Summary
— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio.
I am once again including my top picks from the material from each category below, but adding brief quotes from the pieces for added context. I hope this highlights certain bits and helps readers identify content to consume, since there is so much great information and so little time. Happy Reading!
Highlights (my top picks):
News/Reports: The Annual Cost of Data Breach Report by the Ponemon Institute.
“average total cost of a data breach is the U.S. at $8.19 million, more than twice the global average. Healthcare was again the most expensive industry for data breach costs, with the total cost of a data breach in 2019 averaging $6.45 million.”
By Larry Ponemon
Threat Research: Gigamon Takes a Detailed Look at FIN8’s Tooling
“FIN8 is a financially-motivated threat group originally identified by FireEye in January of 2016, with capabilities further reported on by Palo Alto Networks’ Unit 42 and root9B….we aim to show how FIN8 continues to evolve and adapt their tooling….to enable defenders to better prevent, discover, or disrupt FIN8’s operations.”
by Kristina Savelesky, Ed Miles, Justin Warner
Tools and Tips: Analysis of the AmCache — DFIR Summit 2019
“Frequently overlooked and understudied, this database is rarely fully exploited when doing incident response. Indeed, its correct interpretation is complex: a lot of special cases can occur that have to be taken into account when performing an analysis. However, the information collected by the AmCache is extremely useful and the lack of awareness about this artifact makes it very valuable, since it is easily overlooked by attackers erasing their tracks.”
Author Blanche Lagny
Government: Report of the Senate Intelligence Committee on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election
“From 2017 to 2019, the Committee held hearings, conducted interviews, and
116TH CONGRESS 1st Session SENATE REPORT
reviewed intelligence related to Russian attempts in 2016 to access election infrastructure. The Committee sought to determine the extent of Russian activities, identify the response of the U.S. Government at the state, local, and federal level to the threat, and make recommendations on how to better prepare for such threats in the future.”
Vulns/Exploits: #Bluekeep POC Exploit Research Presented and Incorporated into Commercial Pentesting Tool
“on Tuesday, July 23, Immunity Inc. announced it included a fully-working BlueKeep exploit inside CANVAS v7.23, the company’s pen-testing toolkit.”
By Catalin Cimpanu
Industry Reports, News, and Miscellany
- Ransomware: A Mid-Year Summary
- APT17 is run by the Jinan bureau of the Chinese Ministry of State Security
- What’s New in the 2019 Cost of a Data Breach Report
- Bestsellers in the Underground Economy: Measuring Malware Popularity by Forum
- Dragos ICS Threat Detection app for Splunk Broadens Security Visibility from Enterprise Through Operations
- BEC Scams Remain a Billion-Dollar Enterprise, Targeting 6K Businesses Monthly
- CYBER ATTACK TRENDS: 2019 MID-YEAR REPORT
- Let’s Destroy Democracy: ELECTION SECURITY THROUGH AN ADVERSARY’S EYES
- Week in OSINT #2019–29
- A CISO Mid-Life Crisis
- This Week in Data #2019-2
Threat Research – Malware, Phishing, and other Campaigns in the Wild
- Chinese APT “Operation LagTime IT” Targets Government Information Technology Agencies in Eastern Asia
- Discovering BADHATCH and a Detailed Look at FIN8’s Tooling
- P2P Worm Spreads Crypto-Miners in the Wild
- Phishing Attackers Are Abusing WeTransfer to Evade Email Gateways
- GANDCRAB DOPPELGÄNGED HIS SHELL?
- A Deep Dive Into IcedID Malware: Part III – Analysis of Child Processes
- How to steal a million (of your data)
- A deep dive into Phobos ransomware
- Multistage Attack Delivers BillGates/Setag Backdoor, Can Turn Elasticsearch Databases into DDoS Botnet ‘Zombies’
- EXPLOIT KITS “SHADE” INTO NEW TERRITORY
- Watching the WatchBog: New BlueKeep Scanner and Linux Exploits
- BrushaLoader still sweeping up victims one year later
- TrickBooster – A Deeper Dive into the Malware that Successfully Harvested Over 250M Addresses
- Malicious Document delivering Dridex — analysis and emulation (part 1 and part 2)
- Phishers Target Office 365 Admins with Fake Admin Alerts
- Winnti uses the rtf exploit 8.t too targeting Vietnam
- Tencent Yushen Threat Intelligence Center captured a malicious mining virus spread using a bunch of pornographic e-books (chm format)
- Building Out ProtonMail Spoofed Infrastructure with Creation Timestamp Pivoting
Tools and Tips
- How to make your org more resilient to common Mac OS attacks
- Finding Evil in Windows 10 Compressed Memory, Part One: Volatility and Rekall Tools
- ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.
- Yara rule to Detect Various PowerShell Obfuscation Techniques
- Using Lampyre for Basic Email and Phone Number OSINT
- Вы понимаете? OSINT in Foreign Languages
- MacOS Red Teaming 206: ARD (Apple Remote Desktop Protocol)
- Red Team Diary, Entry #1: Making NSA’s PeddleCheap RAT Invisible
- FireELF- Fileless Linux Malware Framework
- Quickstart: onboarding sysmon data to Azure Sentinel
- PowerShell Tutorial Mini-Course: Building a Server Inventory Script
- Analyzing your Microsoft Defender ATP data in real-time in ELK using the new streaming API
- Deciphering Browser Hieroglyphics: Intro (Part 1)
- AMCACHE ANALYSIS — 2019 DFIR Summit
- Cerbero Suite 3.2 is out!
- PE Section Names – Re-visited, Again
Breaches, Government, and Law Enforcement
- Louisiana governor declares state emergency after local ransomware outbreak
- The “Security Six” — Guidance from the IRS for Tax Professionals
- Russia’s Secret Intelligence Agency Hacked: ‘Largest Data Breach In Its History’
- Hackers breach FSB contractor, expose Tor deanonymization project and more
- DOD More Assertive, Proactive in Cyber Domain
- NSA to establish a defense-minded division named the Cybersecurity Directorate
- Canadian Centre for Cyber Security Releases Advisory on Fileless Malware
- Citrix concludes investigation of unauthorized internal network access
- Report of the Senate Intelligence Committee on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election
- Shadow force: The secret history of the U.S. intelligence community’s battle with Iran’s Revolutionary Guard
- New Entries in the CFR Cyber Operations Tracker: Q2 2019
Vulnerabilities and Exploits
- A US cyber-security company is selling a weaponized BlueKeep exploit as part of a penetration testing utility.
- OCVE-2019–13382: Local Privilege Escalation in SnagIt
- Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
- About the “security issue” on #VLC : VLC is not vulnerable.
- Attacking SSL VPN – Part 1: PreAuth RCE on Palo Alto GlobalProtect, with Uber as Case Study!
- Create a backdoor to take-over an object in AD
- #bluekeep RDP from patch to remote code execution (presentation slides)
- Exploiting CVE–2019-1132: Another NULL Pointer Dereference in Windows Kernel