Malware Analysis Tools
Here are some of the free tools for analyzing a malware. 1. Process Hacker- observers running processes
Process monitor- records local system interactions 2. ProcDOT - cleans up and visualizes process monitor data 3. Wireshark - records network activity
4. Magnetic ram capture – creating memory dumps 5. IDA Pro – is a code analysis tool useful in reverse engineering malwares. 6. What’s Running - is a scanning tool that shows currently active programs, processes, services, modules and network connections.
7. Directory Monitor - is a tool used for the surveillance of directories and/or network shares and will notify you of file changes, access, deletions, modifications new files on real time 8. RegScanner - a tool that enables you to scan the registry
9. Capsa Network Analyzer- records network activity 10. Virtual lab – an environment for setting up the malware analysis with the tools needed 11. Mandiant RedLine - is analyzing malicious activity through memory and file analysis and development of a threat assessment profile.
10. Volatility - is a memory forensics framework for malware analysis. With this tool, you can extract information from running processes, network sockets, network connection, DLLs and registry hives. 11. Remnus - a Linux distro with tools for malware analysis
• • •
Missing some Tweet in this thread? You can try to
force a refresh
A Security Operations Centre is an organizational framework for security. It combines many components of a robust security environment, including people, processes, and tools that can detect, respond, and analyze security threats.
SOCs run 24 hours a day, seven days a week, with security analysts interacting with environmental data to watch for emerging threats and respond as required.
Along with the technology components, a SOC leverages several levels of cybersecurity analysts.
They are broken up into tiers and manage different tasks based on their experience.
Tier 1 (Triager): An entry-level position that works on the front lines of the SOC, typically triaging and prioritizing the hundreds of alerts that get set.
In today's post, we will look at the benefits of having a strong threat intelligence infrastructure in any organization: 1. Threat analysis - You will be able to learn the patterns that attackers use to compromise your system(s). This will greatly aid in countering them properly
2. Security operations - You can be able to set up and correctly configure various security systems after learning about the scope of items in the threat intelligence research materials you have gathered.
3. Vulnerability management - You can decide to handle the risks that come along with various vulnerabilities via various strategies such as handling, transferring or handling the risks obtained.
Here are some opensource tools for Cyber threat intelligence that you can utilize; 1. SIEM (security information and event management) for network monitoring needs. A SIEM (like Wazuh, AlienVault, Zeek, etc.) is a tool for monitor network traffic and log files in real time and
allow response to incoming threats. 2. HoneyDB provides real time data of honeypot activity. This data comes from honeypots deployed on the Internet using the HoneyPy honeypot. In addition, HoneyDB provides API access to collected honeypot activity,
which also includes aggregated data from various honeypot Twitter feeds. 3. Infosec - CERT-PA is an online repository that contains Malware samples collection and analysis, blocklist service, vulnerabilities database and more. Other similar tools include VirusShare, etc.
Organizations mostly source threat intelligence from third-party providers. By Purchasing this service without using the info to proactively protect your network is like buying a book and expecting to learn the information without reading it.
Here are things that can help organizations use threat intelligence more productively. 1. Define what is important ensure that it’s tailored to fit your needs in order to receive the benefit by receiving applicable content to effectively risk profile your business.
There is no point in receiving threat information about attacks on SQL database servers if your organization doesn’t use that kind of server. 2. Be willing to share its common that security information is not shared not within departments or groups, let alone between companies.
Did you know that cyber threat intelligence is an on-going, circular process or cycle rather than an end-to-end process as threat actors never stop developing and testing new techniques for their exploitation.
As such, the threat intelligence cycle involves the following steps;
1. Planning and direction: Data requirements must first be defined by defining what information is needed to make informed decisions in the shortest time. This helps define objectives that are based on evidence gathered, such as the nature of the attack, what was compromised etc.
2. Collection: Large quantities of raw data is collected from internal and external threat intelligence sources, such as audit logs, IP addresses, physical devices, chat rooms, articles blogs, etc. 3. Processing: Raw data is filtered, categorized, and organized.
Today we are going to cover Azure Active Directory.
Azure AD is not simply a cloud version of AD as the name might suggest. Although it performs some of the same functions, it is quite different.
🧵👇
Azure Active Directory is a secure online authentication store, which can contain users and groups. Users have a username and a password which are used when you sign into an application that uses Azure AD for authentication...
...So for example all of the Microsoft Cloud services use Azure AD for authentication: Office 365, Dynamics 365, and Azure. If you have Office 365, you are already using Azure AD under the covers.😉