Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly reading. The summaries are provided with links for the reader to drill down into particular topics according to their own interests.

Industry Reports, News, and Miscellany

The Unique Challenges and Risks Posed by Insiders
- https://www.flashpoint-intel.com/blog/the-unique-challenges-and-risks-posed-by-insiders/
Escalating Cyber Tensions Risk Human Life
- https://dragos.com/blog/industry-news/escalating-cyber-tensions-risk-human-life/
CrowdStrike EMEA’s John Titmus Offers Insights on Protecting Against Today’s Biggest Threat Actors
- https://www.crowdstrike.com/blog/john-titmus-protecting-against-todays-biggest-threat-actors/
RDP Security Explained
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-security-explained/
Caught in the Web of Shells?
- https://medium.com/@ashabdalhalim/caught-in-the-web-of-shells-e40524ca8097
Me(n)tal Health in DFIR – It’s Kind of a Big Deal
- https://thebinaryhick.blog/2019/06/21/mental-health-in-dfir-its-kind-of-a-big-deal
UNC Path Injection with Microsoft Access
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/unc-path-injection-with-microsoft-access/
How Verizon and a BGP Optimizer Knocked Large Parts of the Internet Offline Today
- https://blog.cloudflare.com/how-verizon-and-a-bgp-optimizer-knocked-large-parts-of-the-internet-offline-today
“A thread on how BGP holds the internet together using sticky tape”
- https://mobile.twitter.com/GossiTheDog/status/1143226378428592129?s=19
Dial cURL for Content
- https://osintcurio.us/2019/06/25/dial-curl-for-content
Empathizing with Threat Actors
- https://nullsweep.com/empathizing-with-threat-actors
Notes on the OSI Model
- https://0x00sec.org/t/notes-on-the-osi-model/14573
Google Public DNS over HTTPS (DoH) supports RFC 8484 standard
- https://security.googleblog.com/2019/06/google-public-dns-over-https-doh.html?m=1

Tools and Tips

How to Build a Cybersecurity Career [ 2019 Update ]
- https://danielmiessler.com/blog/build-successful-infosec-career/
Getting started in Cyber Security [Video by Colin Hardy]
- https://www.youtube.com/watch?v=OThu_FZs2zM&feature=youtu.be
The Windows 10 security guide: How to safeguard your business
- https://www.zdnet.com/article/the-windows-10-security-guide-how-to-safeguard-your-business/
Suricata IDS: an overview of threading capabilities
- https://www.alienvault.com/blogs/security-essentials/suricata-ids-threading-capabilities-overview
Thumbs Up: Using Machine Learning to Improve IDA’s Analysis
- https://research.checkpoint.com/thumbs-up-using-machine-learning-to-improve-idas-analysis/
Verifying Running Processes against VirusTotal – Domain-Wide
- https://isc.sans.edu/forums/diary/Verifying+Running+Processes+against+VirusTotal+DomainWide/25078/
Tracking driver inventory to unearth rootkits
- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
Updates to Cheetsheets: Digital Forensics and Incident Response
- https://www.jaiminton.com/cheatsheet/DFIR/#
Free Course: Learn to install and Configure Splunk
- https://www.csoonline.com/article/3402617/free-course-learn-to-install-and-configure-splunk.html
Awesome YARA: A curated list of awesome YARA rules, tools, and resources
- https://github.com/InQuest/awesome-yara
The Recon-ng Framework: providing a powerful environment to conduct open source web-based reconnaissance quickly and thoroughly
- https://github.com/lanmaster53/recon-ng
MISP dashboard v1.2 has been released
- https://github.com/MISP/misp-dashboard/releases/tag/v1.2
sysmon-cheatsheet: All sysmon event types and their fields explained
- https://github.com/olafhartong/sysmon-cheatsheet
Strelka is a real-time, container-based file scanning system used for threat hunting, threat detection, and incident response
- https://github.com/target/strelka
Introducing Elastic SIEM
- https://www.elastic.co/blog/introducing-elastic-siem
How to get started with Threat Modeling, before you get hacked
- https://hackernoon.com/how-to-get-started-with-threat-modeling-before-you-get-hacked-1bf0ea3310df
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables
- https://github.com/OpenCTI-Platform/opencti

Threat Research – Malware, Phishing, and other Campaigns in the Wild

OPERATION SOFT CELL: A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
The “Return of the WiZard” Vulnerability: Crooks Start Hitting
- https://blog.yoroi.company/research/the-return-of-the-wizard-vulnerability-crooks-start-hitting/
LokiBot & NanoCore being distributed via ISO disk image files
- https://www.netskope.com/blog/lokibot-nanocore-iso-disk-image-files
Under the Radar – Phishing Using QR Codes to Evade URL Analysis
- https://cofense.com/radar-phishing-using-qr-codes-evade-url-analysis/
New Dridex Variant Evading Traditional Antivirus
- https://www.esentire.com/blog/new-dridex-variant-evading-traditional-antivirus/
Iranian Threat Actor Amasses Large Cyber Operations Infrastructure Network to Target Saudi Organizations
- https://www.recordedfuture.com/iranian-cyber-operations-infrastructure/
GandCrab Threat Actors Retire…Maybe
- https://www.fortinet.com/blog/threat-research/gandcrab-threat-actors-retire.html
Undocumented Excel Variable Used in Malicious Spam Run Targeting Japanese Users
- https://www.fortinet.com/blog/threat-research/excel-variable-targeting-japanese-users.html
Riltok mobile Trojan: A banker with global reach
- https://securelist.com/mobile-banker-riltok/91374/
Fake jquery campaign leads to malvertising and ad fraud schemes
- https://blog.malwarebytes.com/threat-analysis/2019/06/fake-jquery-campaign-leads-to-malvertising-and-ad-fraud-schemes/
ShadowGate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit
- https://blog.trendmicro.com/trendlabs-security-intelligence/shadowgate-returns-to-worldwide-operations-with-evolved-greenflash-sundown-exploit-kit/
Welcome Spelevo: New exploit kit full of old tricks
- https://blog.talosintelligence.com/2019/06/spelevo-exploit-kit.html
Malicious SYLK Files with MS Excel 4.0 Macros
- https://blog.nviso.be/2019/06/25/malicious-sylk-files-with-ms-excel-4-0-macros/
Turla Group Hacks APT34 (OilRig) Infrastructure and Puts Malware on Exchange Server and YARA Rule
- https://www.malcrawler.com/turla-group-hacks-apt34-oilrig-infrastructure-and-puts-malware-on-exchange-server-and-yara-rule/
IcedID aka #Bokbot Analysis with Ghidra
- https://medium.com/@dawid.golak/icedid-aka-bokbot-analysis-with-ghidra-560e3eccb766
Executable and Linkable Format 101 Part 4: Dynamic Linking
- https://www.intezer.com/executable-linkable-format-101-part-4-dynamic-linking/

Vulnerabilities and Exploits

A Vulnerability in Oracle WebLogic Could Allow for Remote Code Execution
- https://medium.com/@knownsec404team/knownsec-404-team-alert-again-cve-2019-2725-patch-bypassed-32a6a7b7ca15
Using Whitelisting to Remediate an RCE Vulnerability (CVE-2019-2729) in Oracle WebLogic
- https://blog.trendmicro.com/trendlabs-security-intelligence/using-whitelisting-to-remediate-an-rce-vulnerability-cve-2019-2729-in-oracle-weblogic/
Weaponizing vulnerable driver for privilege escalation— Gigabyte Edition!
- https://medium.com/@fsx30/weaponizing-vulnerable-driver-for-privilege-escalation-gigabyte-edition-e73ee523598b
Analyzing CVE-2018-8453: An Interesting Tale of UAF and Double Free in Windows Kernel
- https://lehack.org/en/planning/en-analyzing-cve-2018-8453-an-interesting-tale-of-uaf-and-double-free-in-windows-kernel

Breaches, Government, and Law Enforcement

Germany and the Netherlands to build the first ever joint military internet
- https://www.zdnet.com/article/germany-and-the-netherlands-to-build-the-first-ever-joint-military-internet/
2nd Florida city in just a week to pay hackers big ransom for seized computer systems
- https://www.cbsnews.com/news/ransomware-attack-lake-city-florida-pay-hackers-ransom-computer-systems-after-riviera-beach/
CISA Statement on Iranian Cybersecurity Threats
- https://www.dhs.gov/cisa/news/2019/06/22/cisa-statement-iranian-cybersecurity-threats
The US 2020 Elections: weaponizing social media to conduct disinformation and influence campaigns
- https://technical.nttsecurity.com/post/102fmvt/the-us-2020-elections-weaponizing-social-media-to-conduct-disinformation-and-inf
Pentagon secretly struck back against Iranian cyberspies targeting U.S. ships
- https://news.yahoo.com/pentagon-secretly-struck-back-against-iranian-cyber-spies-targeting-us-ships-234520824.html
The Legal Context for CYBERCOM’s Reported Operations Against Iran
- https://www.lawfareblog.com/legal-context-cybercoms-reported-operations-against-iran

Weekly News Roundup — June 23 to June 29