Summary

— A collection of infosec links to Tools & Tips, Threat Research, and more! The focus trends toward DFIR and threat intelligence, but general information security and hacking-related topics are included as well. This list is not vetted nor intended to be an exhaustive source. Keeping up with the enormous volume of security-related information is a daunting task, but this is my way of filtering the most useful items and improving the signal to noise ratio. Happy Reading!

Industry Reports, News, and Miscellany

C-Suite in the Hot Seat – Execs’ Responsibility Regarding Digital Security
- https://www.lastline.com/blog/c-suite-in-the-hot-seat-execs-responsibility-regarding-digital-security/
Pervasive Social Engineering Characterizes the Threat Landscape: Proofpoint Releases the Human Factor 2019 Report
- https://www.proofpoint.com/us/threat-insight/post/pervasive-social-engineering-characterizes-threat-landscape-proofpoint-releases
Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/evolution-of-malware-sandbox-evasion-tactics-a-retrospective-study/
Process Injection and Manipulation: Malware Evasion Techniques Part 1
- https://www.deepinstinct.com/2019/09/15/malware-evasion-techniques-part-1-process-injection-and-manipulation/
The Rise of New Tactics in Business Email Compromise
- https://www.fireeye.com/blog/products-and-services/2019/09/the-rise-of-new-tactics-in-business-email-compromise.html
Week in OSINT #2019–36
- https://medium.com/week-in-osint/week-in-osint-2019-36-f8ad16732b2
Mirai Botnet Continues to Plague IoT Space
- https://blog.reversinglabs.com/blog/mirai-botnet-continues-to-plague-iot-space
Clarifying ProtonMail and Huawei
- https://protonmail.com/blog/clarifying-protonmail-and-huawei/
Automated incident response in Office 365 ATP now generally available
- https://www.microsoft.com/security/blog/2019/09/09/automated-incident-response-office-365-atp-now-generally-available
The Five Stages of the DFIR Career Grief Cycle
- https://brettshavers.com/brett-s-blog/entry/the-five-stages-of-the-dfir-career-grief-cycle
Does Your Incident Evidence Really Lead to Better Intelligence?
- https://medium.com/anton-on-security/does-your-incident-evidence-really-lead-to-better-intelligence-9dbc0379fa5d
Decaying of Indicators – MISP improved model to expire indicators based on custom models
- https://www.misp-project.org/2019/09/12/Decaying-Of-Indicators.html
The Curious Case of Edward Snowden
- https://pylos.co/2019/09/15/the-curious-case-of-edward-snowden/

Threat Research – Malware, Phishing, and other Campaigns in the Wild

Dissecting the 10k Lines of the new TrickBot Dropper
- https://blog.yoroi.company/research/dissecting-the-10k-lines-of-the-new-trickbot-dropper/
InnfiRAT: A new RAT aiming for your cryptocurrency and more
- https://www.zscaler.com/blogs/research/innfirat-new-rat-aiming-your-cryptocurrency-and-more
ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group
- https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/
Gluptedba Expands Operation and Toolkit with LOLBINS and Cyptominer
- https://www.cybereason.com/blog/glupteba-expands-operation-and-toolkit-with-lolbins-cryptominer-and-router-exploit
Rig Exploit Kit Delivering VBScript
- https://isc.sans.edu/forums/diary/Rig+Exploit+Kit+Delivering+VBScript/25318/
Threat Spotlight: TrickBot Infostealer Malware
- https://threatvector.cylance.com/en_us/home/blackberry-cylance-vs-trickbot-infostealer-malware.html
Malware Analysis Report (AR19-252A) – North Korean Trojan: BADCALL
- https://www.us-cert.gov/ncas/analysis-reports/ar19-252a
COBALT DICKENS Goes Back to School…Again
- https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again

Tools and Tips

Using Docker to Do Machine Learning at Scale
- https://www.crowdstrike.com/blog/using-docker-to-do-machine-learning-at-scale/
iOS Location Mapping with APOLLO Part 1: I Know Where You Were Today, Yesterday, Last Month, and Years Ago!
- https://digital-forensics.sans.org/blog/2019/09/10/ios-location-mapping-with-apollo-part-1
Following the CloudTrail: Generating strong AWS security signals with Sumo Logic
- https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
How to build an incident response playbook
- https://swimlane.com/blog/incident-response-playbook/
Open Sourcing StringSifter
- https://www.fireeye.com/blog/threat-research/2019/09/open-sourcing-stringsifter.html
How to Detect Running Malware – Intro to Incident Response Triage (Part 7)
- https://www.cybertriage.com/2019/how-to-detect-running-malware-intro-to-incident-response-triage-part-7/
Malware Analysis Techniques — Basic Static Analysis
- https://medium.com/@NasreddineBencherchali/malware-analysis-techniques-basic-static-analysis-335a7286a176
TaHiTI Threat Hunting Methodology – Version 1.0
- https://www.betaalvereniging.nl/wp-content/uploads/DEF-TaHiTI-Threat-Hunting-Methodology.pdf
Windows Forensics Analysis — Windows Artifacts (Part I)
- https://medium.com/@NasreddineBencherchali/windows-forensics-analysis-windows-artifacts-part-i-c7ad81ada16c
BLUF: The Military Standard That Can Make Your Writing More Powerful
- https://www.animalz.co/blog/bottom-line-up-front
pixload — Image Payload Creating tools
- https://github.com/chinarulezzz/pixload
Inhale – is a malware analysis and classification tool that is capable of automating and scaling many static analysis operations.
- https://github.com/netspooky/inhale

Breaches, Government, and Law Enforcement

Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups
- https://home.treasury.gov/index.php/news/press-releases/sm774
Scammer behind sextortion campaigns arrested in France
- https://www.zdnet.com/article/scammer-behind-sextortion-campaigns-arrested-in-france/
Arizona Schools Ransomware Attack: Recovery Update
- https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/arizona-schools-recovery-update/
281 Arrested Worldwide in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes
- https://www.justice.gov/opa/pr/281-arrested-worldwide-coordinated-international-enforcement-operation-targeting-hundreds
FIN7’s IT admin pleads guilty for role in billion-dollar cybercrime crew
- https://www.cyberscoop.com/fin7-fedir-hladyr-guilty-carbanak/

Vulnerabilities and Exploits

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2019-093/
The Art of Patch Management
- https://securityintelligence.com/articles/the-art-of-patch-management/
Another Local Privilege Escalation Vulnerability Using Process Creation Impersonation
- https://www.fortinet.com/blog/threat-research/another-local-privilege-escalation-lpe-vulnerability.html
From BinDiff to Zero-Day: A Proof of Concept Exploiting CVE-2019-1208 in Internet Explorer
- https://blog.trendmicro.com/trendlabs-security-intelligence/from-bindiff-to-zero-day-a-proof-of-concept-exploiting-cve-2019-1208-in-internet-explorer/
Watchbog and the Importance of Patching
- https://blog.talosintelligence.com/2019/09/watchbog-patching.html
Microsoft September 2019 Patch Tuesday
- https://isc.sans.edu/forums/diary/Microsoft+September+2019+Patch+Tuesday/25310/
BlueKeep: A Journey from DoS to RCE (CVE-2019-0708)
- https://www.malwaretech.com/2019/09/bluekeep-a-journey-from-dos-to-rce-cve-2019-0708.html

Weekly News Roundup — September 8 to September 14