Finding & Attributing Malicious Command & Control Servers
In one of my last posts, I wrote about attribution in cybersecurity, i.e. ways to find out who was behind … More Finding & Attributing Malicious Command & Control Servers
Differences in cloud security (Alibaba, Amazon, Google, IBM, Microsoft)
I recently had a look at the security assessments of different well-known cloud providers and found some interesting discrepancies. It … More Differences in cloud security (Alibaba, Amazon, Google, IBM, Microsoft)
Who the hæck?Attribution in cybersecurity
While we are getting used to hearing news on a daily basis about hacking attacks, much less do we read … More Who the hæck?Attribution in cybersecurity
SRPs block malware, but what if things stop working?
As I wrote in my last post on lateral movement, using AppLocker or Software Restriction Policies (SRPs) to avoid the … More SRPs block malware, but what if things stop working?
Hello, somebody there? Or: The difficulty of detecting lateral movement
Lateral Movement is a key technique for attackers: Once they entered your infrastructure, the next step is to look around … More Hello, somebody there? Or: The difficulty of detecting lateral movement
Which layer for encryption? Which for VPNs?
As more people work from home, VPNs are in peak season. Recently I discussed with a network engineer the advantages … More Which layer for encryption? Which for VPNs?
Life-saving Excel shortcuts
Recently on Twitter someone asked security professionals which tools they use most for their day-to-day tasks. Someone said “Excel” and … More Life-saving Excel shortcuts
Analyze Emotet and Trickbot with NetworkMiner and Suricata
As I explained in the previous post, NetworkMiner and Suricata are a great combination for performing quick and straightforward network … More Analyze Emotet and Trickbot with NetworkMiner and Suricata
Quick and easy setup for NetworkMiner and Suricata to perform network forensics
Many people know Suricata as network intrusion detection (IDS) system, i.e. acting on live traffic; many people know NetworkMiner as … More Quick and easy setup for NetworkMiner and Suricata to perform network forensics
Sysmon v11.10 reads Alternate Data Streams
A few days ago, the new version 11.10 of Sysinternals Sysmon was released. Despite the minor version increase from 11.0 … More Sysmon v11.10 reads Alternate Data Streams