Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source, but simply a collection of items I found interesting throughout my weekly research. The summaries are provided with links for the reader to drill down into particular topics according to their own interests. Thank you to all of the contributors for this great content!

Industry Reports, News, and Miscellany

Whether to Pay Ransomware Demands is Foremost a Business Decision

• https://www.flashpoint-intel.com/blog/whether-to-pay-ransomware-demands-is-foremost-a-business-decision/

CrowdStrike Becomes a Publicly Traded Company

• https://www.crowdstrike.com/blog/crowdstrike-celebrates-ipo/

SQL Injection Attacks: So Old, but Still So Relevant. Here’s Why (Charts)

• https://www.imperva.com/blog/sql-injection-attacks-so-old-but-still-so-relevant-heres-why-charts/

The Fight Against Cybercrime and BEC

• https://www.agari.com/email-security-blog/fight-against-cybercrime-bec/

Project Svalbard: The Future of Have I Been Pwned

• https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/

Business Email Compromise: A Case Study

• https://ensurtec.com/business-email-compromise-a-case-study/

China’s Great Cannon

• https://citizenlab.ca/2015/04/chinas-great-cannon/

Tools and Tips

A few Ghidra tips for IDA users, part 4 – function call graphs

• https://isc.sans.edu/forums/diary/A+few+Ghidra+tips+for+IDA+users+part+4+function+call+graphs/25032/

5 Tips for Improving Employee Security Awareness

• https://www.recordedfuture.com/employee-security-awareness/

How to Automate Phishing Investigations and Remediation

• https://blog.rapid7.com/2019/06/13/how-to-automate-phishing-investigations-and-remediation/

Awesome Incident Response: A curated list of tools for incident response

• https://github.com/meirwah/awesome-incident-response

O365: Hidden InboxRules

• https://mgreen27.github.io/posts/2019/06/09/O365HiddenRules.html

Ransomware identification for the judicious analyst

• https://www.gdatasoftware.com/blog/2019/06/31666-ransomware-identification-for-the-judicious-analyst

Sysmon 10.0 – New features and changes

• https://medium.com/@olafhartong/sysmon-10-0-new-features-and-changes-e82106f2e00

HOWTO: Disable account enumeration in Azure Active Directory

• https://dirteam.com/sander/2019/06/11/howto-disable-account-enumeration-in-azure-active-directory/amp/?__twitter_impression=true

Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro (video)

• https://www.youtube.com/watch?v=DGX7oZvdmT0&feature=youtu.be

New Tool: amsiscan.py

• https://blog.didierstevens.com/2019/06/13/new-tool-amsiscan-py/amp/?__twitter_impression=true

Demystifying Code Injection Techniques: Part 1 – Shellcode Injection

• https://pwnrip.com/demystifying-code-injection-techniques-part-1-shellcode-injection/

IDA: What’s new in 7.3

• https://www.hex-rays.com/products/ida/7.3/index.shtml

Introducing SEPparser — to parse Symantec’s Endpoint Protection logs into a human readable form

• https://malwaremaloney.blogspot.com/2019/06/introducing-sepparser.html?m=1

Digital Forensics and Incident Response Cheat Sheet

• https://jpminty.github.io/cheatsheet/DFIR/#

The Social Engineering Framework

• https://www.social-engineer.org/framework/general-discussion/code-of-ethics/

Visualizing BloodHound Data with PowerBI — Part 2

• https://posts.specterops.io/visualizing-bloodhound-data-with-powerbi-part-2-3e1c521fb7ae

Threat Research – Malware, Phishing, and other Campaigns in the Wild

Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns

• https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/

New Pervasive Worm Exploiting Linux Exim Server Vulnerability

• https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability

Hunting COM Objects (Part Two)

• https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects-part-two.html

Threat Proliferation in ICS Cybersecurity: XENOTIME Now Targeting Electric Sector, in Addition to Oil and Gas

• https://dragos.com/blog/industry-news/threat-proliferation-in-ics-cybersecurity-xenotime-now-targeting-electric-sector-in-addition-to-oil-and-gas/

Hide ‘N Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP

• https://unit42.paloaltonetworks.com/hide-n-seek-botnet-updates-arsenal-with-exploits-against-nexus-repository-manager-thinkphp/

Observations of ITG07 Cyber Operations

• https://securityintelligence.com/posts/observations-of-itg07-cyber-operations/

Houdini Worm Transformed in New Phishing Attack

• https://cofense.com/houdini-worm-transformed-new-phishing-attack/

Malware Misuses Common Operating System Commands to Perform Targeted Attacks

• https://www.bromium.com/malware-os-language-targeted-attacks/

Threat Spotlight: MenuPass/QuasarRAT Backdoor

• https://threatvector.cylance.com/en_us/home/threat-spotlight-menupass-quasarrat-backdoor.html

New Spam Campaign, Possibly Necurs-based via DNS TXT Records

• https://www.bleepingcomputer.com/news/security/new-spam-campaign-controlled-by-attackers-via-dns-txt-records/
• https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

Vulnerabilities and Exploits

MSFT June 2019 Patch Tuesday

• https://isc.sans.edu/forums/diary/MSFT+June+2019+Patch+Tuesday/25024/

Intel Releases Security Updates, Mitigations for Multiple Products

• https://www.us-cert.gov/ncas/current-activity/2019/06/11/Intel-Releases-Security-Updates-Mitigations-Multiple-Products

Sandbox Escaper Publishes Additional CVE-2019-0841 Bypass

• http://sandboxescaper.blogspot.com/p/disclosures_8.html

Drop the MIC – CVE-2019-1040

• https://blog.preempt.com/drop-the-mic

“BlueKeep” Vulnerability (CVE-2019-0708) within Cloud/Datacenter Machines: How to Safeguard Yourself?

• https://www.fortinet.com/blog/threat-research/bluekeep-vulnerability-cloud-datacenters.html

The Week in Ransomware – June 14th 2019 – pyLocky and GandCrab Cleans Up

• https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-14th-2019-pylocky-and-gandcrab-cleans-up/

Breaches, Government, and Law Enforcement 

IoT Cybersecurity Improvement Act: An Important Step Forward

• https://www.tenable.com/blog/iot-cybersecurity-improvement-act-an-important-step-forward

Telegram CEO Fingers China State Actors for DDoS Attack

• https://threatpost.com/telegram-ceo-china-ddos-attack/145654/