Hiding Your Tracks: Bash History
🗣bad3r_
Nice! I would add another one, kill the console to quit bash without saving history:
kill -9 $$
👤ReigningShells
🎖@malwr
🗣bad3r_
Nice! I would add another one, kill the console to quit bash without saving history:
kill -9 $$
👤ReigningShells
🎖@malwr
What do you use for IP Reputation?
We are currently using IBM X-force, but o don't find it that reliable there is a lot if false positives in there.
Any suggestions? Especially for one were we can get a feed from (API or something)
🗣Mo7Robot
https://www.abuseipdb.com/register
https://talosintelligence.com/reputation\_center
https://www.apivoid.com/api/ip-reputation/
👤chrisknight1985
If you are looking for malicious domains the Fortinet threat feed is pretty good. It's part of their Fortinet Developer's Network Site License. It's an API feed that supports csv and stix formats.
👤Defiant_Success
🎖@malwr
We are currently using IBM X-force, but o don't find it that reliable there is a lot if false positives in there.
Any suggestions? Especially for one were we can get a feed from (API or something)
🗣Mo7Robot
https://www.abuseipdb.com/register
https://talosintelligence.com/reputation\_center
https://www.apivoid.com/api/ip-reputation/
👤chrisknight1985
If you are looking for malicious domains the Fortinet threat feed is pretty good. It's part of their Fortinet Developer's Network Site License. It's an API feed that supports csv and stix formats.
👤Defiant_Success
🎖@malwr
Reddit
From the cybersecurity community on Reddit
Explore this post and more from the cybersecurity community
Ubisoft send 2FA recovery code by email
🗣-d4v3-
Once someone has access to your email they can take away the 2FA anyways. So it's not really weird or smth
👤Axua247
🎖@malwr
🗣-d4v3-
Once someone has access to your email they can take away the 2FA anyways. So it's not really weird or smth
👤Axua247
🎖@malwr
Emotet file hashes, Compromised IP addresses and domains, and malicious powershell artifacts
While collecting malware samples on pastebin, my bot found an anonymous paste that contained a large amount of data relating to emotet.
It includes a section of file hashes, malicious IP addresses, compromised servers, compromised domains, and a few obfuscated powershell artifacts that look to either be post-exploitation or an alternative infection method.
File samples can be collected by simply using wget on a live compromised domain.
Here is a link to a reupload of the document:
https://pastebin.com/V6GGEPVA
🗣NovateI
🎖@malwr
While collecting malware samples on pastebin, my bot found an anonymous paste that contained a large amount of data relating to emotet.
It includes a section of file hashes, malicious IP addresses, compromised servers, compromised domains, and a few obfuscated powershell artifacts that look to either be post-exploitation or an alternative infection method.
File samples can be collected by simply using wget on a live compromised domain.
Here is a link to a reupload of the document:
https://pastebin.com/V6GGEPVA
🗣NovateI
🎖@malwr
Pastebin
Copy of An Emotet Report - Pastebin.com
Need to know how to setup a "Basic" Vulnerability Management program? Follow these steps to start 2020 off right in VM!
https://cyberpulse.tech/2020/01/21/create-a-basic-vulnerability-management-program/
🗣Siloras
🎖@malwr
https://cyberpulse.tech/2020/01/21/create-a-basic-vulnerability-management-program/
🗣Siloras
🎖@malwr
Cyberpulse
Create a basic Vulnerability Management program - Cyberpulse
Create a successful and modern Vulnerability Management program by following these phases. Plan, Design, and Execute the following steps to be secure!
Fake Company, Real Threats: Logs From a Smart Factory Honeypot - Security News
🗣_TM_dude
The most interesting part of this piece was the layout they used on their website to show the story.
It looks like it was running for several months, but didn't produce any revealing information. A few non-technical ransomware attacks. Simple stuff caused by poor security, which, I get it, it was mainly to show how weak security is a main point of entry. Not exactly revolutionary.
👤DegenerateJC
Disappointed. I wish the guy came from real APT group doing more sophisticated or unknown exploits. No PLC system were harmed or attempted.
👤thanoscsgo
I like the guy who acted like he was installing ransomware then renamed their files instead.
👤steezefries
🎖@malwr
🗣_TM_dude
The most interesting part of this piece was the layout they used on their website to show the story.
It looks like it was running for several months, but didn't produce any revealing information. A few non-technical ransomware attacks. Simple stuff caused by poor security, which, I get it, it was mainly to show how weak security is a main point of entry. Not exactly revolutionary.
👤DegenerateJC
Disappointed. I wish the guy came from real APT group doing more sophisticated or unknown exploits. No PLC system were harmed or attempted.
👤thanoscsgo
I like the guy who acted like he was installing ransomware then renamed their files instead.
👤steezefries
🎖@malwr
Trendmicro
Fake Company, Real Threats: Logs From a Smart Factory Honeypot
To determine threat actors' degree of knowledge in compromising a smart factory, we deployed our most elaborate honeypot to date. The incidents we observed show the kinds of attacks that can easily affect poorly secured manufacturing environments.