During the past week CrowdStrike published its 2018 Mid-Year Review call “Observation from the front lines of threat hunting“. This report provides insights, trends and details on today’s most sophisticated cyber attacks observed by CrowdStrike Falcon OverWatch team.
Some interesting points of the report include:
Continue reading “CrowdStrike’s 2018 Mid-Year Review”
Florian Roth published the new version of Anti-Virus Log Analysis Cheat Sheet (version 1.5). I highly recommend to implement monitoring of the events included in this cheat sheet. To my mind, this is the easiest and quickest win and AV logs are one of the first things I hunt whenever I go to a new environment.
The new version has information on :
Continue reading “Anti-Virus Log Analysis Cheat Sheet (v1.5)”
Lots of good stuff going on for MITRE ATT&CK framework. It’s great to see the whole project evolving and stimulating cybersecurity community to better analyse intrusions and actors, enhance controls and active defense activities. See some of the latest updates:
Continue reading “Latest advances in MITRE’s ATT&CK framework”
It was ~2 weeks ago when Costin Raiu wrote an article on “Where are all the ‘A’s in APT?”. In this article, Costin focused on what is regarded as sophisticated in observed APT attacks as well as how future detected sophisticated attacks will look like:
Continue reading “Costin Raiu on future sophisticated attacks”
This is a great blog post from Digital Shadows . Their team has gone through Mueller GRU indictment and mapped the mentioned capabilities to ATT&CK framework TTPs (accompanied with mitigation advice per TTP).
Blue teams should learn from this type of analysis:
Continue reading “Mapping Threat Actor TTPs to ATT&CK Framework”
This is an interesting article based on FireEye, Inc. ‘s CEO Kevin Mandia presentation during CTI Forum. Some interesting points:
During the past years, there has been a lot of public reporting on APT activity of group with Russia and China nexus. However, it has been observed that more and more countries have developed such advanced capabilities and their activity is captured and reported by the vendors and mainstream media.
FireEye’s list of sophisticated actors and naming conventions looks like this:
