Hello and welcome to Sec Soup, where the weekly newsletter has a collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

CIS CommunityDefense Model v1.0
- https://www.cisecurity.org/white-papers/cis-community-defense-model/
Phishing & BEC Scams Soar 3000%: Agari H2 2020 Email Fraud and Identity Deception Trends Report
- https://www.agari.com/email-security-blog/phishing-bec-scams-soar/
Time Is (Still) Money and Other Findings from the 2020 Cost of a Data Breach Report
- https://securityintelligence.com/media/findings-from-2020-cost-of-a-data-breach-report/
Spam and phishing in Q2 2020
- https://securelist.com/spam-and-phishing-in-q2-2020/97987/
Incident Response Analyst Report 2019
- https://securelist.com/incident-response-analyst-report-2019/97974/
Machine Learning for Humans
- https://blog.reversinglabs.com/blog/machine-learning-for-humans
I’m Open Sourcing the Have I Been Pwned Code Base
- https://www.troyhunt.com/im-open-sourcing-the-have-i-been-pwned-code-base/
Capital One Ruling – Why Capital One was forced to disclose its incident report in data breach lawsuit
- https://www.esentire.com/blog/capital-one-ruling
Ransomware Attacks Fracture Between Enterprise and Ransomware-as-a-Service in Q2 as Demands Increase
- https://www-coveware-com.cdn.ampproject.org/c/s/www.coveware.com/blog/q2-2020-ransomware-marketplace-report
Should Governments Actively Defend Private Sector Networks?
- https://www.robertmlee.org/should-governments-actively-defend-private-sector-networks/

Threat Research

Inter skimming kit used in homoglyph attacks
- https://blog.malwarebytes.com/threat-analysis/2020/08/inter-skimming-kit-used-in-homoglyph-attacks/
US-CERT Malware Analysis Report (AR20-216A) – MAR-10292089-1.v1 – Chinese Remote Access Trojan: TAIDOOR
- https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
Water Nue Phishing Campaign Targets C-Suite’s Office 365 Accounts
- https://blog.trendmicro.com/trendlabs-security-intelligence/water-nue-campaign-targets-c-suites-office-365-accounts/
TA551 (Shathak) Word docs push IcedID (Bokbot)
- https://isc.sans.edu/forums/diary/TA551+Shathak+Word+docs+push+IcedID+Bokbot/26438/
Dridex – From Word to Domain Dominance
- https://thedfirreport.com/2020/08/03/dridex-from-word-to-domain-dominance/
2020-07-31 DEOBFUSCATING ICEDID MACRO SCRIPT
- https://www.herbiez.com/?p=1398
2020-08-05: Update on zloader XLM code
- https://clickallthethings.wordpress.com/2020/08/07/2020-08-05-update-on-zloader-xlm-code

Tools and Tips

Persistent JXA: A poor man’s Powershell for macOS
- https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5
Securing Oracle Cloud Infrastructure
- https://www.cisecurity.org/benchmark/oracle_cloud/
Stadeo: Deobfuscating Stantinko and more
- https://www.welivesecurity.com/2020/08/07/stadeo-deobfuscating-stantinko-and-more/
CPR Anti-Debug Encyclopedia: The Check Point Anti-Debug Techniques Repository
- https://research.checkpoint.com/2020/cpr-anti-debug-encyclopedia-the-check-point-anti-debug-techniques-repository/
Making the Most Out of WLAN Event Log Artifacts
- https://www.sans.org/blog/making-the-most-out-of-wlan-event-log-artifacts/
How to Install SIFT Workstation and REMnux on the Same System for Forensics and Malware Analysis
- https://www.sans.org/blog/how-to-install-sift-workstation-and-remnux-on-the-same-forensics-system/
BlackBerry’s Open Source PE Tree Tool for Malware Reverse Engineers
- https://blogs.blackberry.com/en/2020/08/blackberry-open-source-pe-tree-tool-for-malware-reverse-engineers
- https://github.com/blackberry/pe_tree
Announcing the Seventh Annual Flare-On Challenge
- https://www.fireeye.com/blog/threat-research/2020/08/announcing-the-seventh-annual-flare-on-challenge.html
Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach
- https://www.fireeye.com/blog/threat-research/2020/08/bypassing-masslogger-anti-analysis-man-in-the-middle-approach.html
Masking Malicious Memory Artifacts – Part III: Bypassing Defensive Scanners
- https://www.cyberark.com/resources/threat-research-blog/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners
zip-crack: The purpose of this script is brute force ZIP archives that are password protected
- https://github.com/Sec-Soup/Python-ToolBox/tree/master/zip-crack#zip-crack
DFIR Related Events for Beginners – August, 2020
- https://dfirdiva.com/dfir-related-events-for-beginners-august-2020
My Experience With the SANS FOR500 Course and the GCFE Exam
- https://dfirdiva.com/gcfe-exam
Panopticon is a debugger-powered tracer for Python code to quickly visualize and explore code execution
- https://github.com/kunalb/panopticon
VT Code Similarity Yara Generator
- https://github.com/arieljt/VTCodeSimilarity-YaraGen
Kerberoasting: A Blue Team Perspective
- https://medium.com/@rootsecdev/kerberoasting-a-blue-team-perspective-85e8892a8157
Windows Process Injection – some popular methods used for process injection on the windows operating system.
- https://github.com/odzhan/injection
Chromebook Data Locations
- https://www.magnetforensics.com/blog/chromebook-data-locations
0xf0x #5 Malware Analysis Using a Cuckoo Sandbox (video)
- https://www.youtube.com/watch?v=7Nm48OQWmA8&feature=youtu.be
Unprotect [Project] The search engine about Malware Evasion Techniques
- https://medium.com/@tom_rock/unprotect-project-5f80a88d9bdd
Emotet API+string deobfuscator (v0.1)
- https://github.com/mauronz/binja-emotet
The Art Of Mac Malware
- https://taomm.org/
Pysa: An open source static analysis tool to detect and prevent security issues in Python code
- https://engineering.fb.com/security/pysa/

Breaches, Government, and Law Enforcement

TikTok exploring ‘all remedies’ to safeguard ‘rule of law’ in US ban
- https://www.zdnet.com/article/tiktok-exploring-all-remedies-to-safeguard-rule-of-law-in-us-ban/
Rewards for Justice – Reward Offer for Information on Foreign Interference in U.S. Elections
- https://www.state.gov/rewards-for-justice-reward-offer-for-information-on-foreign-interference-in-u-s-elections/
Announcing the Expansion of the Clean Network to Safeguard America’s Assets
- https://www.state.gov/announcing-the-expansion-of-the-clean-network-to-safeguard-americas-assets
GandCrab ransomware distributor arrested in Belarus
- https://www.zdnet.com/article/gandcrab-ransomware-distributor-arrested-in-belarus/
Porn Clip Disrupts Virtual Court Hearing for Alleged Twitter Hacker
- https://krebsonsecurity.com/2020/08/porn-clip-disrupts-virtual-court-hearing-for-alleged-twitter-hacker/
US shares info on election interference tied to Russia, China, Iran
- https://www.bleepingcomputer.com/news/security/us-shares-info-on-election-interference-tied-to-russia-china-iran/
Garmin Pays Up to Evil Corp After Ransomware Attack — Reports
- https://threatpost.com/garmin-pays-evil-corp-ransomware-attack-reports/157971/

Vulnerabilities and Exploits

Multiple Vulnerabilities in Apache Web Server Could Allow for Remote Code Execution
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-apache-web-server-could-allow-for-remote-code-execution_2020-108/
Don’t be silly – it’s only a lightbulb
- https://research.checkpoint.com/2020/dont-be-silly-its-only-a-lightbulb/
Cisco alert: Four high-severity flaws in routers, switches and AnyConnect VPN for Windows
- https://www.zdnet.com/article/cisco-alert-four-high-severity-flaws-in-routers-switches-and-anyconnect-vpn-for-windows/
The Current State of Exploit Development, Part 1
- https://www.crowdstrike.com/blog/state-of-exploit-development-part-1/
US-CERT Bulletin (SB20-216): Vulnerability Summary for the Week of July 27, 2020
- https://us-cert.cisa.gov/ncas/bulletins/sb20-216
CVE-2020–9854: “Unauthd” (three) logic bugs ftw!
- https://objective-see.com/blog/blog_0x4D.html

Weekly News Roundup — August 2 to August 8

Industry Reports, News, and Miscellany

Threat Research

Tools and Tips

Breaches, Government, and Law Enforcement

Vulnerabilities and Exploits

1 comment / Add your comment below

Leave a Reply Cancel reply