SoheilSec

ورکشاپ مقدمه‌ای بر ردتیم و شبیه سازی APT38؛ با تدریس استاد هاشمی (⁦ @soheilsec ⁩ ). مقدمه‌ای از پایه ردتیم و پایه‌ای ترین توضیحات و سپس پیاده سازی APT38 برای درک بهتر و بیشتر. و ارائه راهکار‌های دفاعی در تمامی مراحل. https://huntlearn.com/courses/تیم-قرمز?show=webinar در این ورکشاپ، افراد علاقه مند، ردتیمر و SOC میتوانند حضور پیدا کنند. لینک ورود به وبینار به صورت پابلیک قرار داده خواهد شد اما به افرادی که در سایت، توی وبینار ثبت نام کرده باشند به قید قرعه، چندین کتاب به انتخاب خود شخص، آفر شغلی و آموزشی و... داده خواهد شد👌🏻 به صورت کاملا رایگان! پشتیبانی هانت لرن: @huntlearn_support

سلام وقت بخیر، یک وبینار تیم قرمز (پایه + کمی عملی) 25 مرداد ساعت 14-18 در خدمتتون هستم ثبت نام رایگان + جزییات : https://www.huntlearn.com/courses/%D8%AA%DB%8C%D9%85-%D9%82%D8%B1%D9%85%D8%B2?show=webinar سرفصل + توضیحات: https://www.youtube.com/watch?v=R-I9B_hrYLM

Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD): https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/

the Antivirus Event Analysis Cheat Sheet to version 1.13.0 - new shellcode detections added - more extensions: .VBE, .MSC, .XLL, .WLL https://www.nextron-systems.com/2024/07/17/antivirus-event-analysis-cheat-sheet-v1-13-0/

FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/

Process injection alternative https://github.com/CICADA8-Research/IHxExec https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d

The CVE-2024-26229 vulnerability in the Windows CSC Service is being exploited with proof-of-concept (PoC) exploit code available on GitHub. This high-severity vulnerability could allow attackers to gain SYSTEM privileges on a Windows system, posing a significant risk. This type of elevation of privilege flaw can lead to severe security breaches, and there is potential for it to be used by threat actors, although it is not specified if ransomware groups are involved. It is crucial for users to apply the patch released by Microsoft to mitigate the risk of exploitation. https://securityvulnerability.io/vulnerability/CVE-2024-26229

⚠️⚠️The vulnerability, tracked as CVE-2024-6409 (CVSS score: 7.0), is distinct from CVE-2024-6387 (aka RegreSSHion) and relates to a case of code execution in the privsep child process due to a race condition in signal handling. It only impacts versions 8.7p1 and 8.8p1 shipped with Red Hat Enterprise Linux 9. https://thehackernews.com/2024/07/new-openssh-vulnerability-discovered.html?m=1

9.4 GB Twitter Data Leaked – Over 200 Million Records Exposed Online 🤔 https://cyberpress.org/9-4gb-twitter-data-leaked-online/?amp=1

وضعیت ایران 🤔🤷‍♂️

⚠️⚠️ CVE-2024-6387: Critical OpenSSH Unauthenticated RCE Flaw ‘regreSSHion’ Exposes Millions of Linux Systems https://en.fofa.info/result?qbase64=YXBwPSJPcGVuU1NIIg%3D%3D poc:https://github.com/zgzhang/cve-2024-6387-poc

APT 29 🇷🇺 had security breaches the teamviewer company but according to their first report, hackers did not lateral movement to production segment. https://www.teamviewer.com/en/resources/trust-center/statement/ source : https://x.com/cyb3rops/status/1806651893344563543?t=7QwPK6W9gSFznr4bAHATaQ&s=19