blog

Hunting The Empire

Empire tool is one of the post-exploitation frameworks with an HTTP module; attackers can use it for various malicious purposes, for example, C&C. Empire HTTP traffic analysis Using the Empire and its HTTP module: After the attacker infiltrates the victim...

January 1, 2023

UseCase

Event Categories and Recommended UseCase (Part two)

This post is part two of Event Categories and Recommended UseCase, you can see part one : The guidelines provided in this article help SOC professionals in understanding and respond to security monitoring requirements in a more professional manner. Additionally,...

October 2, 2022

Splunk Enterprise

Splunk Configuration file precedence

How does Splunk prioritize and merge the configuration files? When editing configuration files, it is important to understand how Splunk software evaluates these files and which ones take precedence. When incorporating changes, Splunk software does the following to your configuration...

July 11, 2022

Playbook

Malware Playbook

July 8, 2022

Splunk Queries for Detecting Anomalous URIs in Web Traffic

UseCase

Splunk Queries for Detecting Anomalous URIs in Web Traffic

Prior to having a presence on the network, attackers are unlikely to be able to disguise web shell traffic as typical traffic for a targeted web server. In these cases, requests to the web shell are likely to have an...

June 17, 2022

UseCase

Event Categories and Recommended UseCase(Part1)

The guidelines provided in this article help SOC professionals in understanding and respond to security monitoring requirements in a more professional manner. Additionally, the use cases and correlation rules proposed in this article aid in making the security monitoring service...

June 10, 2022

Threat Intelligence

Understanding Cyber Threat Intelligence

Understanding Intelligence Intelligence is the processed and classified information that is elucidated by expert analysts. It is extracted from all sorts of reliable resources and is evaluated for pertinence. It is essential to understand that data or information alone cannot...

June 1, 2022

Tools

Sentinel-Attack

Tools To Rapidly Deploy A Threat Hunting Capability On Azure Sentinel That Leverages Sysmon And MITRE ATT&CK Sentinel ATT&CK aims to simplify the rapid deployment of a threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel. DISCLAIMER:...

May 29, 2022

Hunting The Empire

Event Categories and Recommended UseCase (Part two)

Splunk Configuration file precedence

Malware Playbook

Splunk Queries for Detecting Anomalous URIs in Web Traffic

Event Categories and Recommended UseCase(Part1)

Understanding Cyber Threat Intelligence

Sentinel-Attack

Rule

Playbook

VIP Content