ردپاهایی که در ویندوز باقی میماند و شما بعنوان جرم شناس میتوانید به آنها تکیه کنید
#آکادمی_روزبه
https://medium.com/@peace_o_O/introduction-to-windows-artifacts-your-gateway-to-effective-incident-response-cc39172af3a3
#آکادمی_روزبه
https://medium.com/@peace_o_O/introduction-to-windows-artifacts-your-gateway-to-effective-incident-response-cc39172af3a3
Medium
Introduction to Windows Artifacts : Your Gateway to Effective Incident Response
https://pixabay.com/photos/code-hacker-data-security-707069/
شاید وصله کردن دوا نکند !!
در مثال زیر پس از وصله مجددا سیستم دچار آسیب پذیری شده
#آکادمی_روزبه
https://www.darkreading.com/vulnerabilities-threats/apache-erp-0day-underscores-dangers-of-incomplete-patches
در مثال زیر پس از وصله مجددا سیستم دچار آسیب پذیری شده
#آکادمی_روزبه
https://www.darkreading.com/vulnerabilities-threats/apache-erp-0day-underscores-dangers-of-incomplete-patches
Dark Reading
Apache ERP Zero-Day Underscores Dangers of Incomplete Patches
Apache fixed a vulnerability in its OfBiz enterprise resource planning (ERP) framework last month, but attackers and researchers found a way around the patch.
وقتی پلاگین بک آپ گیری ورد پرس هم دردسر ساز می‌شود
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/amp/
#آکادمی_روزبه
https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/amp/
www-bleepingcomputer-com.cdn.ampproject.org
50K WordPress sites exposed to RCE attacks by critical bug in backup plugin
A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.
آشنایی با یک اسکنر متن باز
و نمونه گزارشات
#آکادمی_روزبه
https://cert.pl/en/posts/2024/01/artemis-security-scanner/
و نمونه گزارشات
#آکادمی_روزبه
https://cert.pl/en/posts/2024/01/artemis-security-scanner/
cert.pl
The Artemis security scanner
Artemis is an open-source security vulnerability scanner developed by CERT PL. It is built to look for website misconfigurations and vulnerabilities on a large number of sites. It automatically prepares reports that can be sent to the affected institutions.…
تحلیل ترافیک Trickbot
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
Unit 42
Wireshark Tutorial: Examining Trickbot Infections
A tutorial offering tips on how to identify Trickbot, an information stealer and banking malware that has been infecting victims since 2016.
تحلیل بدافزار بانکی
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
Unit 42
Wireshark Tutorial: Examining Ursnif Infections
Ursnif is banking malware sometimes referred to as Gozi or IFSB. The Ursnif family of malware has been active for years, and current samples generate distinct traffic patterns.This tutorial reviews packet captures (pcaps) of infection Ursnif traffic using…
و اینهم یک تحلیل دیگر از فعالیت های بدافزاری
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
#آکادمی_روزبه
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
Unit 42
Wireshark Tutorial: Examining Ursnif Infections
Ursnif is banking malware sometimes referred to as Gozi or IFSB. The Ursnif family of malware has been active for years, and current samples generate distinct traffic patterns.This tutorial reviews packet captures (pcaps) of infection Ursnif traffic using…
تحلیل بد افزار
How Pikabot obfuscates and decrypts strings.
How Pikabot retrieves API addresses.
How Pikabot slows down the analysis process.
How Pikabot generates victim uuid.
Collecting information from the victim’s machine.
How Pikabot decrypts C2 addresses.
How Pikabot utilizes Syscall.
#آکادمی_روزبه
https://kienmanowar.wordpress.com/2024/01/06/quicknote-technical-analysis-of-recent-pikabot-core-module/
How Pikabot obfuscates and decrypts strings.
How Pikabot retrieves API addresses.
How Pikabot slows down the analysis process.
How Pikabot generates victim uuid.
Collecting information from the victim’s machine.
How Pikabot decrypts C2 addresses.
How Pikabot utilizes Syscall.
#آکادمی_روزبه
https://kienmanowar.wordpress.com/2024/01/06/quicknote-technical-analysis-of-recent-pikabot-core-module/
0day in {REA_TEAM}
[QuickNote] Technical Analysis of recent Pikabot Core Module
1. Overview In early February 2023, cybersecurity experts on Twitter issued a warning about a new malware variant/family being distributed by the #TA577 botnet (associated with the same group from …
آکادمی آموزش روزبه 📚
تحلیل بد افزار How Pikabot obfuscates and decrypts strings. How Pikabot retrieves API addresses. How Pikabot slows down the analysis process. How Pikabot generates victim uuid. Collecting information from the victim’s machine. How Pikabot decrypts C2…
کتابهای پیشنهادی در مسیر انجام تحلیل بدافزار
#آکادمی_روزبه
https://blog.securitybreak.io/my-top-books-to-learn-malware-analysis-and-reverse-engineering-2ae1c6e209b9
#آکادمی_روزبه
https://blog.securitybreak.io/my-top-books-to-learn-malware-analysis-and-reverse-engineering-2ae1c6e209b9
Medium
My Top Books to Learn Malware Analysis and Reverse Engineering
I often get messages from people wanting to learn more about reverse engineering and malware. I always refer to the same books and I though…
ترجمه کامل مقاله روزنامه هلندی
درخصوص اولین مرحله از حضور اکستاکس نت در ایران
#آکادمی_روزبه
https://onhexgroup.ir/stuxnet-erik-van-sabben/
درخصوص اولین مرحله از حضور اکستاکس نت در ایران
#آکادمی_روزبه
https://onhexgroup.ir/stuxnet-erik-van-sabben/
ONHEXGROUP
ابعاد جدیدی از ویروس استاکس نت منتشر شد
در این پست گزارش روزنامه ی هلندی Volkskrant در خصوص نحوه ی ورود ویروس استاکس نت به تاسیسات هسته ای ایران ، توسط یه مهندس هلندی رو بررسی کردیم.
آسیب پذیری خطرناک در ویندوز
وصله کنید
#آکادمی_روزبه
a Windows Kerberos security feature bypass vulnerability that allows attackers to bypass authentication mechanisms and launch impersonation attacks. Attackers can exploit this flaw via a machine-in-the-middle (MitM) attack.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674
وصله کنید
#آکادمی_روزبه
a Windows Kerberos security feature bypass vulnerability that allows attackers to bypass authentication mechanisms and launch impersonation attacks. Attackers can exploit this flaw via a machine-in-the-middle (MitM) attack.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20674
اینطور هست که اطلاعات حساس از برنامه های اندروئید بیرون کشیده می‌شوند
#آکادمی_روزبه
https://github.com/effortlessdevsec/ApkRecon
#آکادمی_روزبه
https://github.com/effortlessdevsec/ApkRecon
GitHub
GitHub - effortlessdevsec/ApkRecon: Scanning APK file for URIs, endpoints & secrets.
Scanning APK file for URIs, endpoints & secrets. Contribute to effortlessdevsec/ApkRecon development by creating an account on GitHub.
تمرین
مدیریت حادثه با پاورشل
با یک ویروس نمونه
#آکادمی_روزبه
https://www.securityinbits.com/incident-response/powershell-commands-for-incident-response/
مدیریت حادثه با پاورشل
با یک ویروس نمونه
#آکادمی_روزبه
https://www.securityinbits.com/incident-response/powershell-commands-for-incident-response/
Securityinbits
PowerShell Commands for Incident Response - Securityinbits
We will learn different PowerShell Commands can be used in Incident Response to remediate the machine. I will take a scenario where a machine is infected with NanoCore malware to explain this PowerShell Commands.