Free SIEM to augment existing SIEM.
Currently we have SIEM (SAAS Solution) that covers all of our servers, switches, routers firewalls.

We do not collect logs for any of our workstations (3000 workstations) and I would like to have something but we do not have any budget to increase our existing SIEM capacity. I just want to have something incase I need to review logs on a workstations.

I was looking at Wazuh but it does not look like it will scale well with that many workstations.

Any recommendations?
🗣Critical_Egg_913

I'm going to be different and say, you don't need a siem to handle workstations. Get alerts out of your EDR and then use Velociraptor to query for logs and other events on workstations.
👤mustacheride3

I just ran across gravwell.io I'm currently testing it out in a lab but it looks promising. It is free up to 14gb/day
👤semipvt

Graylog. Open Source Splunk.
👤SLC_CA


🎖@malwr

MSIFortune - LPE with MSI Installers
A quite long blogpost about several types of LPEs which I found in the msi repair function.

There is a lot of different stuff, much more then Mandiant reveiled a few months ago.

Tested about 1000 msi which was quite time consuming.

https://badoption.eu/blog/2023/10/03/MSIFortune.html
🗣PfiatDe


🎖@malwr

TargetCompany Ransomware Abuses FUD Obfuscator Packers

In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems.

https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html


🎖@malwr

Remote Code Execution In PyTorch Model Server TorchServe
Remote Code Execution In PyTorch Model Server TorchServe

Oligo's research team has uncovered a chain of critical vulnerabilities, named ShellTorch, including CVE-2023-43654 (CVSS: 9.8) in the PyTorch model server TorchServe.

This flaw allows unauthorized access to #AI models and enables Remote Code Execution (RCE) leaving countless services and end-users at risk.
🗣BigBother59


🎖@malwr

What is the dark web?

What is the dark web, and how is it different from the deep web?

https://blog.talosintelligence.com/what-is-the-dark-web/


🎖@malwr

Quishing Triage 101: How to Investigate Suspicious QR Codes in Emails

Quishing, derived from combining “QR code” and “phishing,” has manifested as a significant cybersecurity threat, particularly noting a discernible surge in incidents since July 2023. This technique leverages QR codes, square barcodes decipherable by mobile device cameras, to mislead users into interacting with malicious digital content. When a user scans a QR code in a...

https://intezer.com/blog/alert-triage/quishing-triage-how-to-investigate-suspicious-qr-codes-in-emails/


🎖@malwr

A Practical Approach to SBOM in CI/CD Part III — Tracking SBOMs with Dependency-Track
🗣theowni

Do you fill up dependencies manually, or using something like BlackDuck?
👤broadexample


🎖@malwr