Onkar Patil

In continuation to my yesterday's post and questions I got... Here are some simple practices for your SOC and SIEM Implementation: 1. Prioritisation - Focus on high-impact scenarios first - Align with threat landscape - Consider business context - Address regulatory requirements 2. Tuning - Regular rule optimisation - False positive reduction - Performance impact assessment - Baseline establishment 3. Response Procedures - Clear escalation paths - Documented playbooks - Automated responses where appropriate - Regular testing and updates 4. Monitoring & Maintenance - 24/7 coverage - Regular rule reviews - Updated threat intelligence - Performance optimisation 5. Documentation & Reporting - Detailed alert documentation - Incident tracking - Metrics and KPIs - Trend analysis Key Considerations: 1. Environment-specific customisation 2. Regular updates based on threat intelligence 3. Balance between coverage and manageability 4. Integration with incident response procedures 5. Compliance requirement alignment 6. What and how far would you want to automate 7. How and when to use AI across all the practices 8. Overall Governance, Audit and Control While this provides a foundation for SOC operations, it should be customised based on: - Organisation size and industry - Specific threats and risks - Available resources - Regulatory requirements - Technology stack Share more in comments…

35

🎁Hey Guys As I promised yesterday....The correct answer for the yesterday's Q. No 147 CISSP ToTD is in the COMMENT below. 👇👀👀🎁 Have a look and share your input in comment below.👇👀👀🎁 #cissp #cissptraining #cybersecurity Cybernous Infosec Consulting LLPPratima Sharma

7

1 Comment

Distribution of Malware Under the Guise of MS Office Cracked Versions (XMRig, OrcusRAT, etc.) Through a post titled “Orcus RAT Being Distributed Disguised as a Hangul Word Processor Crack” [1], AhnLab SEcurity intelligence Center (ASEC) previously disclosed an attack case in which a threat actor distributed RAT and CoinMiner to Korean users. Until recently, the attacker created and distributed various malware strains, such as downloaders, CoinMiner, RAT, Proxy, and AntiAV. Numerous systems in South Korea tend to become infected by malware strains that are distributed under the guise of cracked versions of legitimate programs, such as Hangul Word Processor or activation tools for Windows or Microsoft Office. Threat actors have been upgrading their malware by adding another layer to this process, which is registering to the Task Scheduler in the infected system. https://lnkd.in/di_ctMJu

11

Tips for passing Security Blue Team's BTL2 Certification: [Exam Info:] 72 hour practical network intrusion exam covering the following 4 domains: Malware Analysis, Threat Hunting, Advanced SIEM and Vulnerability Management. 2 month+- BTL2 exam result wait period. [Study Preparation:] -Knowledge Baseline: BTL1 Certified (24 hour network intrusion exam covering the following 6 domains: Security Fundamentals, Phishing Analysis, Threat Intelligence, Digital Forensics, SIEM and Incident Response) -Complete all BTL2 course material (content, quizzes & labs)(reach 100% completion) -Normalize thinking in the *CTF* mindset, taking on unknown challenges of varying difficulty using tools you may or may not have ever worked with before. For this i would highly recommend Blue Team Labs Online. -Read and understand The DFIR Report's public intrusion reports. These articles map out the entire kill chain of threat actors and their associated TTPs in great detail. Complete this task in an endless loop and your knowledge and confidence in understanding such serious real world IR cases will grow exponentially. -Embrace cyber vendor's technical write-up articles, peering further then an entertaining surface level cyber post from usual suspects TheHackerNews and BleepingComputer. If you do read articles from these sites, ensure that you follow the hyperlink to pivot to the vendor source article. -BTL2 will introduce you to many new tools which you may not have heard about before, and for that i propose the following workflow: *New tool identification* (UI or CLI tool?) -> Understand tool's usage and function at a: (1. theory)(2. Practical: BTL2 labs)(3. Practical: BTLO labs)(4. Practical: Your VM environment *Open scope UI or CLI switch exploration*) level. Much like a real world network intrusion event timing is of the essence and therefore knowing which tools can work for you, and using said tools in an optimal fashion will be paramount as the clock ticks away. --If the tool is CLI based, come prepared with a list of your CLI switches and their usage descriptions. [The Exam Experience:] *NDA - will focus on surface level points* -This exam is a marathon, not a race. Ensure that you don't change your routine before exam day so that you can almost trick your brain into thinking that this is just another day at work where a notable True Positive incident has dropped which requires you to be all hands on deck for the next few days alone. -"Know Thy Baseline": As you walk into an unknown compromised environment, trying your best to build baselines of the various asset types will help to identify outliers. -Once an observable evolves into an IOC, see how much you could expand upon that IOC to build up the overall threat picture. --Know when to take a break and come out of your self created rabbit holes, to either return at a later stage or leave it be to move on to other observables/IOCs.

152

12 Comments

good to know

2

As you all know, we have already started live classes in Hindi for OSCP, CPTS, and PNPT. Starting today, we'll also begin hacking on HackTheBox machines to enhance our practical skills! 1. Interactive Live Sessions – We’ll dive deep into each certification topic with practical, hands-on demonstrations. 2. HackTheBox Challenges – From today, we’ll tackle HackTheBox machines, providing real-world hacking experience. 3. Step-by-Step Walkthroughs – Every machine will be solved live, ensuring you understand each step of the hacking process. 4. Q&A and Doubts Clearing – After each session, we’ll have dedicated time for questions to make sure no one is left behind. 5. Continuous Skill Improvement – Through these sessions, you'll continuously sharpen your hacking and problem-solving abilities. https://lnkd.in/gS-fZsbe #oscp OffSec #pntp TCM Security # cpts Hack The Box #htb #ctf #pg

32

5 Comments

The latest Cyber Security Framework revision from SEBI is here and it is more stringent than what the stakeholders anticipated through the draft papers. #SEBI #Cybersecurity Page69: The key functions performed by SOC are as follows: 1. Continuous monitoring: To monitor the end-points and network round the clock to immediately notify of abnormal or suspicious behavior. 2. Log management: To collect, maintain, and review logs of all end-points and network activities. Further, SOC aggregates and correlates data from various applications, firewalls, OS and endpoints to establish a baseline for normal behavior. 3. Threat response: To act as a first responder during a cybersecurity incident. Captive SOC is responsible to perform actions like isolating endpoints and limiting the damage with as little disruption of the business as possible. For all forms of managed SOC, the service provider shall alert the RE and guide them in incident management. 4. Alert Management: To monitor alerts issued by diverse tools and closely inspect each one of them in order to discard false positives (if any), and determine the potential impact of threats. 5. Root Cause Investigation: Post the occurrence of incident, SOC is responsible for investigating when, how and why an incident occurred. SOC analyzes all logs to identify the root cause of the incident and prevent its reoccurrence after incorporating learnings from the incident.

13

Comprehensive Network Infrastructure Security & VAPT Checklist for Red Teamers! ✅ As a red teamer, conducting a thorough security audit and penetration test on network infrastructure is critical to uncovering vulnerabilities before attackers do. Network Infrastructure Security Audit & VAPT Checklist is your go-to resource for ensuring no stone is left unturned during your engagements. 🌟 Key Features: - Detailed Security Audit Checklist: Covering everything from laptops and routers to firewalls and servers, ensuring comprehensive security coverage. - Penetration Testing Checklist: Step-by-step guidance on information gathering, configuration management, identity management, and more. - Tools and Techniques: Leverage industry-leading tools and best practices to identify and exploit vulnerabilities in network infrastructure. - Critical Device Security: Ensure devices like UPS systems, fire alarms, and biometric controllers are secured against potential threats. - Best Practices for Secure Configuration: Follow guidelines aligned with top security frameworks like OWASP, NIST, and CREST. Equip your red team with this extensive checklist to enhance the effectiveness of your security assessments and ensure maximum protection for your clients. Download it now and take your network penetration testing to the next level!🚀 Thanks to Daily REDTeam for sharing #RedTeam #NetworkSecurity #VAPT #PenetrationTesting #CyberSecurity #HackingTools #InfoSec #TechSkills #SecurityAudit

46

CyberArk patching and update activities are critical for maintaining the security and stability of Privileged Access Management (PAM) systems. Here’s a brief overview: 1. Planning: Identify the CyberArk components that require updates, such as the Vault, Password Vault Web Access (PVWA), Privileged Session Manager (PSM), or agents. Review release notes to understand changes and potential impacts. 2. Backup: Ensure proper backup of the CyberArk Vault, databases, and configuration files before any patch or update to mitigate risks. 3. Testing: Perform updates in a staging environment to verify compatibility with existing infrastructure and custom configurations. 4. Patching/Updating: Apply the patch or upgrade following CyberArk’s recommended procedures. This usually involves downloading the latest version from CyberArk’s support portal and applying it to the components sequentially. 5. Validation: After the update, verify that all components are functioning properly, check logs for any errors, and test key functionalities like password rotation, session recording, and user access. 6. Rollback Plan: Have a rollback plan ready in case the update introduces any issues, allowing you to revert to the previous stable version. 7. Documentation: Keep records of the updates, including version changes, steps followed, and any issues encountered. Patching and fixing refers to the process of applying software updates to correct security vulnerabilities, bugs, or performance issues. Here’s a quick overview: 1. Patching: This involves updating software, applications, or systems with patches provided by vendors. These patches fix security vulnerabilities, improve functionality, or address bugs. It’s critical to regularly patch systems to prevent exploitation by attackers. 2. Fixing: After applying patches, you might encounter additional issues that need resolution. Fixing involves troubleshooting and resolving problems that arise post-patching, such as compatibility issues or system errors. Steps: • Identify vulnerabilities that need patching. • Test patches in a non-production environment. • Apply patches during scheduled maintenance. • Verify fixes by testing the system post-patch. • Monitor performance and ensure no further issues arise. A robust patching and fixing process is essential to ensure security and system integrity.

36

1 Comment

🟥 Roadmap to OSCP To get more content follow me G M Faruk Ahmed, CISSP, CISA, CDCP #oscp #cybersecurity #roadmap

91

4 Comments

Requirement 8 of PCI DSS is about identifying access. It also is about restricting access to unique IDs. Meaning that everyone who accesses the CDE is fully identifiable for non-repudiation. Setting lockouts for failed logins and automatic logouts after 15 minutes. We also need to be able to identify any source, both logically and physically, for users and apps/systems.

1

YES ! OSCP certification is becoming outdated and doesn't align well with current cyber threats. For a more comprehensive skillset, consider CPTS over OSCP. Many companies still ask for CEH,compTIA+ , but certifications like eJPT and PJPT , PNPT are better choices due to their practical content and hands-on practice.What do companies prefer: theoretical knowledge or practical skills?

7

2 Comments

Day 2: #scoanalyst training Topics: Incident Management, SIEM Tools, Splunk & Microsoft Defender Connect with me Arun Chaudhary #socanalyst #cybersecuritytraining #arunchaudhary #eccouncil #everyone #followers #highlights #arunchaudhary

15

🧑‍💻 Here is 2 chapters of the CEH exam with few details. 🗂️ 2️⃣ Footprinting and Reconnaissance 📇 1️⃣ Footprinting Techniques 1.1Active Footprinting 1.2Passive Footprinting 2️⃣ Information Gathering 2.1 WHOIS Queries 2.2 DNS Queries 2.3 Network Range Identification 3️⃣ 3.Tools for Footprinting 3.1 NSLookup 3.2 WHOIS 3.3 Recon-ng 4️⃣ Social Engineering 4.1 Techniques for Social Engineering 4.2 Social Engineering Tools 4.3 Phishing, Pretexting, and Baiting #3_CEH

23

SOC Alert Sources - Detection Technologies Foundational 1. SIEM 2. Next-gen Firewall IDS/IPS 3. Email Filtering 4. Antivirus / EDR 5. Application control 6. Threat hunting Advanced 1. User and Entity Behaviour Analytics (UEBA) 2. Artificial Intelligence & Machind Learning Analytics #cybersecurity #soc #siem #incidentresponse

27

#Salam Quick Keylogger Malware Analysis within CMD Watcher + Cyber Chef + Notepad ++ .. #malware #sample #quick #brief #analysis

9

2 Comments

Want Cold - Mailing template for #DevRel? Comment 'DevRel' below 👇 #DevRel #Cybersecurity #hiring

8