Security Operations Center Archives

Cybersecurity, Managed SOC Services, Security Operations Center, Threat Hunting

Leveraging DETT&CT Framework

Building detection is a difficult task, particularly with an increasing number of data sources. It might be challenging for detection […]

Cyber Threat Intelligence, Cybersecurity, Security Operations Center

DCSync Attacks Explained

Once an attacker gets access to a Windows endpoint, they can access credentials saved in clear text or as a […]

Cyber Security, Security Operations Center

Monitoring USB Usages in OT Environments

Industrial control systems are vital infrastructures that need strict security protocols, particularly those that operate in operational technology (OT) environments. […]

Cyber Security, Security Operations Center

Silentbob: A New Campaign by Team TNT Attacking Cloud Environments

The infrastructure of many organizations has included cloud computing in recent years due to its multiple advantages in terms of […]

Alert Advisory, Cyber Security, Security Operations Center, Vulnerability Assessment

Alert Advisory: Citrix ADC Gateway RCE – CVE-2023-3519

In this blog post, we will explore the details of Citrix ADC vulnerability, its potential consequences, and the importance of […]

Alert Advisory, Cyber Security, Managed SOC Services, News, Ransomware Protection, Security Operations Center

2022 is Over But What Did We Learn From Our Work

Throughout the year, numerous new incidents and rising threats were unveiled to the horror of many. In 2022, the world […]

Cyber Security, Malware Protection, Managed SOC Services, Security Operations Center

Ursnif/Gozi Malware Evolution and Associated IoC

Gozi is a powerful piece of malware with a wide range of intricate characteristics. It began as a basic banking […]

Cyber Security, Incident Response, Managed SOC Services, Security Operations Center

Detecting Cyber-Attacks on Kubernetes Environment

Kubernetes is a container orchestration system that acts as a management abstraction layer. It is an open-source system that aids […]

Alert Advisory, Incident Response, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, XDR

Alert Advisory: New Microsoft Exchange Zero-Days

Late on September 29, 2022, Microsoft acknowledged both zero-day vulnerabilities and stated that they were aware of “limited, targeted attacks […]

Cyber Security, Cyber Threat Intelligence, Machine Learning, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, Threat Intelligence

Data Exfiltration and Detection through Anomaly Detection

Data exfiltration is the unauthorised transfer of critical and sensitive data and/or information from a targeted network to the cyber […]

Cyber Security, Security Operations Center

Tools Used for Dumping of RDPCreds via comsvcs.dll

Remote Desktop Protocol (RDP) is commonly used by administrators to manage Windows environments remotely. It is also typical for RDP […]

Cyber Security, Managed SOC Services, Security Operations Center

Sniffing Attacks – Packet Capture Techniques Used by Attackers

Sniffing attacks are data thefts caused by capturing network traffic with packet sniffers, which can illegally access and read unencrypted […]

Cyber Security, Managed SOC Services, Security Operations Center

LSASS Dumping Techniques

Local Security Authority Subsystem Service (LSASS) is the process on Microsoft Windows that handles all user authentication, password changes, creation […]

Alert Advisory, Cyber Security, Managed SOC Services, Ransomware Protection, Security Operations Center, XDR

Alert Advisory: Analysis of BlackCat Ransomware

BlackCat, also known as ALPHV-ng, ALPHV, and Noberus, is a Ransomware-as-a-Service (RaaS) threat that targets organizations across multiple sectors worldwide […]

Cyber Security, Incident Response, Security Operations Center

Kerberoasting – Active Directory Attack

Active Directory services are usually used by organizations for easily configuring policies and managing permissions. Due to its widespread usage, […]

Managed SOC Services, Security Operations Center, XDR

XDR Software – The Journey Beyond

We are still in the early days of the XDR (eXtended Detection and Response) era, understanding XDR technology in the […]

Managed SOC Services, Security Operations Center

How Threat Actors Steal Your Data with Reverse Tunnelling

Reverse tunnelling is a technique used to ‘sneak into’ a secured network by hiding applications within traffic which originates from […]

Cyber Security, Managed Security Services, Managed SOC Services, Security Operations Center

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 3

Reading security logs requires a higher level of permission that other logs. Below are the steps to configure the right […]

Cyber Security, Managed Security Services, Managed SOC Services, Security Operations Center

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 2

From a security perspective, generally, it would be better to allow communication from user segments to outside rather than from […]

Cyber Security, Managed SOC Services, Security Operations Center

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 1

Staying on top of cyber threats in your environment could be challenging even with a lot of protective measures in […]

Managed SOC Services, Security Operations Center, Security Orchestration, SOAR

SOAR Features and Use Cases

Organizations are getting bigger and bigger and, because of that a lot of events, activities and data are being generated […]

Cyber Security, Cyber Threat Intelligence, Security Operations Center

Cyber Threat Intelligence and OSINT

We are living in a world where any number of cyber threats can bring an organization to its knees and […]

Cyber Security, Cyber Threat Management, Managed Security Services, Managed SOC Services, Security Operations Center

Cyber Threat Management with MITRE ATT&CK – Part 1

Let’s agree on this first, job of a SOC analyst is TOUGH, as tough as finding a needle in a […]

Managed Security Services, Managed SOC Services, Security Operations Center

What is SOC beyond a Monitoring Center?

Managed SOC / CSOC (aka Cyber Security Operations Center) is often regarded as the workplace where the nerdy information security […]

Leveraging DETT&CT Framework

DCSync Attacks Explained

Monitoring USB Usages in OT Environments

Alert Advisory: Citrix ADC Gateway RCE – CVE-2023-3519

2022 is Over But What Did We Learn From Our Work

Ursnif/Gozi Malware Evolution and Associated IoC

Detecting Cyber-Attacks on Kubernetes Environment

Alert Advisory: New Microsoft Exchange Zero-Days

Tools Used for Dumping of RDPCreds via comsvcs.dll

Sniffing Attacks – Packet Capture Techniques Used by Attackers

LSASS Dumping Techniques

Alert Advisory: Analysis of BlackCat Ransomware

Kerberoasting – Active Directory Attack

XDR Software – The Journey Beyond

How Threat Actors Steal Your Data with Reverse Tunnelling

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 3

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 2

Using Windows Event Forwarding for Centralized Windows Monitoring – Part 1

SOAR Features and Use Cases

Cyber Threat Intelligence and OSINT

Cyber Threat Management with MITRE ATT&CK – Part 1

What is SOC beyond a Monitoring Center?

Ready to get started?

Ready to get started?

HawkEye

Packages

CSOC

Explore