instances of ScreenConnect exposed to the public internet. Severity … Read more

AD Fundamentals

by
This entry is part 2 of 3 in the series Attack and Defend Active Directory

Views: 12Ransomware operators have been increasingly targeting Active Directory as a key part of their attack paths. The Conti Ransomware which has been used in more than 400 attacks around the world has been shown to leverage recent critical Active Directory flaws such as PrintNightmare (CVE-2021-34527) and Zerologon (CVE-2020-1472) to escalate privileges and move laterally in a target network.