Let’s make CTI great (again)!

On 5th and 6th November 2018, the annual CTI-EU event took place in Brussels. CTI-EU is organised by  European Union Agency for Network and Information Security (ENISA) in cooperation with DG Connect, CERT-EU and EDA

 The event had various sessions with different focus (see full agenda here):

Continue reading “Let’s make CTI great (again)!”

CrowdStrike’s 2018 Mid-Year Review

During the past week CrowdStrike published its 2018 Mid-Year Review call “Observation from the front lines of threat hunting“. This report provides insights, trends and details on today’s most sophisticated cyber attacks observed by CrowdStrike Falcon OverWatch team.

Some interesting points of the report include:

Continue reading “CrowdStrike’s 2018 Mid-Year Review”

Anti-Virus Log Analysis Cheat Sheet (v1.5)

Florian Roth published the new version of Anti-Virus Log Analysis Cheat Sheet (version 1.5). I highly recommend to implement monitoring of the events included in this cheat sheet. To my mind, this is the easiest and quickest win and AV logs are one of the first things I hunt whenever I go to a new environment.

The new version has information on :

Continue reading “Anti-Virus Log Analysis Cheat Sheet (v1.5)”

On reported APT trends

During the past years, there has been a lot of public reporting on APT activity of group with Russia and China nexus. However, it has been observed that more and more countries have developed such advanced capabilities and their activity is captured and reported by the vendors and mainstream media.

FireEye’s list of sophisticated actors and naming conventions looks like this:

Continue reading “On reported APT trends”

A Study on Threat Intelligence Platforms (TIPs)

ENISA has released the first comprehensive study on cyber Threat Intelligence Platforms (TIPs) focused on the needs of TIP users, developers, vendors and the security research community.

The study channels its efforts into identifying some of the key opportunities and limitations of existing platforms and solutions, since information exchange formats and tools remain central items on the agenda of the cybersecurity community in general, and particularly of incident responders.

Continue reading “A Study on Threat Intelligence Platforms (TIPs)”

CrySyS Lab Analysis on NSA’s Territorial Dispute

CrySyS Lab has provided a great document on its analysis on NSA’s perspective on the APT landscape. The analysis is based on Shadow Brokers leak (“Lost in Translation” leak) and most specifically on the module called “Territorial Dispute“. The purpose of this module is to detect presence of competing state intelligence services. NSA wanted to secure its operations, avoid any conflict between “Five Eyes” group as well as get intelligence on the targets of the competing state intelligence services.

See below some interesting points related to the analysis done by CrySyS Lab:

Continue reading “CrySyS Lab Analysis on NSA’s Territorial Dispute”