Mohamed Hamdi Ouardi

Vulnerability Details : CVE-2024-38872 Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module. CVSS 8.3

١

Security operations centers (SOCs) are crucial to any organization's cybersecurity. As threats evolve, security teams need the right tools and strategies in place. The 2024 SOC Survey by SANS offers insights from 403 security leaders on current priorities and challenges. Key findings: 🔹 29.8% are implementing AI/ML this year 🔹 46.1% use vendor tools for automated threat-hunting 🔹 29% cite staffing issues as their biggest challenge Download the survey to learn more about the latest SOC trends: https://lnkd.in/eZ73kGqX #CyberSecurity #SANS #SOC #AI #ThreatHunting #SecurityTrends

٢١

🚨 [NEW] SANS 2024 SOC Survey: Tackling Security Operations Challenges 🚨 Download this annual survey from the SANS Institute to discover the latest insights and best practices from active SOC managers and analysts. Here are some key takeaways: 🔍 Budget Misalignment: The top response to budget questions was “Unknown,” showing a big disconnect between SOC teams and the budget process. 👥 Staffing Issues: The biggest hurdle in SOC operations is staffing—high demands and a lack of skilled staff, plus limited enterprise-wide visibility. 📈 More Automation in Threat Hunting: Threat hunting automation with vendor tools jumped from 38% to 46% over the last year. https://hubs.li/Q02JfWJL0 #CyberSecurity #SOC #SANSInstitute #SecurityOperations #ThreatHunting #CyberSurvey #Infosec

٨

OWASP Vulnerability Management Guide [𝐅𝐑𝐄𝐄 𝐆𝐔𝐈𝐃𝐄] 7 𝐒𝐭𝐞𝐩𝐬 𝐭𝐨 𝐠𝐞𝐭 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐉𝐨𝐛 𝐢𝐧 90 𝐝𝐚𝐲𝐬 https://buff.ly/3X7koCZ 📱Telegram Channel https://buff.ly/4b4NHee

١٦

here we go with some basic info

٤

Dive deep into cloud security and pentesting with this awesome collection of resources! Whether you're preparing for the Google Professional Cloud Security Engineer certification or simply keen on enhancing your cloud security skills, these materials have got you covered. A big shoutout to Gabrielle B. for putting together such a comprehensive list! Let's strengthen our cybersecurity arsenal together! 💻🛡️ #CloudSecurity #Pentesting #EthicalHacking

٣

Did you know that you can get a FREE network security exam ? The SecOps Group is currently offering a take for Certified Network Security Practitioner. CNSP is intended to be taken by security engineers, network architects, penetration testers, red and blue team members and any security enthusiast, who wants to evaluate and advance their knowledge. Here's the steps: ✅1. Like and share the post from The SecOps Group 👉🏼https://lnkd.in/dxpuquTT (not mine but you can give a like too👍🏼) ✅2. Fill out this Google form: 📝https://lnkd.in/ddCNdK5j ✅3. After submitting the form, they will email you with the exam details. I've registered this morning but received nothing so far. Let's wait😉 Good luck! More info at https://lnkd.in/dq5kWhub #security #network #cyber #cybersecurity

٢٥

٤ تعليق

"Cryptography and Network Security" Information and Network Security Concepts: Cryptography : The art and science of making ciphers, it is the first subfield of cryptology where it is concerned to keep data secure. Cryptanalysis :The art and science of breaking systems or retrieving cipher messages, it is the second subfield of cryptology. Cryptology :   A combination of two subfields cryptography, and cryptanalysis, it is the art or science to study cryptography and cryptanalysis. Encryption: It is a process of transforming a message that required to be confidential into a unreadable or scrambled form by using a key. Decryption: It is a process of transforming a ciphertext “ encrypted message “ back into its original readable form using the same key that the message encrypted with.

٣

📣 📣📣 Six essential ingredients of a modern Security Operations Center (SOC)📣📣📣 ✅ Six Essential Ingredients : 1️⃣ People (SOC STAFF) 2️⃣ SOC Processes 3️⃣ Technology Stack 4️⃣ SOC Governance 5️⃣ Data Sources 6️⃣ Threat Intelligence ✔ People (SOC STAFF) : Hiring and retention - the highest issue. ✔ Processes : Maturity of processes is a key factor for SOC success. ✔ Technology Stack : ENABLING TECHNOLOGIES. Servers, OS, Storage, Backup, Encryption, Routers, Switches, knowledge management. ✔ SOC Governance : Governance board, SOC organizational chart, Business case, finance, budget, Marketing & Collaboration. ✔ Data Sources : Log Collection, Log Data Storage, Log view and retrieval. ✔ Threat Intelligence : Open and commercial threat intelligence, TI automation with TIP, Exploited Vulnerabilities databases and integration into incident prioritization 👉 Continuous Improvement : Developing and fine tuning use cases. Credit : Faycal Belbachir Source : Cybersecurity Learning Saturday

٥٢

CVE 2024-3094 Credit @fr0gger_ #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

١٧

26 Jul 2024 : Most Active Threat Indicators #Cybersecurity #Cyberattack #RCE #Botnet #IOC Top 3 Attacks: - Mozi Botnet: Predominantly from IN and CN, this botnet is responsible for multiple attacks. - GPON Router Remote Command Injection: Commonly exploited by attackers from CN and IN. - LB-LINK Command Injection: Notable activity from multiple countries including IN and JP. Source IP 31[.]211[.]147[.]248 170[.]84[.]224[.]130 42[.]235[.]152[.]252 120[.]85[.]113[.]193 123[.]5[.]164[.]24 175[.]173[.]59[.]204 116[.]249[.]244[.]108 117[.]86[.]150[.]26 182[.]122[.]221[.]223 27[.]47[.]1[.]196 202[.]107[.]28[.]176 120[.]85[.]112[.]3 115[.]60[.]225[.]6 119[.]179[.]251[.]0 42[.]55[.]97[.]192 116[.]138[.]160[.]187 182[.]120[.]53[.]213 120[.]85[.]118[.]165 120[.]211[.]69[.]13 42[.]224[.]21[.]94 120[.]85[.]113[.]25 125[.]116[.]43[.]208 190[.]120[.]231[.]58 209[.]38[.]254[.]127 8[.]211[.]39[.]61 167[.]99[.]135[.]182 196[.]191[.]66[.]189 54[.]36[.]144[.]237 5[.]254[.]106[.]13 172[.]212[.]60[.]36 180[.]242[.]194[.]189 112[.]215[.]241[.]177 117[.]204[.]191[.]239 59[.]91[.]95[.]158 59[.]99[.]186[.]123 117[.]254[.]143[.]94 117[.]239[.]135[.]122 59[.]91[.]80[.]226 117[.]211[.]213[.]41 117[.]248[.]170[.]160 103[.]181[.]158[.]209 117[.]248[.]171[.]42 103[.]197[.]113[.]255 117[.]243[.]240[.]5 220[.]158[.]158[.]160 103[.]197[.]113[.]125 117[.]248[.]173[.]237 202[.]168[.]86[.]90 120[.]138[.]12[.]15 103[.]109[.]73[.]34 117[.]204[.]232[.]16 117[.]248[.]172[.]179 59[.]184[.]244[.]88 117[.]211[.]46[.]167 120[.]138[.]12[.]207 117[.]235[.]62[.]252 117[.]248[.]223[.]248 117[.]208[.]143[.]134 103[.]197[.]115[.]31 59[.]89[.]225[.]104 61[.]192[.]88[.]115 121[.]116[.]7[.]88 110[.]66[.]9[.]78 112[.]139[.]255[.]92 58[.]97[.]192[.]249 222[.]110[.]199[.]172 202[.]165[.]14[.]21 103[.]130[.]13[.]210 37[.]46[.]122[.]83 37[.]40[.]44[.]45 175[.]107[.]1[.]202 175[.]107[.]2[.]43 175[.]107[.]3[.]5 51[.]77[.]53[.]200 5[.]41[.]231[.]44 68[.]183[.]188[.]120 152[.]42[.]229[.]242 188[.]132[.]202[.]50 110[.]24[.]36[.]5 122[.]116[.]25[.]118 111[.]70[.]12[.]117 70[.]61[.]109[.]130 38[.]159[.]232[.]156 206[.]168[.]34[.]126 185[.]220[.]69[.]114 97[.]64[.]20[.]231 48[.]217[.]211[.]118 146[.]70[.]212[.]70 4[.]151[.]38[.]26 167[.]94[.]145[.]110 209[.]141[.]51[.]21 167[.]94[.]138[.]114 192[.]34[.]128[.]73 104[.]152[.]52[.]80 38[.]75[.]136[.]21 208[.]113[.]133[.]62 161[.]35[.]26[.]24 34[.]207[.]243[.]219 45[.]164[.]23[.]123 164[.]90[.]226[.]202

١

Antivirus vs EDR vs XDR #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #linux #cybersecurityawareness #bugbounty #bugbountytips

٧

ISO 27001:2022 - Information Security Management Systems I suggest this material from Cybrary, a very good course provided by Cybrary ! The topic is a very important cybersecurity framework that is widely adopted. #Cybrary #ISO27001

١٣

Analyzing Cyber Threats: Protocols for L1 SOC Analysts 🔍 Phishing Emails Alert: 1- Heck Email Headers (SPF, DKIM, Message-ID, Sender && Return-path) 2- Inspect Email content 3- Verify SMTP IP in Virustotal, AbuseIPDB, X-Force, Talos intelligence 4- Investigate Attachments at Virustotal, urlscan, Any.run, joesandbox, Hybrid-Analysis ↪️ Note: If Attachment is a domain, check registration time 5- Confirm if the user opened the Attachment ✍️ https://lnkd.in/dfscKs4n ✍️ https://lnkd.in/dSMs5Tqx ✍️ https://lnkd.in/d5sXYis3 ✍️ https://lnkd.in/d3VS3trE. 🦠 Malware Investigation: 1- Check File hash in threat intelligence 2- AV Action, ensure not deleted/cleaned/quarantined; create L2 ticket if needed 3- Examine File path to determine device infection source 4- Check Malware category - Contact user for known results like Ransomware ✍️ https://lnkd.in/dpZdSziE ✍️ https://lnkd.in/dBevZUmj 🤖 Brute Force Analysis: 1- Determine login operation origin (local or remote) by checking Source IP 2- Inspect destination IP/Service to identify targeted service 3- Review Logon Type to understand login method 4- Analyze Login Failure Reason to verify user legitimacy 5- Check IDS/IPS & WAF Logs for automation tool usage 6- Confirm successful or unsuccessful login ⚔️ DoS/DDoS Attack Alert: 1- Check source IP(s) to determine local or remote origin ↪️Note: If remote, check threat intelligence; if local, create L2 ticket to check the host 2- Verify if Destination IP still operational manually 3- Run "netstat -an" command for strange connections 4- Run ping command to detect dropped packets ✍️ DDOS: https://lnkd.in/eQ7zZzVt ✍️ MaliciousNetworkBehaviour: https://lnkd.in/ewVZy2cs 🚫 Proxy Logs Investigation (Communication to bad IP/domain): 1- Check Proxy Category to determine domain type 2- Review device action 3- Examine Destination IP/domain at AbuseIPDB, Virustotal, urlscan ↪️Note: For a domain, check registration time 4- Confirm Destination Port 5- Check User-agent 6- Verify Bytes Sent && Bytes Received 7- Inspect request method 8- Scrutinize Referer Header 9- Validate Content-Type Header ↪️Note: Detection also possible through SIEM Graph 📊 Windows Event Log Analysis (Login & Logout): 1- Check event id/name 2- Verify login type to understand login method 3- Confirm workstation for DNS Name 4- Review status and sub-status for failure ✍️ https://lnkd.in/dpVJRJmY ✍️ https://lnkd.in/d7ABVqjw ✍️ https://lnkd.in/dgJfKpz2 🛑 Unknown Process Installation Investigation: 1- Check process name for anomalies 2- Examine process id to identify parent or child process Telegram: https://t.me/HackerOne71 #hackerone71 #socanalyst #ethicalhackng #cybersecurity

١

Comprehensive Guide on OS Command Injection https://lnkd.in/e_EPThCr #infosec #cybersecurity #pentesting #redteam #informationsecurity #CyberSec #networking #networksecurity #infosecurity #cyberattacks #security #oscp #cybersecurityawareness #bugbounty #bugbountytips

٤