SOC Analyst

Code Obfuscation and Deobfuscation

by
IR_002
This entry is part 14 of 18 in the series Incident Response and Forensics

Views: 16Code Obfuscation is a technique used to make a script more difficult to read by humans but allows it to function the same from a technical point of view, though performance may be slower. This is usually achieved automatically by using an obfuscation tool, which takes code as an input, and attempts to re-write … Read more

Incident Response

by
This entry is part 12 of 2 in the series Digital Forensics and Incident Response

Views: 1Incident response, also known as incident handling, is a cyber security function that uses various methodologies, tools and techniques to detect and manage adversarial attacks while minimizing impact, recovery time and total operating costs. Addressing attacks requires containing malware infections, identifying and remediating vulnerabilities, as well as sourcing, managing, and deploying technical and non-technical … Read more

Windows Event Logs

by
This entry is part 12 of 18 in the series Incident Response and Forensics

Views: 33Windows logon types and logon codes Logs with event IDs 4624 and 4625 are generated every time there is a successful or failed logon on a local computer, respectively.  In Windows, there are several ways a logon can occur locally, and remotely.  Logon Type Numeric Identifier Description Logon Right Used only by the system … Read more

Wireshark 101 | Packet Operations

by
This entry is part 9 of 18 in the series Incident Response and Forensics

Views: 5Wireshark: Packet Operations Statistics | Summary This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic, available protocols, endpoints and conversations, and some protocol-specific details like DHCP, DNS and HTTP/2. For a security analyst, it is crucial to know how to … Read more

SOC Tools and Useful Links

by
This entry is part 10 of 21 in the series Threat Detection Engineering

Views: 241- IP & URL Reputation 1. Virus Total : https://www.virustotal.com/gui/home/upload2. URL Scan : https://urlscan.io/3. AbuseIPDB: https://www.abuseipdb.com/4. Cisco Talos: https://www.talosintelligence.com/5. IBM X-Force: https://lnkd.in/gt8iyHE56. URL Filtering(Palo Alto): https://lnkd.in/e4bkm5Eq7. URL Filtering(Symantec): https://lnkd.in/g4qQGsHG8. IP Void: https://www.ipvoid.com/9. URL Void: https://www.urlvoid.com/ 2- File | Hash | Search | Analysis | Sandboxing 1. File Extension >>https://filesec.io/# 2. LOLBAS >>https://lnkd.in/dDa8XgiM 3. GTFOBins >>https://lnkd.in/dRVzVz87 4. File Hash Check >> https://lnkd.in/gNqxtn4d 5. Hash Search … Read more

ELASTIC SIEM: Kibana Query Language (KQL) 

by
This entry is part 11 of 21 in the series Threat Detection Engineering

Views: 55Different Syntax Languages Kibana supports two types of syntax languages for querying in Kibana: KQL (Kibana Query Language) and Lucene Query Syntax. Special Characters Certain characters are reserved in ELK queries and must be escaped before usage. Reserved characters in ELK include +, -, =, &&, ||, &, | and !. For instance, using the + character in a query will result in an error; to escape this character, precede it with … Read more

Threat Detection: Detecting a Webserver Attack

by
This entry is part 1 of 21 in the series Threat Detection Engineering

Views: 49LAB Setup Let’s use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the these instructions to install Docker on Ubuntu. With the above steps, the DIWA app should be UP and running on the Linux VM. Let’s … Read more