Investigate SQLi attacks using Splunk

by
This entry is part 6 of 22 in the series Threat Detection Engineering

Views: 84Sure! Here are a few Splunk queries that can help detect web application attacks: Note: Replace <your_index> and <your_sourcetype> with the appropriate values from your Splunk environment. Also, make sure you have the corresponding lookup tables (sql_injection_keywords.csv, xss_keywords.csv, etc.) populated with relevant attack patterns. You may need to modify the queries based on your … Read more

Cybersecurity playbook for SOC

by

Views: 18Developing a comprehensive cybersecurity playbook for a Security Operations Center (SOC) requires a systematic approach to address various aspects of cybersecurity operations. Below is a suggested structure for a SOC playbook: 1. Introduction and Scope    – Provide an overview of the playbook’s purpose, target audience, and scope.    – Clearly define the responsibilities … Read more

Linux Privilege Escalation Techniques

by

Views: 20Linux privilege escalation techniques involve methods that allow a user to gain higher privileges or escalate their existing privileges to gain unauthorized access or perform actions they wouldn’t typically be allowed to do. It’s important to note that discussing these techniques can be considered unethical and potentially illegal if used for malicious purposes. However, … Read more

Splunk Threat Hunting – Windows Events

by

Views: 53When performing threat hunting using Splunk on Windows systems, there are several important queries you can use to identify potential threats and security incidents. Here are some examples: This query looks for event code 4688, which indicates process creation events. It filters out known Splunk-related processes to focus on potentially suspicious activities. This query … Read more

Windows Event IDs to monitor/investigation

by

Views: 25SOC (Security Operations Center) teams typically monitor various Windows event IDs to detect and respond to security incidents. While the specific event IDs may vary depending on the organization’s security policies and requirements, here are some commonly monitored Windows event IDs: It’s important to note that the specific event IDs to monitor may vary … Read more

Cisco ISE licensing

by

Views: 10 Cisco ISE licenses Source: Cisco Evaluation Cisco ISE, upon installation, grants a 90-day Evaluation license that supports 100 endpoints and enables all Cisco ISE features. You can set up a limited deployment in Evaluation mode and explore all the capabilities and features within Cisco ISE.

nl NL en EN fr FR