Collaborate Disseminate
The ransomware threat is declining as actors pivot to infostealing, according to IBM, which says that attacks on cloud services and critical infrastructures are growing.
The post Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-For… Continue reading Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-Force
While the evolution of LLMs mark a new era of AI, we must be mindful that new technologies come with new risks. Explore one such risk called “audio-jacking.”
The post Audio-jacking: Using generative AI to distort live audio transactions appeared first on Security Intelligence.
Continue reading Audio-jacking: Using generative AI to distort live audio transactions
Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan.
The post The Ransomware Threat in 2024 is Growing: Report appeared first on SecurityWeek.
Continue reading The Ransomware Threat in 2024 is Growing: Report
In this Help Net Security interview, Alon Gal, CTO at Hudson Rock, discusses integrating cybercrime intelligence into existing security infrastructures. Our discussion will cover a range of essential aspects, from the importance of continuous adaptatio… Continue reading Prioritizing cybercrime intelligence for effective decision-making in cybersecurity
San Francisco startup banks $14 million in Series A funding led by prominent venture capital outfit Andreesen Horowitz (a16z).
The post Doppel Secures $14M for AI-Powered Brand Protection Technology appeared first on SecurityWeek.
Continue reading Doppel Secures $14M for AI-Powered Brand Protection Technology
In this Help Net Security, Alexander Hagenah, Head of Cyber Controls at SIX, discusses the critical steps in creating effective offensive security operations and their impact on organizational security strategies. What are the critical steps in creatin… Continue reading Embracing offensive cybersecurity tactics for defense against dynamic threats
By Waqas
In the world of emerging cybersecurity threats, understanding the significance of threat intelligence is crucial and can not…
This is a post from HackRead.com Read the original post: Python in Threat Intelligence: Analyzing and Mitigatin… Continue reading Python in Threat Intelligence: Analyzing and Mitigating Cyber Threats
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: ‘/crontab’
CommandLine|contains: ‘ -l’
condition: selection
import
“vt”
rule
sigma_example_registry_keys {
meta:
target_entity
= “file”
condition:
for
any
vt_behaviour_sigma_analysis_results in
vt.behaviour.sigma_analysis_results: (
for
any
vt_behaviour_sigma_analysis_results_match_context in
vt_behaviour_sigma_analysis_results.match_context: (
vt_behaviour_sigma_analysis_results_match_context.values[“TargetObject”]
icontains
“\\CurrentVersion\\RunOnce\\”
and
(vt_behaviour_sigma_analysis_results_match_context.values[“Details”]
endswith
“.vbs”
or
vt_behaviour_sigma_analysis_results_match_context.values[“Details”]
endswith
“.bat”)
)
)
}
import
“vt”
rule
sigma_rule_evtx_cve {
meta:
target_entity
= “file”
condition:
for
any
vt_behaviour_sigma_analysis_results in
vt.behaviour.sigma_analysis_results: (
for
any
vt_behaviour_sigma_analysis_results_match_context in
vt_behaviour_sigma_analysis_results.match_context: (
vt_behaviour_sigma_analysis_results_match_context.values[“TargetFilename”]
startswith
“C:\\Windows\\System32\\”
and
vt_behaviour_sigma_analysis_results_match_context.values[“TargetFilename”]
endswith
“.dll”
and
for
any
vt_metadata_tags in
vt.metadata.tags: (
vt_metadata_tags
icontains
“cve-“
)
)
)
}
|
VT |
YARA |
Sigma |
Sigma |
|
behavior_created_processes |
vt.behaviour.processes_created |
process_creation |
Image CommandLine ParentCommandLine ParentImage OriginalFileName |
|
behavior_files |
vt.behaviour.files_attribute_changed vt.behaviour.files_deleted vt.behaviour.files_opened vt.behaviour.files_copied vt.behaviour.files_copied[x].destination vt.behaviour.files_copied[x].source vt.behaviour.files_written vt.behaviour.files_dropped vt.behaviour.files_dropped[x].path vt.behaviour.files_dropped[x].sha256 vt.behaviour.files_dropped[x].type |
file_access file_change file_delete file_rename file_event |
TargetFilename |
|
behavior_injected_processes |
vt.behaviour.processes_injected |
process_access create_remote_thread process_creation |
CallTrace GrantedAccess SourceImage TargetImage StartModule StartFunction TargetImage SourceImage |
|
behavior_processes |
vt.behaviour.processes_terminated vt.behaviour.processes_killed vt.behaviour.processes_created vt.behaviour.command_executions vt.behaviour.processes_injected |
process_access create_remote_thread process_creation |
CallTrace GrantedAccess SourceImage TargetImage StartModule StartFunction TargetImage SourceImage Image CommandLine ParentCommandLine ParentImage OriginalFileName |
|
behavior_registry |
vt.behaviour.registry_keys_deleted vt.behaviour.registry_keys_opened vt.behaviour.registry_keys_set vt.behaviour.registry_keys_set[x].key vt.behaviour.registry_keys_set[x].value |
registry_add registry_delete registry_event registry_rename registry_set |
EventType TargetObject Details |
|
behavior_services |
vt.behaviour.services_bound vt.behaviour.services_created vt.behaviour.services_opened vt.behaviour.services_started vt.behaviour.services_stopped vt.behaviour.services_deleted |
registry_set process_creation |
Image CommandLine ParentCommandLine ParentImage EventType TargetObject Details |
|
behavior_network |
vt.behaviour.dns_lookups vt.behaviour.dns_lookups[x].hostname vt.behaviour.dns_lookups[x].resolved_ips vt.behaviour.hosts_file vt.behaviour.ip_traffic vt.behaviour.ip_traffic[x].destination_ip vt.behaviour.ip_traffic[x].destination_port vt.behaviour.ip_traffic[x].transport_layer_protocol vt.behaviour.http_conversations vt.behaviour.http_conversations[x].url vt.behaviour.http_conversations[x].request_method vt.behaviour.http_conversations[x].request_headers vt.behaviour.http_conversations[x].response_headers vt.behaviour.http_conversations[x].response_status_code vt.behaviour.http_conversations[x].response_body_filetype vt.behaviour.smtp_conversations[x].hostname vt.behaviour.smtp_conversations[x].destination_ip vt.behaviour.smtp_conversations[x].destination_port vt.behaviour.smtp_conversations[x].smtp_from vt.behaviour.smtp_conversations[x].smtp_to vt.behaviour.smtp_conversations[x].message_from vt.behaviour.smtp_conversations[x].message_to vt.behaviour.smtp_conversations[x].message_cc vt.behaviour.smtp_conversations[x].message_bcc vt.behaviour.smtp_conversations[x].timestamp vt.behaviour.smtp_conversations[x].subject vt.behaviour.smtp_conversations[x].html_body vt.behaviour.smtp_conversations[x].txt_body vt.behaviour.smtp_conversations[x].x_mailer vt.behaviour.tls |
network_connection |
DestinationHostname DestinationIp DestinationIsIpv6 DestinationPort DestinationPortName SourceIp SourceIsIpv6 SourcePort SourcePortName |
|
behavior (too generic) |
vt.behaviour.modules_loaded |
image_load |
ImageLoaded Image OriginalFileName |
Recruiters and anyone else involved in hiring processes should be knowledgeable about this social engineering attack threat. Continue reading Proofpoint Exposes Sophisticated Social Engineering Attack on Recruiters That Infects Their Computers With Malware
The US cybersecurity agency calls attention to a Russian APT targeting academia, defense, governmental organizations, NGOs and think-tanks.
The post CISA Issues Warning for Russian ‘Star Blizzard’ APT Spear-Phishing Operation appeared first on Security… Continue reading CISA Issues Warning for Russian ‘Star Blizzard’ APT Spear-Phishing Operation