Visualizing #cybersecurity concepts can be a great way to learn more about specific tools, methodologies, and techniques! Here is a thread that shows 6 useful infographics on threat intelligence and related topics!🧵👇#infosec#threatintel
1⃣ - Practical Threat Intel
2⃣ - Tactics, Techniques and Procedures is an important concept to understand when you are working on threat intelligence to understand the capabilities of threat actors! 🤓 #Infosec#ttp
3⃣ - Mitre ATT&CK Matrix is became one of the references to classify and categorize attackers' TTPs! ☠️ #cybersecurity
3⃣ - Diamond Model of Intrusion is another interesting concept that can help profiling tactics of threat actors! 💻#infosec
4⃣ - Anatomy of a YARA rule - Once you have gained more knowledge of threat intelligence concepts and methodologies, learning to use YARA rules can be very powerful for your threat hunting abilities!🛠️ #yararules#threathunting
5⃣ - Anatomy of a SIGMA rule - Sigma is another great tool that will help you hunt your logs. While Yara is for file, Sigma is for logs. ⚒️ #sigmarule#infosec
6⃣ - Log Parsing Cheatsheet -At some point, you'll have to get your hands dirty. Knowing the popular Linux commands for log parsing can be very helpful and timesaving during incident response! #DFIR#forensic
That's it! If you like this kind of content, you can visit my page dedicated to them where I publish these infographics! You can follow me for more stuff like this! ❤❤️🔥👇#infosec#cybersecurity#threatintel
Analyzing data leaks is a very interesting Intel challenge, especially when you’re dealing with a foreign language 🤓
The I-SOON leak, which contains mostly PNG files of screenshots of documents, is a good example 🔎
Last night, I created a Notebook to automatically process and analyze the data to speed up your investigation.
Here is my process 👇 🧵
If you don't want to read the thread, you can directly jump to the notebook here:
#infosec #isoon #leak #threatintel #llm #python #jupyterjupyter.securitybreak.io/ISOON_DataLeak…
As always, when analyzing new data, check out the structures and formats, and spend time to understand what kind of data you're dealing with. THIS is crucial!🔍
With Python, you can easily peek into the content 💻
Here I created two simple chart to visualize the repartition of the data:
📢I recently investigated a campaign targeting the cryptocurrency industry. I wrote a detailed report that includes TTP, IOC and more. Here is a thread about this attack! 🧵👇
The attack started on Telegram to identify the targets, then they deployed a weaponized Excel document which finally delivered the final backdoor through multiple mechanisms. ☠☠️ #infosec#malware#backdoor
🧐To identify the targets, the threat actor sought out members of cryptocurrency investment groups on Telegram.
👀They created fake profiles using details from employees of the company OKX. #infosec#Cryptocurency
Of course, I couldn't start this thread without talking about this project we started in 2015. Unprotect Project is a database about Malware Evasion techniques with code snippets and detection rules. cf: @DarkCoderSc
Living off the land refers to the use of dual-use tools, which are either already installed in the victims' environment, or are admin, forensic or system tools used maliciously.
The #sunburst case is interesting and demonstrates how threat actors can rely on evasion techniques or defense evasion to spy on or make damage. #UnprotectProject Thread 👇
First of all, the use of the supply chain attack made the attack super stealthy and difficult to detect. This is another red flag to increase and improve trust with partners and suppliers, although it is difficult to resolve.
#Sunburst uses the TrackProcesses() function to verify blacklisted processes and services. If an item in the blacklist is found, the loop is terminated.