Tools Used for Dumping of RDPCreds via comsvcs.dll
Remote Desktop Protocol (RDP) is commonly used by administrators to manage Windows environments remotely. It is also typical for RDP […]
Sniffing Attacks – Packet Capture Techniques Used by Attackers
Sniffing attacks are data thefts caused by capturing network traffic with packet sniffers, which can illegally access and read unencrypted […]
LSASS Dumping Techniques
Local Security Authority Subsystem Service (LSASS) is the process on Microsoft Windows that handles all user authentication, password changes, creation […]
Common Reconnaissance Tools Used by Threat Actors
Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Background […]
DNS Tunneling and Countermeasures in an Enterprise
DNS tunneling is one of the significant threats that an organization faces when it comes to attacker tactics and techniques […]
Alert Advisory: Analysis of BlackCat Ransomware
BlackCat, also known as ALPHV-ng, ALPHV, and Noberus, is a Ransomware-as-a-Service (RaaS) threat that targets organizations across multiple sectors worldwide […]
SSO SAML Tokens Attack
SAML (In)Security Security Assertion Markup Language (SAML) is a method for exchanging authentication and authorization between trusted parties. It’s essentially […]
Kerberoasting – Active Directory Attack
Active Directory services are usually used by organizations for easily configuring policies and managing permissions. Due to its widespread usage, […]
ToddyCat APT
ToddyCat — a relatively new Chinese-Speaking Advanced Persistent Threat, has been targeting and exploiting vulnerable Exchange Servers throughout Europe and […]
CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability and Digital Forensics
Microsoft issued CVE-2022-30190 regarding a vulnerability regarding the Microsoft Support Diagnostic Tool (MSDT). This exists when MSDT is called using […]
Wiper Malware – What is it and How to Detect?
In the world of different malware types and strains, the most disruptive malware type besides ransomware might be Wiper malware. […]
Ransomware Detection Using Machine Learning
Gone are the days of manual security analysis that cyber security teams used to perform to track down and stop […]
How to Detect Ransomware Early
The proliferation of ransomware attacks in the past decade has brought many challenges to companies and cyber security teams worldwide. […]
CSOC Analysts Cybersecurity Toolkit Arsenal
It is safe to say that organizations worldwide have different infrastructure setups, technology, software, and different network architecture types. No […]
XDR Software – The Journey Beyond
We are still in the early days of the XDR (eXtended Detection and Response) era, understanding XDR technology in the […]
Log4j Critical RCE
The Log4j Vulnerability commonly known as Log4Shell zero day vulnerability was made public on December 9th 2021. This vulnerability is […]
How Threat Actors Steal Your Data with Reverse Tunnelling
Reverse tunnelling is a technique used to ‘sneak into’ a secured network by hiding applications within traffic which originates from […]
Using Windows Event Forwarding for Centralized Windows Monitoring – Part 3
Reading security logs requires a higher level of permission that other logs. Below are the steps to configure the right […]
Using Windows Event Forwarding for Centralized Windows Monitoring – Part 2
From a security perspective, generally, it would be better to allow communication from user segments to outside rather than from […]
Using Windows Event Forwarding for Centralized Windows Monitoring – Part 1
Staying on top of cyber threats in your environment could be challenging even with a lot of protective measures in […]
Deep-dive into Azure Sentinel – Part 2 – Data Collection and Processing
From our experience in deploying various SIEM platform, we would rank Azure sentinel number one when it comes to the […]
Deep-dive into Azure Sentinel – Part 1 – Introduction to Sentinel as a SIEM
You might have heard of the North Sentinel Island in the middle of Bay of Bengal that hosts the most […]
SOAR Features and Use Cases
Organizations are getting bigger and bigger and, because of that a lot of events, activities and data are being generated […]
Dark Web and Threat Intelligence (DARKINT)
Security researchers and Cybersecurity professionals have an immense interest in discovering threat intelligence on the deep web and darknet. This […]