Discover and read the best of Twitter Threads about #incidentresponse
Most recents (9)
10 ways to use awk for hackers! 🚀 🧵👇 
1️⃣ Extracting Specific Columns from a CSV File
Quickly extract email addresses and phone numbers from a huge contact list.
#DataExtraction #EthicalHacking
Quickly extract email addresses and phone numbers from a huge contact list.
#DataExtraction #EthicalHacking
2️⃣ Filtering Lines Based on a Pattern
Filter out sensitive information like passwords from log files.
#LogAnalysis #Security
Filter out sensitive information like passwords from log files.
#LogAnalysis #Security
Today's quick #malware analysis with #SecurityOnion: FAKEBAT, REDLINE STEALER, and GOZI/ISFB/URSNIF pcap from 2023-02-03!
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
blog.securityonion.net/2023/02/quick-…
#infosec
#infosecurity
#ThreatHunting
#IncidentResponse
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
blog.securityonion.net/2023/02/quick-…
#infosec
#infosecurity
#ThreatHunting
#IncidentResponse
@malware_traffic Let's review some of the data that #SecurityOnion generates from this traffic!
When you import the pcap using so-import-pcap, it will generate a hyperlink that will take you to the Overview dashboard:
When you import the pcap using so-import-pcap, it will generate a hyperlink that will take you to the Overview dashboard:
@malware_traffic Here are the NIDS alerts:
(1/6) To all investigators out there who have heard of #Maltego before, but still looking for more information. Here's what you need to know about Maltego 👇 #OSINT #infosec
(2/6) #Maltego is a link analysis tool that helps you automatically pull and map data from over 70 public data sources (#OSINT) and third-party data providers, and your own imported or custom data integrations. All of this done with a few clicks on the mouse in one interface.
(3/6) You start by providing input information for your investigation (name, alias, domain, IP address, etc.), install the data integrations you want to use, and #Maltego will retrieve relevant Entities from the data integrations and visualize the data connections between them.
A thread on the (suspected) Okta compromise from an incident response perspective 🧵
#okta #LAPSUS$ #dfir #incidentresponse
#okta #LAPSUS$ #dfir #incidentresponse
1. Collect and preserve all Okta logs, focus on the Okta System Log as it's the main audit trail for Okta activities
Need more info on this log check (developer.okta.com/docs/reference…)
Need more info on this log check (developer.okta.com/docs/reference…)
2. Search your audit log for suspicious activity focus on your superuser/admin Okta accounts as they pose the largest risk
Here begins a fun thread of the finished lightboards that we make together during the ϟ Enlightning stream. ♫
Also- a big THANK YOU to all who come out to watch ϟ Enlightning, and also to those who take the time to watch the recording. I appreciate you.
@VMwareTanzu
Also- a big THANK YOU to all who come out to watch ϟ Enlightning, and also to those who take the time to watch the recording. I appreciate you.
@VMwareTanzu
What is a Small Batch Loop? Featuring guest @cote
Dockerfiles Vs. Cloud Native Buildpacks featuring guest @ciberkleid
Dealing with a bunch of memory #forensics lately so I just dump fairly new tools that are useful to all #dfir #incidentresponse out there:
MemProcFS - convenient and easy to use
BulkExtractor - extracts everything into a text file and grep it
SuperMem - CS tool for quick triage
MemProcFS - convenient and easy to use
BulkExtractor - extracts everything into a text file and grep it
SuperMem - CS tool for quick triage
MemProcFS - github.com/ufrisk/MemProc…
SuperMem - github.com/CrowdStrike/Su…
.@reuschlaw ist beim European Cyber Security Month (#ECSM) von @enisa_eu und @BSI_Bund gleich mit zwei Webinaren beteiligt: Am 05.10.2020 zu Sofortmaßnahmen bei #Cyberangriffen und am 20.10.2020 zu den Auswirkungen von Corona auf die IT-Sicherheit von Unternehmen. #ECSM2020
Anmeldung und weitere Informationen zum #ECSM2020-Webinar von @reuschlaw am 05.10.2020 (Gehackt und jetzt? – technische und rechtliche Sofortmaßnahmen bei Cyberangriffen) unter bsi.bund.de/SiteGlobals/Fo…. #ITSicherheit #Datenpanne #Cybersicherheit #IncidentResponse
Anmeldung und weitere Informationen zum #ECSM2020-Webinar von @reuschlaw am 20.10.2020 ("Virus durch das Virus: Auswirkungen von Corona auf die IT-Sicherheit von Unternehmen") unter bsi.bund.de/SiteGlobals/Fo… #Corona #ITSicherheit #VirusdurchdasVirus #ECSM2020
We are just starting our session @hasgeek. @abh1sek talking about data breaches and how they happen.
hasgeek.com/rootconf/data-…
Join the live stream on the webpage.
#datasecurity
hasgeek.com/rootconf/data-…
Join the live stream on the webpage.
#datasecurity
Thank you @hasgeek for giving us this amazing platform to talk about what we love most #datasecurity #appsec
#cloudsecurity
#cloudsecurity
Agenda for the session
Kommentar zum Artikel:
Bei unseren Kunden wurden alle #Netscaler unmittelbar nach bekanntwerden des Workaround angepasst.
Nach genauerer Analyse mussten wir aber feststellen, dass "alle" Netscaler bereits #kompromitiert sind. 1/x
#Citrix #Shitrix #fail
security-insider.de/shitrix-gefaeh…
Bei unseren Kunden wurden alle #Netscaler unmittelbar nach bekanntwerden des Workaround angepasst.
Nach genauerer Analyse mussten wir aber feststellen, dass "alle" Netscaler bereits #kompromitiert sind. 1/x
#Citrix #Shitrix #fail
security-insider.de/shitrix-gefaeh…
Da auf den Systemen durch die #Exploit's offensichtlich unter anderem auch #Cronjob's eingerichtet wurden, welche irgendwann in Zukunft beliebigen Code von russischen Servern nachladen...jeder Anwender absolut sicherstellen, dass sein System nicht bereits #kompromitiert wurde.
Der angekündigte #Hotfix, wird die bereits entstandenen Probleme sicher nicht lösen. Aus unserer Sicht hilft ausschließlich eine komplette #Neuinstallation der #Komponenten, verbunden mit einem unmittelbaren unmittelbares umsetzen des #Workaround bevor das System online geht.
