Collaborate Disseminate
TheHive is an awesome tool to perform incident management. One of the software components that is linked to TheHive is Cortex defined as a “Powerful observable analysis engine“. Let’s me explain why Cortex can save you a lot of time. When you are working on an incident in TheHive, observables are
[The post DShield Analyzer for Cortex has been first published on /dev/random]
The day three started quietly (let’s call this fact the post-social event effect) with a set of presentations around Blue Team activities. Alexandre Dulaunoy from CIRCL presented “Fail frequently to avoid disaster” or how to organically build an open threat intelligence sharing standard to keep the intelligence community free and sane!
[The post Pass-The-Salt 2018 Wrap-Up Day #3 has been first published on /dev/random]
When you have a look at the schedule of infosec conferences, the number of events is already very high. There is one at least every week around the world. So, when a new one is born and is nice, it must be mentioned. “Pass-The-Salt” (SALT means “Security And Libre Talks“)
[The post Pass-The-Salt 2018 Wrap-Up Day #2 has been first published on /dev/random]
I published the following diary on isc.sans.org: “Are Your Hunting Rules Still Working?“: You are working in an organization which implemented good security practices: log events are collected then indexed by a nice powerful tool. The next step is usually to enrich this (huge) amount of data with external sources. You
[The post [SANS ISC] Are Your Hunting Rules Still Working? has been first published on /dev/random]
Continue reading [SANS ISC] Are Your Hunting Rules Still Working?
I published the following diary on isc.sans.org: “PowerShell: ScriptBlock Logging… Or Not?“:
Here is an interesting piece of PowerShell code which is executed from a Word document (SHA256: eecce8933177c96bd6bf88f7b03ef0cc7012c36801fd3… Continue reading [SANS ISC] PowerShell: ScriptBlock Logging… Or Not?
I published the following diary on isc.sans.org: “Malicious JavaScript Targeting Mobile Browsers“: A reader reported a suspicious piece of a Javascript code that was found on a website. In the meantime, the compromized website has been cleaned but it was running WordPress (again, I would say![1]). The code was obfuscated,
[The post [SANS ISC] Malicious JavaScript Targeting Mobile Browsers has been first published on /dev/random]
Continue reading [SANS ISC] Malicious JavaScript Targeting Mobile Browsers
And here we go with the wrap-up of the 3rd day of the SSTIC 2018 “Immodium” edition. Indeed, yesterday, a lot of people suffered from digestive problems (~40% of the 800 attendees were affected!). This will for sure remains a key story for this edition. Anyway, it was a good
[The post SSTIC 2018 Wrap-Up Day #3 has been first published on /dev/random]
The second day started with a topic this had a lot of interest for me: Docker containers or “Audit de sécurité d’un environnement Docker” by Julien Raeis and Matthieu Buffet. Docker is everywhere today and, like new technologies, is not always mature when deployed, sometimes in a corner by developers.
[The post SSTIC 2018 Wrap-Up Day #2 has been first published on /dev/random]
I published the following diary on isc.sans.org: “A Bunch of Compromized WordPress Sites“: A few days ago, one of our readers contacted reported an incident affecting his website based on WordPress. He performed quick checks by himself and found some pieces of evidence: The main index.php file was modified and some
[The post [SANS ISC] A Bunch of Compromized WordPress Sites has been first published on /dev/random]
Continue reading [SANS ISC] A Bunch of Compromized WordPress Sites
Hello Readers, I’m back in the beautiful city of Rennes, France to attend my second edition of the SSTIC. My first one was a very good experience (you can find my previous wrap-up’s on this blog – day 1, day 2, day 3) and this one was even more interesting
[The post SSTIC 2018 Wrap-Up Day #1 has been first published on /dev/random]