Dark Reading: Attacks/Breaches
Avast Business Introduces Network Discovery for SMBs

Avast's Network Discovery enables network administrators to easily analyze their entire IT network and deploy Avast Business security services.

Dark Reading: Attacks/Breaches
Onfido Acquires EYN to Provide Acoustic-Based Liveness Detection

Technology will be incorporated into Onfido’s Real Identity Platform.

Dark Reading: Attacks/Breaches
Identity-Focused Security Controls Prevail

How identity and access management strategies held up during the pandemic and tips for putting together an identity security road map.

Dark Reading: Attacks/Breaches
Cynerio Launches IoT Attack Detection and Response Module for Healthcare IoT Devices

Module helps hospitals identify, contain, and mitigate threats on devices exhibiting malicious or suspicious behavior.

Dark Reading: Attacks/Breaches
Cyber Readiness Institute Names Karen S. Evans as New Managing Director

Former assistant secretary for cybersecurity, energy security, and emergency response at US Department of Energy and Homeland Security CIO to lead strategic vision and day-to-day operations.

Dark Reading: Attacks/Breaches
Annual Cyber Risk Survey Finds Businesses Are Sharpening Their Focus on Cybersecurity but Also Reveals Much Room for Improvement in Building Cyber-Resilience

This year's survey features the highest percentage of cyber insurance buyers since the beginning of the survey 11 years ago.

Unauthenticated Cache Purge
https://medium.com/@priyanshbansal25/unauthenticated-cache-purge-c56fac8569e8?source=rss------bug_bounty-5

Hello everyone, I am Priyansh and this is my first writeup. Today I will be discussing a vulnerability that I found in one of the…Continue reading on Medium » (https://medium.com/@priyanshbansal25/unauthenticated-cache-purge-c56fac8569e8?source=rss------bug_bounty-5)

Kali Linux Tutorials
Qu1cksc0pe : All-in-One Static Malware Analysis Tool

Qu1cksc0pe tool allows you to statically analyze Windows, Linux, OSX executables and APK files.

You can get:

* What DLL files are used.
* Functions and APIs.
* Sections and segments.
* URLs, IP addresses and emails.
* Android permissions.
* File extensions and their names.
And so on…

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Usage

python3 qu1cksc0pe.py –file suspicious_file –analyze

Screenshot
https://blogger.googleusercontent.com/img/a/AVvXsEjCfQNGdWnLYGhp00BorUldbuJVWZQciP_8aPLceoFdbsKiPQXapp5zU6lVo-Y8boOJItUMGborfMQiwJpFCoT8g3_Jkwb9FpN3vJAYo78mv2ZqKMfAYb_nGqFyq1ObImK_WYdZJn8736Q-6oZeKw0_KUCyU8CXEUp2A0-0ckcFvmHK7u6sMLICsllb=s1028
Updates

09/10/2021

* Added AndroidRuntimemodule. Now you can analyze android applications dynamically!!
*
https://blogger.googleusercontent.com/img/a/AVvXsEiAdssHxE67TQ4KN48fHL1yhOs6I3ZquuVeYyMk54vCeF1e7vgnUvtQZ_EFz8Sn7e9j1w0TIxekLkmUVH9BgFGIdYNVh9B-7ZvjEJJn5Iep2hrwZCO-f3RBWZ7eRMXIpEI5qXGfP_nB0-SZa2HsTGdJlxI5r-spHaMXrhCBuxv2KGOgsKpJxHkjzIMB=s1912
Available On
https://blogger.googleusercontent.com/img/a/AVvXsEi6DQOSvTI_6FD7UuH2BORD6GOcwu4LS5MdSRbd2Z5SXd-Fm-OKzMdrHrfDTMBTlYXyadHMrP3U7wC58p7GZvr5-2XHTjghEPwk-dnOG_d1OHXfyH49pHivJCi37pP6bTBTxd_pbBgUCMEkche70CisaJnfDvzlG9ZEeToXm3AyrV0xe5Ry2FVQLWeH=s687
Note

* You can also use Qu1cksc0pe from Windows Subsystem Linuxin Windows 10. Setup

Necessary python modules:

* puremagic=> Analyzing target OS and magic numbers.
* androguard=> Analyzing APK files.
* apkid=> Check for Obfuscators, Anti-Disassembly, Anti-VM and Anti-Debug.
* prettytable=> Pretty outputs.
* tqdm=> Progressbar animation.
* colorama=> Colored outputs.
* oletools=> Analyzing VBA Macros.
* pefile=> Gathering all information from PE files.
* quark-engine=> Extracting IP addresses and URLs from APK files.
* pyaxmlparser=> Gathering informations from target APK files.
* yara-python=> Android library scanning with Yara rules.
* prompt_toolkit=> Interactive shell.
* frida=> Performing dynamic analysis against android applications.
Installation of python modules: pip3 install -r requirements.txtGathering other dependencies:

* VirusTotal API Key: https://virustotal.com* Binutils: sudo apt-get install binutils* ExifTool: sudo apt-get install exiftool* Strings: sudo apt-get install stringsAlert

You must specify jadx binary path in Systems/Android/libScanner.conf

[Rule_PATH]
rulepath = /Systems/Android/YaraRules/
[Decompiler]
decompiler = JADX_BINARY_PATH <–

Installation

* You can install Qu1cksc0pe easily on your system. Just execute the following commands.
Command 0: sudo pip3 install -r requirements.txtCommand 1: sudo python3 qu1cksc0pe.py --installScan Arguments Normal analysis

Usage: python3 qu1cksc0pe.py --file suspicious_file --analyzehttps://blogger.googleusercontent.com/img/a/AVvXsEjPAG3Are339cssGE6-KZzX05cL02BI_y1h5QpU4pCcVLK2PHSU6-4idAXsIATfvIjOf3w00w7fWGO7DPAYZGFIh6zMeJGlngO_nzUCP-f-JtQWcs_UbOlhpmvQwgh0-v4vr_bopErn5JkkB-B54SUvDPP_de4-gHzmjVrZ3hxKclK0KoYMRH_VCyRM=s973
Multiple Analysis

Usage: python3 qu1cksc0pe.py --multiple FILE1 FILE2 ...https://blogger.googleusercontent.com/img/a/AVvXsEjxCZr1OYUsRV1uZwir4e-c8p3QQ6pv2n2cqN-qezWp1iVKTz72QIfUwe2XBi3FdUgPrgt1_aHunz75EhcE0SzaHQxA9ABLJWtXnj0WkHgVbYDdbNuSFKXpJQ_z7M3ozBZa6ze1Mmd_ubyRfOw04Ce1eh1ccw6dNDIhOyNY9k7Y9qzjn7c0hncUJHsM=s898
Hash scan

Usage: python3 qu1cksc0pe.py --file suspicious_file --hashscanhttps[...]

://blogger.googleusercontent.com/img/a/AVvXsEixS31UC-HdHy_r1a2hceCzd0MIlJNS0IoZICWonFhEJMfHO1QNmtkkXrdqRxqpXIaTbDE9fiuWl_8uld1msx3LzG_GNvWTe_bsmQUFGfbfHyTjuyML5woU_W-fjTU1HrSKFXRS9u9JkQKGJhlD6HM2B2uQZPR8XUZwzbLDvV8nPxu3UwLw1WaCt76I=s624
Folder scan

Supported Arguments:

* --hashscan* --packerUsage: python3 qu1cksc0pe.py --folder FOLDER --hashscanhttps://blogger.googleusercontent.com/img/a/AVvXsEh5ICE8PmfyFXVCr8YX4DpQvLl4FFTEawDXsvUcTl7tcb7A4mgGt42BdCaqFqtLmcxXmM5GhO30reYCrEQiyfTwI0dM8k0FAfFpgbI8DU8UMkOTX5728B-Lb-OV-eD7Brxxc-UL-LldKmFXnnhkvh5oNLa0oVgBl0CECmaPiUGr0x9zqbAcLDS5nXyX=s949
Virus Total

Report Contents:

* Threat Categories* Detections* CrowdSourced IDS ReportsUsage for –vtFile: python3 qu1cksc0pe.py --file suspicious_file --vtFilehttps://blogger.googleusercontent.com/img/a/AVvXsEiF0mUx7rIyxDF4aa6Sd8gSJgNJI4Aijp7ajp6bqtt2l3SJe7Y_9Wtt1f8s7_59wpva2gWrV6OUJchkEjMiNdAYNyvDZIw4zas_24KbWcnZkHr6lZdNC2XpqZUkbeaydcbPcAzVgEEagVkBxYcfMLsWCBEWLIiwL0Ebw6K1LCWCWAU4fDuVlqRVnLdm=s659
Document scan

Usage: python3 qu1cksc0pe.py --file suspicious_document --docshttps://blogger.googleusercontent.com/img/a/AVvXsEhL3-Qatmlcf5VOAv5Uhov0pE9Y0-dGDp6mdMDLSz9vlHSo7jB5VOXCVSOmfbKYIsfiAvOhmm7u-wVfdd595QiDX7PFVKS9260O5kPl8Sjq9pIbsVuraXjiDsPARJW7zT3uLalbkKLyMsb1nt_h3DvBdcQx5DAN5ozVrIO8YBLvBTuVcIXW67r_1XTC=s955
Programming language detection

Usage: python3 qu1cksc0pe.py --file suspicious_executable --langhttps://blogger.googleusercontent.com/img/a/AVvXsEhn8e-X-zOGLC6il5zOyJH1fjL_KuMMZaTwqrMIUZ-TWZQmi9wv4LPVxpFvUUhRVCjVE88gB-5kruSCLV9AgOleRjHJ-DavsP6mKxus5lRX9Q9Q0zYwIvALUL8ndqfOezUTxTL7L98ZGAg2cxm_j2aSERgrPbME_6r6Pv028lVvG6ta49HvqpIis1MT=s596
Interactive shell

Usage: python3 qu1cksc0pe.py --consolehttps://blogger.googleusercontent.com/img/a/AVvXsEgbiq3-0C1Kv0DrmZEvHyPq4cP_jJx_K2-DYu9Ou8avLsSfJoWw5Uhq6AWjE59dUF8k8-lXjAr-odkN9-CmLbN2SW00ATYqpbHnA3YFqRYSJtkfl4DG3SBEwPgQKAEeWfHp5fDNLvrrpRi2vLb_XfEzHnbLUYtsoUs58G_RmlYPLoA0JjlsvrTd_m6S=s1054
Domain

Usage: python3 qu1cksc0pe.py --file suspicious_file --domainInformations About Categories Registry

This category contains functions and strings about:

* Creating or destroying registry keys.
* Changing registry keys and logs. File

This category contains functions and strings about:

* Creating/modifying/infecting/deleting files.
* Getting information about file contents and filesystems. Networking/Web

This category contains functions and strings about:

* Communicating with malicious hosts.
* Downloading malicious files.
* Sending informations about infected machine and its user. Process

This category contains functions and strings about:

* Creating/infecting/terminating processes.
* Manipulating processes. Dll/Resource Handling

This category contains functions and strings about:

* Handling DLL files and another malware’s resource files.
* Infecting and manipulating DLL files. Evasion/Bypassing

This category contains functions and strings about:

* Manipulating Windows security policies and bypassing restrictions.
* Detecting debuggers and doing evasive tricks. System/Persistence

This category contains functions and strings about:

* Executing system commands.
* Manipulating system files and system options to get persistence in target systems. COMObject

This category contains functions and strings about:

* Microsoft’s Component Object Model system. Cryptography

This category contains functions and strings about:

* Encrypting and decrypting files.
* Creating and destroying hashes. Information Gathering

This category contains functions and strings about:

* Gathering informations from target hosts like process states, network devices etc. Keyboard/Keylogging

This category contains functions and strings about:

* Tracking infected machine’s keyboard.
* Gathering i[...]

nformation about targets keyboard.
* Managing input methods etc. Memory Management

This category contains functions and strings about:

* Manipulating and using target machines memory. Download

Kernel Karnage – Part 1
https://www.reddit.com/r/redteamsec/comments/qgz9bj/kernel_karnage_part_1/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.nviso.eu/2021/10/21/kernel-karnage-part-1/) [comments] (https://www.reddit.com/r/redteamsec/comments/qgz9bj/kernel_karnage_part_1/)

Detecting EDR Bypass: Malicious Drivers(Kernel Callbacks)
https://www.reddit.com/r/redteamsec/comments/qgz9oz/detecting_edr_bypass_malicious_driverskernel/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://posts.bluraven.io/detecting-edr-bypass-malicious-drivers-kernel-callbacks-f5e6bf8f7481) [comments] (https://www.reddit.com/r/redteamsec/comments/qgz9oz/detecting_edr_bypass_malicious_driverskernel/)