HCS ▋ @superruserr@infosec.exchange

rest of 2020 goals in mind: 📆

Pivot at the current place

Take on board another project

Actually contribute to an open source project (now that, I'm no longer involved with open source / community software)

Contribute into an online course

Pick up a whole new skill

Keep up my blog entries on hannahsuarez.me

Continue to apply and send Cfp/talk submissions

Continue on with this ruleset submissions that has been on my mind

Who moved my DNS cheese? BIND 9 DNS Log Collection and DNS Auditing https://hannahsuarez.github.io/2020/who-moved-my-cheese-dns-linux/

Looking into other cloud DNS infrastructure for a potential series. What provider do you use?

Just a note that they also share options to come up and be a speaker.

Current Calls for Presentations (CFPs)

https://www.sans.org/cyber-security-summit/speak-at-a-summit?msc=blog

And subscribe to their notification list!

WOW!! SANS Virtual Summits Will Be FREE for the Community in 2021

https://www.sans.org/blog/sans-virtual-summits-free-2021/

Cyber Threat Intelligence Summit
Open-Source Intelligence
ICS Security Suimit
Purple Team Summit
CloudSec Next Summit
DFIR Summit
Security Awareness Summit
Cybersecurity Leadership Summit
Cyber Defense Summit |
Threat Hunting Summit
Cloud & DevOps Security 2021
Pen Test HackFest Summit

The #DFIR Report

https://thedfirreport.com/

Real Intrusions by Real Attackers, The Truth Behind the Intrusion

SIEM use case writing and best practices https://blueteamblog.com/siem-use-case-writing-guide

InfoSec Black Friday Deals 2020 https://github.com/0x90n/InfoSec-Black-Friday

German Open Source Intelligence Conference GOSINTCon 2020

https://www.youtube.com/watch?v=iAxlmOmztAA&feature=youtu.be

(in German)

DeTT&CT aims to assist blue teams using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours.

https://github.com/rabobank-cdc/DeTTECT

How Ryuk Ransomware operators made $34 million from one victim https://www.bleepingcomputer.com/news/security/how-ryuk-ransomware-operators-made-34-million-from-one-victim/

German prosecutors tried to prove that a ransomware attack on a hospital was to blame for someone losing their life. Their story is a warning https://www.wired.co.uk/article/ransomware-hospital-death-germany

Other than my German lessons (I booked at least 22 hours incl 11 hrs class), what else can I do in the next 2-3 weeks for the rest of November?
An immersive #Python course somewhere?
More blog posts on http://hannahsuarez.me for another topic?
Maybe rules for socprime?

Humble Book Bundle: AWS, Azure, Google, and Cloud Security https://www.humblebundle.com/books/aws-azure-google-and-cloud-security-books

Save the date for the virtual Purple Team Summit on Friday, November 13, 2020.

This is a community driven event for the entire Purple Team from all levels including Executives to Students. We want to get Cyber Threat Intelligence, Red Team, Blue Team, SOC, Hunt Teams, Digital Forensics and Incident Response, and everything in between together for this free conference and workshops. More details coming soon.

The Call for Presentations is now open til October 18, 2020.

https://www.scythe.io/purple-team-summit

Cyber Threat Intelligence Summit CFP https://www.sans.org/event/cyber-threat-intelligence-summit-2021/call-for-presentations

Remapping Red Canary with ATT&CK sub-techniques https://redcanary.com/blog/mitre-sub-techniques/

Nice, HKCU run keys get a mention. https://vxug.fakedoma.in/papers/VXUG/Exclusive/PersistenceSeries/0/MasqueradingtheHKCURunKey.pdf

Defenders can check out my post on: List of HKEY_* / Windows Registry keys and subkeys to audit based on MITRE ATT&CK, JPCert Lateral Movements analysis https://hannahsuarez.github.io/2019/hkey-mitre/ and other links

Thread: https://twitter.com/smelly__vx/status/1310119130943586304

+ their addition: "Note: Mitre | Att&ck does not explicitly list this technique. This technique is a pseudo-hybrid child of DLL side-loading & binary masquerading."

A Dutch hacker summer camp is a go go for 2021! #MCH2021

Collect and alert on this PowerShell code that disables Microsoft-Windows-PowerShell event logging:
Remove-EtwTraceProvider -AutologgerName EventLog-Application -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}'
(from https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 )

Because attacks like Empire uses powershell command line parameters, which you can also add rules on your choice of siem or dashboard, see https://uncoder.io then "Empire PowerShell Launch Parameters" #blueteam #logging

DNS and IT security - Know your DNS Queries and Requests, Attacks, and SANS CSC https://hannahsuarez.github.io/2020/dns-log-collection-series-security-dns/

An overview of targeted attacks and APTs on Linux

https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/

Registration for #ShellCon2020 is LIVE / October 9th and 10th http://shellcon.io/registration