Guides
The Threat Hunter’s Hypothesis
A case for structured threat hunting and how to make it work in the real world. Contents “Everybody Wanna Threat Hunt…” The Threat Hunter’s Conundrum
A case for structured threat hunting and how to make it work in the real world. Contents “Everybody Wanna Threat Hunt…” The Threat Hunter’s Conundrum
A case for structured threat hunting and how to make it work in the real world. While every large organization wants to threat hunt, many
Registry keys can be a very useful method for hunting and detecting malicious activity, but if they are ingested wholesale they can also be one of the noisiest methods of detection. However, if organizations take the time to understand how registry keys can be used to help detect malicious activity, they can help security teams improve their security posture significantly. Join Cyborg Security’s Lee Archinal in his second instalment of our Threat Hunt Deep Dive series “Get to Know Your Logs!”
One of the universal hurdles that organizations face when it comes to cybersecurity is visibility within their own environment. Pair that with often non-technical restrictions on how and what teams can ingest from endpoints, routers, servers, and any other network devices and it is evident that gaps will exist. This doesn’t just affect the security posture of an organization, but it also hinders cybersecurity analysts as well. If you don’t have the appropriate logs to detect and respond to threats, security analysis is going to suffer.
In this series I share my experience on logs that I have used in my past lives as a SOC analyst and threat hunter. Half the battle is knowing what information the logs contain and why they are relevant to the investigation. The other half is creating a business use-case to get these logs ingested into your tools. While this series will not be the magic bullet and get you the logs you want, it will at least tell you how to use them in hunts and what they are telling you.
In this Threat Hunt Deep Dive, we focus on the Living Off the Land Binary (LOTL) Esentutl.exe. Designed for running tasks and operations related to databases and database files, this executable can abuse the NTFS file attribute Alternate Data Streams (ADS). Using different techniques, threat actors can hide files in these streams to accomplish different goals such as tool infiltration and data exfiltration. Esentutl.exe also has the ability to extract the ntds.dit file from a Shadow Copy, which provides the attacker with information related to the Active Directory environment, to include usernames and password hashes. By combining these techniques together, the adversary can infiltrate the network, take what they want, and get keys to the kingdom using one tool.
Welcome to Threat Hunt Deep Dives, Episode 7! Today we are looking at the Registry Key Modification method, one that abuses registry keys by creating or modifying values that some trusted Windows executables look for during their process execution. Join us as we put this method under the microscope.
Welcome to Threat Hunt Deep Dives, Episode 6! Today we are looking at a Living off the Land (LotL) technique involving Tscon.exe, which is a Windows native binary, and users with inactive sessions. Join us as we put these techniques under the microscope.
Threat Hunting can be challenging for organizations, especially when they don’t know where to start. Cyborg Security’s “Threat Hunting Framework” makes it easy to get
Welcome to Threat Hunt Deep Dives, Episode 5! Today, we are introducing part one of an exciting new series of threat hunting videos dedicated to the practice of Living off the Land (LotL)! Join Austin Jackson as he dives into a few LotL techniques involving downloading remote files on Microsoft Windows.
Welcome to Threat Hunt Deep Dives, Episode 4! Today we are looking at a recent Apache Struts Remote Code Execution (RCE) vulnerability, CVE-2020-17530. Join us as we put this threat under the microscope.
