Collaborate Disseminate
I am trying to create an incident response scenario for training purposes.
Do you know any good sources of free training content that I can reuse to create the scenario?
I am thinking of a scenario where I will provide the participants wit… Continue reading Incident Response Training Scenario Ideas [closed]
I have taken a DFIR course, but I have not worked with an SME. Looking at this SuperTimeline output, I saw something like what is pictured. SVCHOST executing from prefetch and the file then being deleted. The other instance is modificatio… Continue reading Log analysis of suspicious activity [closed]
I am conducting a survey for user analysis on incident response playbooks as part of my capstone project. Any Incident responder or SOC analyst is welcome to fill. https://docs.google.com/forms/d/e/1FAIpQLSeJcnAYmgw-ccmV-MjPHVe-77MgQfrOp0z… Continue reading I am conducting a survey for user analysis on incident response playbooks. Any Incident responder or SOC analyst is welcome to fill
I have been wondering if someone is accessing my system and after doing using some basic assessment tools like netstat and event viewer, found some unusual open ports(12345) and special Logon! below is the screenshots I would really apprec… Continue reading Is someone accessing my win10 computer?
How would I screen emails (or files) for differences from the last one (or a template stored for this email) and alert when a difference occurs?
When you run a large number of computers/servers, you will probably have some unified thread d… Continue reading Automatically screen e-mails (from chkrootkit and rkhunter) for differences
I’m investigating an alert where the parent process Excel spawns RunDll32.
Parent Process:
"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\" \"C:\\Users\\john.doe\\Documents\\File.csv\"
Child Process:
… Continue reading Word Or Excel Spawns RunDLL32
I started noticing this behaviour for more than a month. Whenever I connect my laptop to the WiFi router there are lots of RST and DUP ACKs up to the same TCP sequence, as given in the example below, where DUP ACK reached the sequence numb… Continue reading Repeated DUP ACK and RST to same TCP SEQ and ACK
My website built upon Laravel is currently under attack.
Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code executes before the legitimate Laravel code…. Continue reading How to secure Laravel website against the ongoing massive exploitation
My website is built in Laravel 8. After some time multiple fake pages were created by someone. How he got access I don’t know. pages like (example.com/free-dating-site). These are all pages indexed by Google. There are many pages but when … Continue reading My Website Hacked! Needs Possible Reasons and Solutions [duplicate]
I recently looked at a spam mail I received. Generally, I’d say it was a fairly standard phishing attempt, but one thing struck me as odd:
The link that victims are supposed to click looks very weird and (apart from the domain name) consis… Continue reading Why are there so many special characters in this phishing link?