Year: 2017

Delaware, USA – November 24, 2017 – Shadow IT Framework for ArcSight and Splunk is available in Use Case Cloud. Any company has a lot of systems to meet the needs of information interaction between employees or business tasks, but sometimes employees decide to accelerate the process and make innovations bypassing IT and security by […]

Delaware, USA – November 23, 2017 – Attackers from the infamous Cobalt hacker group have changed their primary targets and techniques to install malicious payload on victims’ systems. The campaign against organizations in the CIS countries began this summer, adversaries used RTF which exploited CVE-2017-0199 to attack small and medium business. Researchers from Trend Micro […]

Delaware, USA – November 22, 2017 – Terdot banking trojan appeared about a year ago; it was created on the basis of Zeus trojan code and targeted Canadian banks. Recently, researchers from Bitdefender found that threat actors behind this trojan had significantly modified it and added several features. A new version of malware monitors almost […]

Delaware, USA – November 20, 2017 – SOC Prime, Inc. announces that Andrii Bezverkhyi, Ruslan Mikhalov and Sergii Tyshchenko are now preparing to meet you at the annual cybersecurity event in Istanbul – SHIELD 2017! Come by our booth G6, talk to experts, try our products and experience their effectiveness for yourself.   SHIELD 2017 […]

In the previous article I have demonstrated how to create a simple dashboard that monitors accessibility of sources in Splunk. Today I want to demonstrate you how to make any table in the dashboard more obvious and convenient. Let’s look at my last article and continue to improve the functionality of the table that I […]

A very common task for all ArcSight content developers is cleaning active lists on a scheduled basis or on-demand automatically. In the previous post I have described how to clear Active Lists on scheduled basis using trends: https://socprime.com/en/blog/active-lists-in-arcsight-automatic-clearing-part-1/ Today I will show you another two ways how this can be achieved. Automatic clearing of Active Lists […]

Delaware, USA – November 15, 2017 – Attackers extremely rarely use CPL files to disguise malware, and usually, such attacks are performed by the notorious cybergangs. Using this file format allows them to bypass Windows AppLocker and causes less suspicion when cybersecurity officers investigate suspicious activity on a compromised system. The Palo Alto Networks unit […]

Delaware, USA – November 14, 2017 – Cybercriminals’ arsenal is expanded with banking Trojan IcedID. It was discovered by researchers from IBM X-Force, and they argue that this is not a modification of any of the existing malware, but an entirely new one. IcedID targeted North American banks, and it is distributed via botnet associated […]

Delaware, USA – November 13, 2017 – SOC Prime team will participate in SHIELD 2017 conference in Istanbul on November, 21: http://shield.innoverabt.com/ This event is conducted by Innovera company, leading IT security and IT continuity consulting shop in the Turkish territory. This year, SHIELD conference will be held for the third time and will gather […]

Delaware, USA – November 10, 2017 – On October, the hacker group which infects corporate servers with LockCrypt Ransomware increased the number of attacks. Researchers from Alien Vault report that for the first time this Ransomware strain was seen in June and linked it with the same group that used Satan Ransomware in previous attacks. Unlike […]