HAWKEYE

Cyber Security, Incident Response, Managed SOC Services, Security Operations Center

Detecting Cyber-Attacks on Kubernetes Environment

Kubernetes is a container orchestration system that acts as a management abstraction layer. It is an open-source system that aids […]

Advanced Persistent Threat, Cyber Security, Malware Protection, Managed SOC Services

An overview of FIN11 and their motivations

A financially driven threat group FIN11 has run some of the most extensive and longest-running malware dissemination campaigns. Researchers have […]

Advanced Persistent Threat, Alert Advisory, Cyber Threat Management, Managed SOC Services

Alert Advisory: Insight into APT29

Threat group APT29 is allegedly operated by Russia’s Foreign Intelligence Service (SVR). They have been active since 2008 and frequently […]

Advanced Persistent Threat, Alert Advisory, Cyber Security, Incident Response, Managed Security Services, Managed SOC Services

Alert Advisory: Insight into APT42

APT42 is a state-sponsored cyber espionage group in Iran. The gang, which has been active at least since 2015, is […]

Alert Advisory, Incident Response, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, XDR

Alert Advisory: New Microsoft Exchange Zero-Days

Late on September 29, 2022, Microsoft acknowledged both zero-day vulnerabilities and stated that they were aware of “limited, targeted attacks […]

Breach Detection, Cyber Security, Managed SOC Services

Recent Uber Breach and Lessons Learnt

Uber acknowledged reports of a widespread cybersecurity compromise on September 15th. The security investigation found that the company’s system had […]

Cyber Security, Managed Security Services, Managed SOC Services

Usage of NPPSpy

Extracting Windows credentials from Domain based hosts is one of the common attack techniques hackers use to obtain user credentials […]

Cyber Security, Machine Learning, Malware Protection, Managed SOC Services

Malware Evasion Techniques and Recommendations for Threat Protection

Malware evasion methods are frequently employed to evade detection, analysis, and comprehension. Due to the fact that sandboxes are now […]

Cyber Security, Cyber Threat Intelligence, Machine Learning, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, Threat Intelligence

Data Exfiltration and Detection through Anomaly Detection

Data exfiltration is the unauthorised transfer of critical and sensitive data and/or information from a targeted network to the cyber […]

Cyber Security, Machine Learning, Managed Security Services, Managed SOC Services

DGA Detection Using Machine Learning

Domain Generation algorithm (DGA) is an automation technique used by cyber attackers for a variety of attacks like Data exfiltration, […]

Cyber Security, Machine Learning, Managed SOC Services, UEBA

Augmenting Traditional UEBA with ML and Deep Learning

User and entity behavior analytics (UEBA) is a threat detection technology that is based on analytics. UEBA employs machine learning […]

Cyber Security, Security Operations Center

Tools Used for Dumping of RDPCreds via comsvcs.dll

Remote Desktop Protocol (RDP) is commonly used by administrators to manage Windows environments remotely. It is also typical for RDP […]

Cyber Security, Managed SOC Services, Security Operations Center

Sniffing Attacks – Packet Capture Techniques Used by Attackers

Sniffing attacks are data thefts caused by capturing network traffic with packet sniffers, which can illegally access and read unencrypted […]

Cyber Security, Managed SOC Services, Security Operations Center

LSASS Dumping Techniques

Local Security Authority Subsystem Service (LSASS) is the process on Microsoft Windows that handles all user authentication, password changes, creation […]

Cyber Security, Reconnaissance Tools

Common Reconnaissance Tools Used by Threat Actors

Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Background […]

Cyber Security, Managed SOC Services, XDR

DNS Tunneling and Countermeasures in an Enterprise

DNS tunneling is one of the significant threats that an organization faces when it comes to attacker tactics and techniques […]

Alert Advisory, Cyber Security, Managed SOC Services, Ransomware Protection, Security Operations Center, XDR

Alert Advisory: Analysis of BlackCat Ransomware

BlackCat, also known as ALPHV-ng, ALPHV, and Noberus, is a Ransomware-as-a-Service (RaaS) threat that targets organizations across multiple sectors worldwide […]

Cyber Security

SSO SAML Tokens Attack

SAML (In)Security Security Assertion Markup Language (SAML) is a method for exchanging authentication and authorization between trusted parties. It’s essentially […]

Cyber Security, Incident Response, Security Operations Center

Kerberoasting – Active Directory Attack

Active Directory services are usually used by organizations for easily configuring policies and managing permissions. Due to its widespread usage, […]

Advanced Persistent Threat, Malware Protection

ToddyCat APT

ToddyCat — a relatively new Chinese-Speaking Advanced Persistent Threat, has been targeting and exploiting vulnerable Exchange Servers throughout Europe and […]

Cyber Security, Incident Response, Vulnerability Assessment

CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability and Digital Forensics

Microsoft issued CVE-2022-30190 regarding a vulnerability regarding the Microsoft Support Diagnostic Tool (MSDT). This exists when MSDT is called using […]

Malware Protection, Managed Security Services, Managed SOC Services

Wiper Malware – What is it and How to Detect?

In the world of different malware types and strains, the most disruptive malware type besides ransomware might be Wiper malware. […]

Ransomware Protection

Ransomware Detection Using Machine Learning

Gone are the days of manual security analysis that cyber security teams used to perform to track down and stop […]

Compromise Assessment, Ransomware Protection

How to Detect Ransomware Early

The proliferation of ransomware attacks in the past decade has brought many challenges to companies and cyber security teams worldwide. […]