The US military uses a process called the Joint Targeting Cycle to select and act on targets. In this edition of #TechTalkTuesday, we will talk about how you can improve your threat hunting efforts using a similar process.
Let’s talk hacking labs! This week’s #techtalktuesday explores three different stages and price points of labs for infosec security research. Let us know what is in your lab in the comments below!
Specs for the portable lab server we showed in the tier 2 example:
Intel Hades Canyon NUC (NUC8i7HVK)
Intel(R) Core(TM) i7-8809G CPU @ 3.10GHz
64 GB RAM
3TB solid-state drive
This edition of #TechTalkTuesday shows how to quickly go from a malware sample in a threat intelligence report to the associated MITRE ATT&CK techniques. The MITRE ATT&CK techniques gained through this approach help your threat hunting efforts through the identification of behaviors you can tie to various host and network data sources.
NTDS credential dumping [MITRE ATT&CK T1003.003] provides APT28, Hafnium, and several other attackers access to domain credentials for easy pivoting. This week’s #TechTalkTuesday explores ways to include NTDS detection techniques into your #threathunting efforts.
As defenders, we hold the advantage against attackers when we work together. In today’s special edition of #TechTalkTuesday, we share the process we use to go from threat intel to building a treat hunt. This information will hopefully help you with your own journey.
MITRE’s ATT&CK for Enterprise matrix and ATT&CK for ICS matrix provide two valuable reference models for network security. In this edition of #TechTalkTuesday, we will be joined by Ron Fabela from SynSaber to explore why you should be using both models to secure industrial systems and networks.
Digitally signed executables provide one layer of trust to prevent attacks that leverage unauthorized or unexpected code. This week, TechTalkTuesday will explore attacks against digital signatures and how you can avoid or hunt for attackers leveraging this technique. We will examine attacks that specifically don’t require an attacker to compromise the signing key material and leverage vulnerabilities in Windows’ trust algorithms instead.
What do APT 29, APT 37, and APT 40 have in common? They all have capabilities that use steganography (MITRE ATT&CK technique T1027.003) for command and control. This edition of #TechTalkTuesday will cover what steganography is, why it matters, how it works, and how to defend and hunt for it.
