Month: May 2016

SOC Prime trains 18 security experts
SOC Prime trains 18 security experts
  • May 30, 2016

Kyiv, Ukraine, May 30, 2016 – SOC Prime conducted an expert master class on HPE ArcSight administration, SIEM best practices and SOC automation via Predictive Maintenance on Friday, 27th of May. Warmly welcomed by HPE Ukraine, 18 security professionals worked intensely with SOC Prime team for the whole day, collaborating on practical aspects of SIEM […]

Read More
Infrastructure infiltration via RTF
Infrastructure infiltration via RTF
  • May 20, 2016

Let’s proceed to studying a stage of attack called “Delivery” from Lockheed Martin Cyber Kill Chain. Much can be said about this stage, but today I’ll just share parsing of one sample which I have recently received for analysis. The sample attracted my attention because of its simplicity on one hand and its sophistication on […]

Read More
Attack on domain controller database (NTDS.DIT)
Attack on domain controller database (NTDS.DIT)
  • May 10, 2016

So, as I have promised, we start the process of analyzing separate Cyber Kill Chain stages of the previously described attack. Today we will review one of the attack vectors on the Company infrastructure, which we can count as two stages: «Actions on Objectives» and «Reconnaissance». Our goals are:

Read More
Search:
Follow us on:
Archive
Tags
APT Ariel Millahuel Aytek Aytemur Blog CERT-UA CERTUA CVE Cyberattack Detection Content Elasticsearch ELKStack Emir Erdogan How to Interview Interview Knowledge Bits Latest Threats Latest threats Lee Archinal Malware MITRE ATT&CK Nattatorn Chuensangarun News OpenSearch Osman Demir Phishing Ransomware Release Notes Rule Digest SIEM SIEM & EDR SIEM & EDR Sigma Sittikorn Sangrattanapitak SOC Prime Platform SOC Prime Platform Splunk TDM Threat Bounty Program Threat Detection Marketplace Threat Hunting Threat Hunting Content Uncoder AI Vulnerability Zero-Day