Tweet

blueteamblog

6 Jan, 7 tweets, 5 min read

Quick #Emotet thread with detections / mitigations etc since there has been a spike in the past few months.

Firstly, it is worth blocking the URL's, Domains and IP addresses found at the following links -

paste.cryptolaemus.com
feodotracker.abuse.ch/downloads/ipbl…
urlhaus.abuse.ch/downloads/csv_…

Cryptolaemus also contains Emotet hashes in their releases - check for these on your network if possible.

Next, It is worth setting up detections in your SIEM for any communications to the URL's, Domains and IP addresses found at the following links -

feodotracker.abuse.ch/downloads/ipbl…
urlhaus.abuse.ch/downloads/text/
paste.cryptolaemus.com

Next, There are Sigma rules to detect Emotet, for example -

github.com/Neo23x0/sigma/…

github.com/Neo23x0/sigma/…

There are YARA rules which can be used to hunt for Emotet using tools such as ClamAV.- github.com/StefanKelm/yar…

There are Snort rules to detect Emotet (First two pages) - snort.org/search?page=1&…

Emotet detection tool for Windows OS. - github.com/JPCERTCC/EmoCh…

@Cryptolaemus1

Also recommend following these accounts for Emotet updates -

@Cryptolaemus1
@malware_traffic
@ffforward
@pollo290987
@Unit42_Intel
@abuse_ch
@anyrun_app

Also, it is always worth checking your proxy logs for suspicious patterns, some ideas here - blueteamblog.com/various-threat…

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @blueteamblog

blueteamblog

@blueteamblog

7 Jan

A quick thread.

Review of the URL's submitted to URLhaus in the past 30 days.

53109 URLs reported, lets look for patterns; which we can use for threat hunting and detection in DNS entries and proxies logs.

#infosec #cybersecurity #threathunting

25494 of the URLs end with Mozi.m, relating to the Mozi Botnet - securityintelligence.com/posts/botnet-a…. To detect this, we can look for the regex pattern .*Mozi\.m$

A further 4636 of the URLs end with Mozi.a, related to the above. We can detect this using regex pattern .*Mozi\.a$

Finally, there are 10 URLs which contain Mozi within them in different patterns to above. It is therefore worthwhile searching for any case of Mozi within a URL (This will be greedier than the above, but still worthwhile checking)

Read 11 tweets

blueteamblog

@blueteamblog

21 Dec 20

SIEM info thread.

I have posts with rules, SIEM best practices, threat hunting - blueteamblog.com

Free SIEM rules -

• github.com/Azure/Azure-Se…
• github.com/Neo23x0/sigma/…
• github.com/elastic/detect…
• github.com/elastic/detect…
•my.socprime.com/tdm/ (partially free)

Understanding commonly used log formats :

Windows Security Event Logs – search Event ID here – ultimatewindowssecurity.com/securitylog/en……
Azure AD Audit logs – docs.microsoft.com/en-us/azure/ac…
Azure AD SignIn logs – docs.microsoft.com/en-us/azure/ac……
Linux Logs – plesk.com/blog/featured/……

1/2

DHCP Logs – serverbrain.org/network-planni……
DNS Logs – nxlog.co/whitepapers/dn……
Office365 – docs.microsoft.com/en-us/microsof……
Proxy Logs – vanimpe.eu/2016/10/21/pro…

2/2

Read 5 tweets

blueteamblog

@blueteamblog

13 Dec 20

I have a lot of people asking me ‘Will SOAR / Automation in general replace SOC/Cybersecurity Analyst jobs in X number of years’

My opinion - Simple answer, no.

Long answer, it is already (and will in all SOCs in the future) replace simple tasks such as copy pasting info

1/

From tools into ticketing platforms, sorting mailboxes, running scans on IOCs and things such as this. (Which in a lot of cases are currently classed as Tier/Level 1 analysts tasks)

It will not replace expert knowledge, such as in-depth analysis skills, remediating difficult

2/

Problems (Incident Response), threat Intel investigations / reporting, risk mitigation etc etc. The list goes on of tasks and skills which SOAR/Automation will not replace any time soon.

So don’t be worried - SOAR/Automation should be thought of as an assistant for us all

3/

Read 7 tweets

blueteamblog

@blueteamblog

22 Nov 20

Work in #Infosec / #CyberSecurity?

Here are some tools I have been using recently that I think will make your life easier!

Got any you would like to share? Put them in the comments. 😀

Sooty (All in one CLI tool) - github.com/TheresAFewCono…

Intel Owl (Threat intel data about a specific file IOC from a single API at scale) - github.com/intelowlprojec…

Cyber Chef (Web app for carrying out all manner of "cyber" operations within a web browser.) - gchq.github.io/CyberChef/

TheHive (Scalable Incident Response Platform designed to make life easier for SOCs, CSIRTs, and CERTs, featuring integration with MISP.) - thehive-project.org

CertSpotter (Alerts you when a SSL/TLS certificate is issued for one of your domains.) - github.com/SSLMate/certsp…

Read 4 tweets

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Share this page!

blueteamblog

Try unrolling a thread yourself!

More from @blueteamblog

blueteamblog

blueteamblog

blueteamblog

blueteamblog

Did Thread Reader help you today?

Like this author's thread?