pH retweeted
🚨🔥 LOLRMM IS LIVE! 🔥🚨
The wait is over, folks! 🥳🎉
We’re thrilled to announce the official release of LOLRMM — your new go-to tool to detect and counter RMM abuse! 🕵️♂️💻
👉 Check it out NOW at LOLRMM.io 👈
This couldn’t have been possible without our amazing contributors:
@nas_bench , @Kostastsale , @cyb3rbuff , @_josehelps , and @M_haggis ! 🙌
And a HUGE thanks to the projects that paved the way:
- Steven Dick — Splunk Lookup
- @WikiJM — Ruler Project
- @mthcht — RMM
- @Cyberspooon — RMM-Catalogue
- @br0k3ns0und — Gist
- @redcanary — Surveyor
Release vid: youtube.com/watch?v=rbh7uFUI…
🔥 Dive into the full story here: medium.com/magicswordio/anno… 🔥
#CyberSec #ThreatIntel #LOLRMM
pH retweeted
Allen Medien zur Folge betraf der Hinweis Inhalte aus öffentlich einsehbaren Kanälen. Dazu bedarf es keiner rechtlichen Anpassung.
Was es braucht ist technisches Verständnis. Da haben wir definitiv Defizite auf allen Ebenen, sowohl medial als auch politisch...
"Auf Grund fehlender rechtlicher Rahmenbedingungen sind die österreichischen Nachrichtendienste auf Hinweise aus dem Ausland angewiesen. Eine Anpassung der rechtlichen Befugnisse unter strenger rechtlicher Kontrolle ist unvermeidbar." #Bundesheer
pH retweeted
The 2 latest releases from @sigma_hq have been downloaded a total of 1.4M times 🔥
Love to see people enjoying and automating the download of releases 😁 (more to come)
pH retweeted
New article just published on @sigma_hq by @sifex - Introducing Sigma Filters 🔥
This new feature was added to pySigma v0.11.7 allows users to express filters and exclusions independently of the Sigma rule itself. Allowing for their re-use across many rules and ease their management.
Chekc out the blog for more details and examples blog.sigmahq.io/introducing-…
pH retweeted
People and vendors dunking on CS have a lack of understanding of how Software works and specifically kernel drivers. Building one is hard af let's make that clear., and CI/CD & QA can be even harder.
And for those pointing that their software is better here are some screenshots to ponder on :)
pH retweeted
Let’s be clear. 'Upload Moderation' is a mass surveillance program.
We urge EU governments to reject mass scanning of their citizens' communications by voting against this proposal tomorrow.
📣Official statement: the new EU chat controls proposal for mass scanning is the same old surveillance with new branding.
Whether you call it a backdoor, a front door, or “upload moderation” it undermines encryption & creates significant vulnerabilities
signal.org/blog/pdfs/upload-…
pH retweeted
New blog post by @sigma_hq core team member @blubbfiction
Introducing the long awaited feature Sigma correlations.
blog.sigmahq.io/introducing-…
pH retweeted
Funny, we had the old style AI, optimizing logistics, winning Chess & Go & ad placement against humans. Then there is the new windbag AI, suggesting gluing cheese to your pizza, recommend eating healthy rocks daily, and so on. That's the AI, everyone wants for their business sys.
pH retweeted
I feel like generative AI shouldn't be used yet. Its a "beta" topic but many companies are acting like they its "mature" (its not)
What's worrying is that, current tooling doesn't really know how to differentiate between human and machine generated data (with some exceptions)
This means the next set of training data is already being generated by AI (via co-pilot generated code, articles, pictures, etc.).
Combine that with the audacity of AI (never admitting it's wrong). Its gonna be very interesting (if not ducked) to see.
pH retweeted
Today we're releasing our first entry in a new monthly blog series we're calling - Tales Of Valhalla
nextron-systems.com/2024/03/…
Our aim is to highlight some of the more evasive threats we're following and seeing uploaded to VT with very low detection rate.
In this first entry we put the spotlight on MrAgent, GuLoader, IronWind and HemiGate.
You might leverage the rules referenced from Valhalla in the blog to get ahold of samples and monitor for new variants.
Huge thanks to my colleague @X__Junior and his help in writing this. And many thanks to @cyb3rops and @pH_T__ for their review.
pH retweeted
Yara practices I highly recommend after having written ~1500 rules🧵#100DaysOfYara
1. For code patterns: add the disassembled code as comment
Otherwise you force readers to reverse engineer the code pattern, making it hard to maintain, judge its usefulness and matches.
pH retweeted
I've put together a blog post outlining the basic cyber security trends that I believe will not only persist but also intensify throughout 2024
pH retweeted
I have finally found the time to update my "Log Sources" slide with input from @blubbfiction @phantinuss @shellcromancer @DefensiveDepth & others
Changes
- added EDR, cloud & IdP logs
- rewrote the texts in the legend
- updated values
#SIEM
github.com/Neo23x0/Talks/blo…
pH retweeted
You're not gonna wanna miss today's Atomic on a Friday @AtomicsonaFri :) Today is going to be all about Sigma w/ @M_haggis and @burning_pm
We're gonna talk about all the new hotness that's been going on in the Sigma world form sigconverter.io to VsCode extension and all in between :)
And the first look at Sigma correlations implemented in Aurora
youtube.com/watch?v=-MOLIUPr…
pH retweeted
Supercharging Postfix With THOR Thunderstorm
nextron-systems.com/2023/11/…
pH retweeted
🚀ASRGEN is live! 🎉
asrgen.streamlit.app
🤿 Diving deep into ASR, and this was my "sharpening the axe" 🪓 moment. I'll be updating the Atomic Tests 🔬 as I go, but if you want to contribute, PRs/Issues are open. 🙌 !
📣 Any feedback? Definitely shoot it over! There's a lot to explore here! 💡
github.com/MHaggis/ASRGEN
📚 Highlights:
- It stacks the ASR GUIDs based on the mode. 🛠️
- "Enable all" - remember, this is for testing, not prod... Unless your prod is testing? 🤔🧪
- Oh - you can add exclusions too! 🔥
- ASR Essentials is like a firehose course 🚒 on ASR. Get ready to get soaked with knowledge! 🧠
- ASR ⚛️Atomic Testing 🧬 - scripts and different knick-knacks to help you generate block/warn/audit events. 🎯
Stay tuned for more updates ⭐️
pH retweeted
Our Encrypted DNS servers have now been converted to run from RAM!
This is completely cost-free, and available to anyone that wishes to have a trustworthy, audited Encrypted DNS service with optional content blocking!
Read more here: mullvad.net/blog/moving-our-…
pH retweeted
🧙♂️#SigmaHQ r2023-11-06 Release is here.
🌟27 New Rules
🛡️40 Rule updates
🔬9 Rule Fixes
This release includes new rules related to the recently reported Diamond Sleet APT by Microsoft, couple OKTA related rules based on BeyondTrust reporting as well as rules covering the potential abuse of the VsCode tunnel functionality and much more 🔥
You can read more by checking the release highlight blog -> blog.sigmahq.io/sigmahq-rule…
Or check the full change log and start exploring this, by downloading the latest release -> github.com/SigmaHQ/sigma/rel…
Thanks to the many contributors that helped shape this release, specifically
citronninja, @_ezlucky_, @faisalusuf, @frack113, fukusuket, @iSecRoOt1, Andreas Braathen, @phantinuss, @sifex, Sean Johnstone, Tessa Georgen, ts-lbf, Tuutaans, @waggabat and @X__Junior
