HCS ▋ @superruserr@infosec.exchange

Added a couple of short entries today

https://hannahsuarez.github.io/2019/eurobsdcon-lillehammer/

Collection of various answers I've given online

https://hannahsuarez.github.io/2019/Top-Answers/

If you are in Luxembourg area, it looks like there are some free #misp trainings in February, but a no show would be a 40 euro fee

https://en.xing-events.com/UXMOBFA

https://en.xing-events.com/DLCMDJY

#misp - Malware Information Sharing Platform & Threat Sharing - Training Materials

https://www.circl.lu/services/misp-training-materials/

Is Threat Hunting the new Fad? https://isc.sans.edu/diary/25746

Interesting item to think about, knowing your 'enemy'...

https://medium.com/anton-on-security/how-to-fail-at-know-your-enemy-24b2ab40632c

does 'knowing your enemy' involve ...
- a list of bad IPs
- a set of event ids
- different entropy (ie when obscuring potentially malicious powershell commands like disabling an etw provider)

"In fact, many observations of past badness — the indicators — may in fact be essentially random and present no useful knowledge about the future badness or about the nature of the enemy, their intents and capabilities."

#Infosec Skills Matrix
#BSidesLeeds

https://infosecskillsmatrix.com/rolesskills

CfP in now extended until 10th February for #BSidesLjubljana https://bsidesljubljana.si

And the venue will be at #Ljubljana Castle this year 🐉

Me: posts something positive and wholesome that is #infosec parallel on Twitter

Twitter: *fights amongst themselves over Thing*

Me: *feels awkward*

Looks like I am now going to #bsidesdublin in March! I used to live in Dublin, Ireland for a short while...Ireland is one of my favourite countries! Looking forward to visiting again in March https://www.bsidesdub.ie/index.php #bsides

https://www.bsidesdub.ie/index.php

Windows Performance Toolkit - Xperf - https://docs.microsoft.com/en-us/archive/blogs/ntdebugging/windows-performance-toolkit-xperf

Concurrency Visualizer - https://docs.microsoft.com/en-us/visualstudio/profiling/concurrency-visualizer?view=vs-2019

Tracefmt - https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/understanding-tracefmt

Tracerpt - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tracerpt_1
TraceView - https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/traceview-overview

PerfView - https://github.com/Microsoft/perfview

SvcTraceView - https://docs.microsoft.com/en-us/dotnet/framework/wcf/service-trace-viewer-tool-svctraceviewer-exe

logman - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman

Developer own ETW tools:

C# - https://blogs.msdn.microsoft.com/danielvl/2009/02/02/how-to-consume-etw-events-from-c/

Pywintrace - https://www.fireeye.com/blog/threat-research/2017/09/pywintrace-python-wrapper-for-etw.html

PowerShell - https://docs.microsoft.com/en-us/message-analyzer/automating-tracing-functions-with-powershell

I signed up to preview Amazon Detective https://aws.amazon.com/detective/

"Amazon Detective makes it easy to analyze, investigate, and quickly identify the root cause of potential security issues or suspicious activities. Amazon Detective automatically collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct faster and more efficient security investigations."

Very interesting.

Just published by my colleague: how to do Windows USB Auditing using modules available on free/paid versions of this log collector

https://nxlog.co/documentation/nxlog-user-guide/windows-usb-auditing.html

“In essence, people write stupid string-matching and regex-based content because they trust it. They do not — en masse — trust the event taxonomies if their lives and breach detections depend on it. And they do.” — Chronicle

https://medium.com/@chroniclesec/security-correlation-then-and-now-a-sad-truth-about-siem-7bee55b7ceee

The Department of Defence and the Australian Taxation Office recently entered into contracts with the government’s exclusive Microsoft licence reseller, Data#3, to extend support until at least 2021 https://www.itnews.com.au/news/defence-ato-fork-out-millions-to-keep-windows-7-secure-for-another-year-536572

Just published: Windows Event IDs to collect based on top Windows Security Events, JP/CERT Lateral Movements and also on other guidance from NSA and Palantir. https://nxlog.co/documentation/nxlog-user-guide/eventlog-eventids.html - You can use the Community Edition for these and adapt on your own systems. #nxlog #infosec

"CIS Controls Implementation Guide for SMEs" https://www.cisecurity.org/wp-content/uploads/2017/09/CIS-Controls-Guide-for-SMEs.pdf

Published: Work I have done around Rapid7 Integration to collect and rewrite logs to the Universal Event Format (UEF) which offers another alternative to what is in their documentation https://nxlog.co/documentation/nxlog-user-guide/rapid7.html

Getting my teeth into Mcafee EPO, Micro Focus Arcsight and Microsoft Advanced Threat Analytics log collection integrations

small ebook I drafted on siem and log collection to go to the marketing agency's designer.

MITRE Releases Framework for Cyber Attacks on Industrial Control Systems

https://attack.mitre.org/ics/

#ics

Cybersecurity Canon https://cybercanon.paloaltonetworks.com/

#books #booklist