Tweet

@ZephrFish

@thechrisharrod

@understudy77

https://twitter.com/d1vious/status/1506447099793133572

More from @blueteamblog

blueteamblog

@blueteamblog

May 12, 2021

https://twitter.com/likethecoins/status/1392249090260537344

LONG THREAD.

Here are some detections / preventions in response to the DarkSide findings.

INITIAL COMPROMISE

Password attacks on perimeter. 2FA everything. Set lockout thresholds on logins. Ingest logs to SIEM and monitor for brute force attempts and impossible travel.
1/14

https://twitter.com/likethecoins/status/1392249090260537344

https://twitter.com/tinkersec/status/1392196981733445635?s=21

ItAlso as mentioned the attackers potentially accessed the VPN to disable MFA. Onboard your network devices to SIEM and monitor change events.

Malicious emails. Read this tweet -

https://twitter.com/tinkersec/status/1392196981733445635?s=21

.

2/14

https://twitter.com/blueteamblog/status/1373283358147547138

ESTABLISH FOOTHOLD.

BEACON - Hunting Tips, detections and IOCs - github.com/MichaelKoczwar…

MAINTAIN PERSISTENCE

TeamViewer / Anydesk. Create a SIEM rule and / or run threat hunt for ports in below thread. Try to pick one remote access for your organisation, block the rest.

3/14

https://twitter.com/blueteamblog/status/1373283358147547138

Read 15 tweets

blueteamblog

@blueteamblog

Mar 24, 2021

Yes SIEMs can be expensive, but are you getting full value from yours? Or are you just using it for security monitoring?

Here are some other things a SIEM can be used for, to provide much more value to a business.

#siem #infosec #CyberSecurity

1/6

Dashboards. Yes, your security team has dashboards, but have you thought of creating ones to be used by Networking, Desktop Support and other teams? Ask them what dashboards could be useful, and provide them access to the SIEM which only allows access to these dashboards.

2/6

Threat Hunting. There are bountiful threat hunting resources online - Perform these threat hunts on your SIEM logs! This could find things your alerts or analysts have missed; and can lead to future detection opportunities.

3/6

Read 6 tweets

blueteamblog

@blueteamblog

Mar 3, 2021

Thread to help anyone logging to #HAFNIUM / Microsoft Exchange Zero Day and wondering where to start.

CVEs as follows - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.

These CVEs are for Exchange Server. Exchange Online users are not affected by this.

Start by reading the following two articles, patching if required and looking for the IOCs provided (they are extensive).

Microsoft Article - microsoft.com/security/blog/…

Volexity Article - volexity.com/blog/2021/03/0…

https://twitter.com/d1vious/status/1366937178379542528?s=21

Further useful reading / detections -

Splunk Queries -

https://twitter.com/d1vious/status/1366937178379542528?s=21

Sigma Rule to detect procdump on lsass.exe -

https://twitter.com/cyb3rops/status/1366868464586153989?s=21

OSQuery hunt to identify systems that the ProcDump EULA has been accepted-

https://twitter.com/eric_capuano/status/1366977482533011459?s=21

Read 6 tweets

blueteamblog

@blueteamblog

Jan 7, 2021

A quick thread.

Review of the URL's submitted to URLhaus in the past 30 days.

53109 URLs reported, lets look for patterns; which we can use for threat hunting and detection in DNS entries and proxies logs.

#infosec #cybersecurity #threathunting

25494 of the URLs end with Mozi.m, relating to the Mozi Botnet - securityintelligence.com/posts/botnet-a…. To detect this, we can look for the regex pattern .*Mozi\.m$

A further 4636 of the URLs end with Mozi.a, related to the above. We can detect this using regex pattern .*Mozi\.a$

Finally, there are 10 URLs which contain Mozi within them in different patterns to above. It is therefore worthwhile searching for any case of Mozi within a URL (This will be greedier than the above, but still worthwhile checking)

Read 11 tweets

blueteamblog

@blueteamblog

Jan 6, 2021

Quick #Emotet thread with detections / mitigations etc since there has been a spike in the past few months.

Firstly, it is worth blocking the URL's, Domains and IP addresses found at the following links -

paste.cryptolaemus.com
feodotracker.abuse.ch/downloads/ipbl…
urlhaus.abuse.ch/downloads/csv_…

Cryptolaemus also contains Emotet hashes in their releases - check for these on your network if possible.

Next, It is worth setting up detections in your SIEM for any communications to the URL's, Domains and IP addresses found at the following links -