Detection Content | 18 중 3 번째 페이지

BianLian 랜섬웨어 탐지: AA23-136A 공동 사이버 보안 자문 – BianLian 운영자가 진행 중인 악의적인 캠페인에서 사용하는 TTP의 세부 사항

11월 22, 2024

태그: AA23-136A, BianLian, CISA, Cyberattack, Detection Content, Malware, Ransomware, Sigma

이란과 연계된 해킹 집단으로 추적된 사이버 공격의 물결에 따라 Pioneer Kitten이 발생했습니다. FBI, CISA 및 공동 저자 파트너는 BianLian 랜섬웨어 그룹에 의해 가해지는 증가하는 위협을 방어자들에게 알리는 새로운 경고를 발행했으며, 이는 주로 미국과 호주의 중요한 기반 시설 조직을 대상으로 합니다. BianLian 랜섬웨어 탐지 Sophos의 2024 랜섬웨어 상태 보고서에 따르면, 전 세계의 59%의 조직이 랜섬웨어 공격을 […]

변덕스러운 스틸러 악성코드 탐지: 새로운 러스트 기반 스틸러가 합법적인 소프트웨어로 위장하여 손상된 장치에서 데이터를 탈취

11월 21, 2024

태그: Cyberattack, Detection Content, Infostealer, Malware, Sigma, SOC Prime Platform, Threat Detection Marketplace, Threat Hunting Content

Fickle Stealer라는 새로운 러스트 기반 정보 탈취 악성코드가 나타났습니다. 이 악성코드는 감염된 사용자로부터 민감한 데이터를 추출할 수 있습니다. 새 탈취 악성코드는 Windows용 GitHub Desktop 소프트웨어로 가장하며, 광범위한 안티 멀웨어 및 탐지 회피 기법을 채택하여 잠재적 피해자에게 증가하는 위협을 제공합니다. Fickle Stealer 악성코드 탐지 현재 사이버 보안 환경은 탈취 악성코드의 증가하는 은밀성과 회피성으로 특징지어집니다. 특히, 최근 […]

PXA Stealer 탐지: 베트남 해커, 유럽 및 아시아 공공 및 교육 부문 공격

11월 18, 2024

태그: Detection Content, Infostealer, Malware, Phishing, Sigma, SOC Prime Platform, Threat Detection Marketplace, Threat Hunting Content

높은 회피 수단을 활용한 최근 사이버 공격의 여파로 Strela Stealer 중앙 및 남서부 유럽에서 정보 탈취 프로그램 이 주목받고 있으며, 유럽 및 아시아 전역의 정부 및 교육 부문 내 민감한 데이터를 타겟으로 하고 있습니다. 수비자들은 베트남어를 사용하는 상대가 새로운 파이썬 기반의 악성코드인 PXA Stealer를 활용하여 진행 중인 정보 탈취 캠페인을 관찰했습니다. PXA Stealer 탐지 에 […]

새로운 Remcos RAT 활동 탐지: 피싱 캠페인을 통해 전파되는 새로운 파일리스 멀웨어 변종

11월 15, 2024

태그: Cyberattack, Detection Content, Malware, Sigma, SOC Prime Platform, Threat Detection Marketplace, Threat Hunting Content

사이버 보안 연구원들은 피싱 이메일에 미끼 첨부 파일로 사용되는 악성 Excel 파일에 의해 악용되는 CVE-2017-0199로 추적되는 Microsoft Office의 알려진 RCE 취약점을 활용하는, 인 더 와일드에서 진행 중인 적대 세력 캠페인을 식별했습니다. 이 피싱 캠페인은 악명 높은 파일리스 버전의 새로운 Remcos RAT 맬웨어를 배포하고 대상 시스템에 대한 전체 원격 제어를 수행하도록 설계되었습니다. Remcos RAT 탐지 피싱 […]

인터락 랜섬웨어 탐지: 새로운 랜섬웨어 변종을 사용하는 고위험 및 이중 갈취 공격

11월 12, 2024

태그: Cyberattack, Detection Content, Ransomware, SOC Prime Platform, Threat Detection Marketplace, Threat Hunting Content

공격자들은 새로운 인터록 랜섬웨어 를 최근에 관찰된 큰 사냥 및 이중 협박 공격에서 미국과 유럽의 다양한 산업 부문에 속한 조직들을 대상으로 사용하고 있습니다. 방어자들은 인터록 랜섬웨어가 Rhysida 랜섬웨어 관련자나 개발자들과 연결되어 있을 가능성을 낮은 확률로 추정하고 있으며, 유사한 TTP 및 암호화 바이너리 기반으로 이를 추론하고 있습니다. 인터록 랜섬웨어 감지 랜섬웨어 공격은 계속해서 증가하고 있으며, 2022년에서 […]

SOC Prime 위협 현상금 요약 — 2024년 10월 결과

11월 12, 2024

태그: Detection Content, Threat Bounty Program

위협 현상금 규칙 릴리스 10월 결과판에 오신 것을 환영합니다, 우리의 전통적인 위협 현상금 월간 다이제스트입니다. 지난 달, 우리 글로벌 사이버보안 전문가 커뮤니티는 크라우드소스 탐지 엔지니어링에 참여하여 신흥 사이버 위협을 신속히 처리하였고, 실행 가능한 탐지 콘텐츠로 기여하였습니다. 그 결과, 위협 현상금 프로그램 회원들에 의해 SOC Prime 플랫폼에 81개의 새로운 탐지 규칙이 릴리스되었습니다. 안타깝게도, 많은 규칙이 검증을 […]

초보자에서 전문가로: 보안 취약점 포상제에서의 성공적인 경로

11월 11, 2024

태그: Detection Content, Sigma, SOC Prime Platform, Threat Bounty Program, Uncoder AI

SOC Prime 위협 현상금 프로그램에서 레벨을 높이는 필수 팁 검출 엔지니어 및 SOC 분석가, 위협 헌터로서 SOC Prime의 위협 현상금 프로그램에 참여하면, 글로벌 사이버 보안 커뮤니티에서 상당한 수준의 전문 성장의 기회를 제공합니다. 이 프로그램은 검출 엔지니어링의 전문성을 활용하여, 조직의 보안 팀이 전 세계적으로 사용할 수 있는 고가치 콘텐츠에 기여하면서 지속적인 보상과 인정을 얻도록 설계되었습니다. 기초를 […]

은밀한 Strela Stealer 탐지: 정보 탈취 멀웨어가 중앙 및 남서 유럽을 겨냥하여 기능을 강화하며 재등장

11월 05, 2024

태그: Cyberattack, Detection Content, Malware, Sigma, SOC Prime Platform, Threat Bounty Program, Threat Detection Marketplace, Threat Hunting Content

보안 연구원들은 중앙 및 남서부 유럽의 사용자들을 대상으로 이메일 자격증명 탈취기를 겨냥한 은밀한 캠페인을 공개했습니다. 스트렐라(Strela)라 불리는 이 교묘한 멀웨어는 피싱 이메일을 통해 배포되며, 일반적인 보안 조치를 우회하기 위해 난독화된 JavaScript와 WebDAV를 활용합니다. 2년 전 처음 등장한 이후 Strela Stealer는 악성 기능을 크게 강화하여 탐지되지 않으면서도 알지 못하는 사용자들의 민감한 데이터를 비밀리에 탈취하고 있습니다. 은밀한 […]

실용 가이드: Uncoder AI로 IOC를 SIEM 쿼리로 변환하기

10월 31, 2024

태그: Detection Content, IOC, IOC Rule, SOC Prime Platform, Uncoder, Uncoder AI, Uncoder IO

IOC란 무엇이며 사이버 보안에서 그들의 역할은 무엇인가요? 사이버 보안 운영에서 IP 주소, 파일 해시, 도메인 및 URL과 같은 침해 지표(IOC)는 조직의 네트워크 내에서 악성 활동을 식별하는 중요한 포렌식 증거로 사용됩니다. 이러한 아티팩트는 보안 팀이 잠재적인 사이버 위협을 감지할 수 있도록 하는 데 필수적입니다. 효과적인 IOC를 활용하려면 팀은 제공된 정보가 그들에게 위협 행위자가 사용하는 최신 전술, […]

UAC-0001 aka APT28 공격 탐지: 클립보드의 PowerShell 명령을 초기 진입점으로 활용

10월 29, 2024

태그: CERT-UA, CERTUA, Cyberattack, Detection Content, Phishing, Sigma, SOC Prime Platform, Threat Detection Marketplace, Threat Hunting Content, Vulnerability

악명 높은 러시아 국가 후원 해킹 그룹으로 알려진 APT28 또는 UAC-0001, 우크라이나 공공 부문 조직을 대상으로 한 피싱 공격을 지속적으로 수행해온 이력이 있는 이 그룹이 최근 사이버 위협 환경에서 다시 등장했습니다. 최신 적대자 캠페인에서 CERT-UA에 의해 확인된 공격자들은 공격의 진입점으로 클립보드에 삽입된 PowerShell 명령을 무기화하여 데이터 유출 및 METASPLOIT 멀웨어 . UAC-0001 aka APT28 활동 […]

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.

Tag: Detection Content

Search:

Follow us on:

Archive

Tags