Who the hæck?Attribution in cybersecurity
While we are getting used to hearing news on a daily basis about hacking attacks, much less do we read … More Who the hæck?Attribution in cybersecurity
Author: Fabian
SRPs block malware, but what if things stop working?
As I wrote in my last post on lateral movement, using AppLocker or Software Restriction Policies (SRPs) to avoid the … More SRPs block malware, but what if things stop working?
Hello, somebody there? Or: The difficulty of detecting lateral movement
Lateral Movement is a key technique for attackers: Once they entered your infrastructure, the next step is to look around … More Hello, somebody there? Or: The difficulty of detecting lateral movement
Which layer for encryption? Which for VPNs?
As more people work from home, VPNs are in peak season. Recently I discussed with a network engineer the advantages … More Which layer for encryption? Which for VPNs?
Life-saving Excel shortcuts
Recently on Twitter someone asked security professionals which tools they use most for their day-to-day tasks. Someone said “Excel” and … More Life-saving Excel shortcuts
Analyze Emotet and Trickbot with NetworkMiner and Suricata
As I explained in the previous post, NetworkMiner and Suricata are a great combination for performing quick and straightforward network … More Analyze Emotet and Trickbot with NetworkMiner and Suricata
Quick and easy setup for NetworkMiner and Suricata to perform network forensics
Many people know Suricata as network intrusion detection (IDS) system, i.e. acting on live traffic; many people know NetworkMiner as … More Quick and easy setup for NetworkMiner and Suricata to perform network forensics
Sysmon v11.10 reads Alternate Data Streams
A few days ago, the new version 11.10 of Sysinternals Sysmon was released. Despite the minor version increase from 11.0 … More Sysmon v11.10 reads Alternate Data Streams
Collection of Windows commands abused by attackers
Only recently I stumbled upon a slightly dated but still relevant post published on the Japanese CERT blog: Windows Commands … More Collection of Windows commands abused by attackers
Script to enumerate Windows events with name, ID, security monitoring recommendation, URL
When setting up and tuning a SIEM solution, you will write a lot of rules to detect well-known and arising … More Script to enumerate Windows events with name, ID, security monitoring recommendation, URL