Understanding "Solorigate"'s Identity IOCs
🗣Wireless_Life
The Solarwinds attack is an ongoing investigation, and teams at Microsoft continue to act as first responders to these attacks. The following post shares how they leverage threat intelligence and monitor for new indicators that could signal attacker activity.
👤Wireless_Life
🎖@malwr
🗣Wireless_Life
The Solarwinds attack is an ongoing investigation, and teams at Microsoft continue to act as first responders to these attacks. The following post shares how they leverage threat intelligence and monitor for new indicators that could signal attacker activity.
👤Wireless_Life
🎖@malwr
TECHCOMMUNITY.MICROSOFT.COM
Solorigate AzureAd IOCs
Solarwinds solorigate IOCS Identity
Forwarded from CVE Notify
🚨 CVE-2020-28641
In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.
🎖@cveNotify
In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.
🎖@cveNotify
Malwarebytes Support
Arbitrary file deletion vulnerability fixed in Malwarebytes Endpoint Protection
In October 2020, Fortinet's FortiGuard Labs reported an arbitrary file deletion vulnerability in our product Malwarebytes Endpoint Protection. The product was mistakenly deleting good files that we...
DirectX creator Eric Engstrom dies aged 55, leaving behind a game-changing legacy
🗣instilledbee
According to wikipedia, he died from complications from dropping a monitor on his foot. Talk about unlucky. Damn.
👤turniphat
🎖@malwr
🗣instilledbee
According to wikipedia, he died from complications from dropping a monitor on his foot. Talk about unlucky. Damn.
👤turniphat
🎖@malwr
Developer Tech News
DirectX creator dies aged 55, leaving behind a game-changing legacy
DirectX creator Eric Engstrom has sadly passed away at the age of 55, following a career which helped to shape the gaming industry as we know it.
BlueTeam Online Training
I’m looking to have continuous training for a blue team and I’m curious as to what the group would recommend. Outside of Cybrary and SANS what do you recommend?
I’m personally interested in core disciplines and not aimed towards a certification. Also, being continuous is also helpful.
🗣nullsku
https://wildwesthackinfest.com/training-schedule/
👤Sho_nuff_
I haven’t used it but ISACA’s training looks solid. Was gonna try it before training budget was cut.
Maybe you can do a trial to see if you like it.
https://www.isaca.org/training-and-events/cybersecurity
👤Just_saying_brah
🎖@malwr
I’m looking to have continuous training for a blue team and I’m curious as to what the group would recommend. Outside of Cybrary and SANS what do you recommend?
I’m personally interested in core disciplines and not aimed towards a certification. Also, being continuous is also helpful.
🗣nullsku
https://wildwesthackinfest.com/training-schedule/
👤Sho_nuff_
I haven’t used it but ISACA’s training looks solid. Was gonna try it before training budget was cut.
Maybe you can do a trial to see if you like it.
https://www.isaca.org/training-and-events/cybersecurity
👤Just_saying_brah
🎖@malwr
Reddit
From the blueteamsec community on Reddit
Explore this post and more from the blueteamsec community
Reversing APT-28 64-bit Keylogger [Zebrocy Nim TLP: White ](https://0xthreatintel.medium.com/reversing-apt-28-64-bit-keylogger-zebrocy-nim-tlp-white-a77033f5c36b)
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Zelda Hit Detection - Behind the Code [YouTube](https://www.youtube.com/watch?v=FBk-QkzMeIk)
🗣rolfr
🎖@malwr
🗣rolfr
🎖@malwr
YouTube
Zelda Hit Detection - Behind the Code
Code walk through sword collision detection, sword/wand states, and the wand collision bug.
If you would like to support this channel, here is a link to the Displaced Gamers Patreon page - https://www.patreon.com/displacedgamers
Twitter: https://twit…
If you would like to support this channel, here is a link to the Displaced Gamers Patreon page - https://www.patreon.com/displacedgamers
Twitter: https://twit…
Tutorial video explaining Paging in x86_64 systems and how to add it to your C++ OS
🗣AbsurdPoncho
🎖@malwr
🗣AbsurdPoncho
🎖@malwr
YouTube
Page Table Manager | How to Make an OS: 8
In this video we make a Page Table Manager so that we can map any virtual address to any physical address when we need to.
➤Discord:
https://discordapp.com/invite/p2JYhr9
➤Github:
https://github.com/Absurdponcho/PonchoOS/tree/Episode-8-Page-Table-Manager…
➤Discord:
https://discordapp.com/invite/p2JYhr9
➤Github:
https://github.com/Absurdponcho/PonchoOS/tree/Episode-8-Page-Table-Manager…
SOLARWINDS BACKDOOR (SUNBURST) INCIDENT RESPONSE PLAYBOOK
🗣digicat
Looks like some good steps and would be a good starting point for many looking to have a checklist of items if their security IRP is not well flushed out.
👤hackfacts
🎖@malwr
🗣digicat
Looks like some good steps and would be a good starting point for many looking to have a checklist of items if their security IRP is not well flushed out.
👤hackfacts
🎖@malwr
TrustedSec
SolarWinds Backdoor (Sunburst) Incident Response Playbook
SolarWinds Orion servers should be forensically preserved, if possible, to allow forensic examination. User Activity The accounts mentioned below include…
CVE-2020-8554 is a vulnerability that particularly affects multi-tenant Kubernetes clusters. If a potential attacker can create or edit services and pods, then they may be able to intercept traffic. Learn how to detect CVE-2020-8554 using open source Falco
🗣RoutineConversation4
🎖@malwr
🗣RoutineConversation4
🎖@malwr
Sysdig
Detect CVE-2020-8554 using Falco – Sysdig
How to detect the CVE-2020-8554 vulnerability that allows users to intercept traffic from other pods or nodes in a Kubernetes cluster.
Malware wrapped in Cyberpunk 2077
🗣f474m0r64n4
And this is why that walled garden works!
Edit: and this is why we iOS users don’t need third party stores or the ability to side load just by clicking a link
👤AndreiD2017
🎖@malwr
🗣f474m0r64n4
And this is why that walled garden works!
Edit: and this is why we iOS users don’t need third party stores or the ability to side load just by clicking a link
👤AndreiD2017
🎖@malwr
Kaspersky
Ransomware disguised as a mobile version of Cyberpunk 2077
Cybercriminals spread mobile ransomware under the guise of a beta version of Cyberpunk 2077 for Android.
Cloud-native security operations with Azure Sentinel. A new ‘Microsoft Learn’ training module, finally replacing the ‘Ninja’ training.
🗣munrobotic
🎖@malwr
🗣munrobotic
🎖@malwr
Docs
Cloud-native security operations with Microsoft Sentinel - Training
This learning path describes basic architecture, core capabilities, and primary use cases of its products. You'll also learn about differences and Get familiar with Microsoft Sentinel, a cloud-native, security information and event management (SIEM) service.
Emotet Returns to Hit 100K Mailboxes Per Day
🗣DrinkMoreCodeMore
How wholesome, dropping Christmas presents!
👤PM_CUTE_PUSSY
🎖@malwr
🗣DrinkMoreCodeMore
How wholesome, dropping Christmas presents!
👤PM_CUTE_PUSSY
🎖@malwr
Threat Post
Emotet Returns to Hit 100K Mailboxes Per Day
Just in time for the Christmas holiday, Emotet is sending the gift of Trickbot.
HalMakeBeep - Reversing A Tiny Built-In Windows Kernel Module [Journey from Kernel32 to HAL](http://www.debasish.in/2014/02/reversing-tiny-built-in-windows-kernel.html)
🗣doctorstyles
🎖@malwr
🗣doctorstyles
🎖@malwr
www.debasish.in
Reversing A Tiny Built-In Windows Kernel Module [Journey from Kernel32 to HAL]
Debasish Mandal's Personal Blog about Information Security Research,Exploit Development,Vulnerability Research,Python and some random ideas!