SOC Prime 위협 현상금 다이제스트 — 2024년 11월 결과

작성자

Alla Yurchenko

위협 현상금 프로그램 리드

[post-views]

12월 12, 2024 · 3 분 읽기

새로운 위협 현상금 월간 다이제스트 에디션에 오신 것을 환영합니다. 11월 결과 및 업데이트에 대해 알아보십시오.

무엇보다도, 모든 헌신적인 위협 현상금 프로그램의 회원들에게 큰 감사를 드립니다. 총 80개의 탐지 규칙이 위협 탐지 마켓플레이스에 출시되어, 새로운 사이버 위협을 탐지할 수 있는 귀중한 기회를 제공하고 프로그램 회원들에게 그들의 전문성을 향상시키고 수익화할 기회를 제공합니다.

그러나 이번 달에는 제출된 콘텐츠의 수용률이 예상보다 낮아, 우리의 가이드라인 및 권장 사항을 준수하는 데 있어서 여전히 어려움을 겪고 있음을 강조합니다. 이는 전반적으로 위협 현상금 규칙에 대한 관심 저하와 기여자들의 보상 감소로 이어졌음을 이해하는 것이 중요합니다. 이러한 콘텐츠 제출 접근 방식은 콘텐츠 검증 및 출시 시간뿐만 아니라 콘텐츠 및 연구 품질을 양보다 우선시하는 프로그램 회원들의 동기에도 영향을 미칩니다.

현재의 거절률과 프로그램 기준에 부합하지 않아 게시할 수 없는 제출물을 해결하기 위해, 위협 현상금 프로그램에 몇 가지 개선 사항을 탐구하고 있습니다. 이러한 조정은 위협 탐지 마켓플레이스 에서 탐지 규칙의 높은 기준을 유지하고, 기여자들이 그들의 귀중한 작업에 대해 적절하게 보상받을 수 있도록 도와줄 것입니다. 위협 현상금 프로그램에 대한 변경사항이 있을 경우 알려 드리며, 콘텐츠 품질 향상에 대한 지속적인 헌신에 감사드립니다.

저자들은 제출된 탐지가 프로그램 기준을 준수하도록 하여, 규칙의 제목에 대한 품질 요구사항과 가이드라인을 포함하고, SOC Prime 플랫폼에서 프리미엄 콘텐츠에 대한 기대치를 충족시키기 위해 우리의 지침을 철저히 따르도록 권장합니다.

11월에 인기 있었던 탐지 규칙은 무엇입니까?

여기 SOC Prime 플랫폼을 사용하여 보안 운영을 향상시키는 조직들 사이에서 위협 현상금 저자들이 작성한 가장 인기 있는 다섯 가지 탐지 규칙이 있습니다:

VEILDrive 멀웨어의 지속성과 C2 통신을 위한 레지스트리 수정의 가능한 탐지(Microsoft Services를 통해, registry_event) by Davut Selcuk 이 Windows Run 키 아래에서 레지스트리 수정을 모니터링하여 VEILDrive 멀웨어가 사용하는 지속성 메커니즘을 탐지합니다.

Possible Midnight Blizzard SpearPhishing 캠페인(file_event를 통해) by Joseph Kamau 이 2024년 10월에 Midnight Blizzard 위협 행위자와 연결된 가능성 있는 스피어피싱 첨부 파일 실행을 탐지합니다(Microsoft 위협 인텔리전스에 따르면).

PowerShell 제거 네트워크 공유 탐지(ps_script를 통해) by Onur Atali 가 PowerShell을 통해 장착된 네트워크 공유 제거를 탐지합니다. 공격자는 흔적을 없애고 작업 후 가시성을 제한하기 위해 공유 연결을 삭제할 수 있습니다.

EDR 통신을 차단하고 스텔스를 가능하게 하기 위한 방화벽 규칙을 타겟으로 한 EDR 회피를 위한 의심스러운 레지스트리 수정의 가능한 탐지(registry_event를 통해) by Davut Selcuk EDR 네트워크 통신을 차단함으로써 엔드포인트 탐지 및 대응 시스템을 회피하기 위한 잠재적으로 악성 레지스트리 수정을 식별합니다.

Possible Scattered Spider x RansomHub에 의한 VM을 종료하기 위한 Bat 파일 호출로 가능한 실행(VMware Tools를 통한 process_creation)에 의한 Nattatorn Chuensangarun 규칙이 vmtoolsd 프로세스를 통해 VM을 종료하기 위한 악성 .bat 파일 실행과 관련된 의심스러운 Scattered Spider x RansomHub 활동을 탐지합니다.

최고 콘텐츠 저자

여기 11월에 고객들 사이에서 가장 인기 있었던 탐지를 해낸 상위 5명의 위협 현상금 저자들이 있습니다:

Davut Selcuk

Nattatorn Chuensangarun

Onur Atali

Sittikorn Sangrattanapitak

Osman Demir

영향을 주고 기술을 수익화할 준비가 되셨나요? 지금 위협 현상금 프로그램 에 가입하여 글로벌 사이버 보안을 강화하기 위해 여러분의 전문성을 기여하십시오. 탐지 규칙을 제출하여 보상을 받고, 귀중한 작업에 대한 인정을 받으세요.

이 기사가 도움이 되었나요?

동료들과 좋아요를 누르고 공유하세요.

SOC Prime의 Detection as Code 플랫폼에 가입하세요 귀하의 비즈니스와 가장 관련 있는 위협에 대한 가시성을 향상시키세요. 시작하고 즉각적인 가치를 창출하기 위해 지금 SOC Prime 전문가와의 미팅을 예약하세요.

무료 가입하기 미팅 예약하기

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.

SOC Prime 위협 현상금 다이제스트 — 2024년 11월 결과

11월에 인기 있었던 탐지 규칙은 무엇입니까?

최고 콘텐츠 저자

목차

이 기사가 도움이 되었나요?

관련 게시물

사이버 방어를 강화하세요위협 탐지 마켓플레이스

SOC Prime 위협 현상금 다이제스트 — 2024년 11월 결과

11월에 인기 있었던 탐지 규칙은 무엇입니까?

최고 콘텐츠 저자

#ez_toc_widget_sticky-2 .ez-toc-widget-sticky-container ul.ez-toc-widget-sticky-list li.active{ background-color: #ededed; } 목차

이 기사가 도움이 되었나요?

관련 게시물

사이버 방어를 강화하세요위협 탐지 마켓플레이스

목차