SOC Prime Team released a new Sigma rule based on IOCs that can detect the known indicators of the Outlaw hacking group. Check the link to view the available translations on Threat Detection Marketplace: https://tdm.socprime.com/tdm/info/yyiW6rvv5a00/JiEBzHEBjwDfaYjKqEwv/ Also, you can use Uncoder to convert Sigma rule to a number of supported platforms without access to your SIEM environment. […]
Adversaries can mask malicious executables as images, documents or archives, replacing file icons and adding fake extensions to the file names. Such “crafted” files are often used as attachments in phishing emails, and this is a fairly effective way to infect Windows systems due to “Hide known file types extensions” option enabled by default for […]
With this release, we’ve done a great job and today we are delighted to introduce our sparkling new features and improvements to SOC Prime Threat Detection Marketplace (TDM). Check out what’s new. New Platforms The most wanted innovation is the support of a couple of popular Platforms. CrowdStrike You can now hunt for the threats […]
An emergency security update for Sophos XG Firewall was released this Saturday. The update patches a zero-day SQL injection remote code execution vulnerability that is actively exploited in the wild. It allows cybercriminals to compromise Sophos firewalls via their management interface and deploy Asnarok malware. The Trojan steals the firewall’s license and serial number, user […]
SOC Prime is presenting another interview with a participant of the SOC Prime Threat Bounty Developer Program (https://my.socprime.com/en/tdm-developers). We want to introduce to you Den Iuzvyk who published 60+ community rules of the highest quality and detection value during six months of his participation in the Threat Bounty Program. Read more interviews with content developers […]
‘The Suspicious Command Line Contains Azure TokenCache.dat as Argument’ community rule by the SOC Prime team is available at Threat Detection Marketplace: https://tdm.socprime.com/tdm/info/MzSiYeDJ9PvW/ The TokenCache.dat file contains the AccessKey for the current session and is stored as a plaintext JSON file. Any manipulations with this file via the command line may indicate an attempt to steal […]
All SOC Prime Team is currently working remotely (hope you do the same) but such conditions didn’t influence our effectiveness and striving to improve Threat Detection Marketplace (TDM) platform. In this blog we’re thrilled to announce SOC Prime’s 4 new TDM features that come thanks to our 3d party integration with Microsoft Azure Sentinel, which […]
Purpose The purpose of this blog post is to introduce the metrics (Pain, Actionability, SIEM Impact, and Severity) that have been introduced to SOC Prime’s Threat Detection Marketplace. Introduction SOC Prime’s Threat Detection Marketplace enhances your security operations with quality detection content. As with all defensive technology deploying all possible content “out of the box” […]
+30% bonus on Threat Bounty Payout for March and Steady Income Generation on Threat Research in times of WFH and COVID19 “We are witnessing the cyber security industry transformation. Software has progressed from waterfall and kanban to agile processes and CI/CD. The discipline of threat detection engineering has evolved too. This became possible due to […]
We present to your attention new interview with the participant in SOC Prime’s Developer Program (https://my.socprime.com/en/tdm-developers). Meet Osman Demir. Tell us a bit about yourself and your experience in threat-hunting. Hello, I’m Osman Demir. I live in Istanbul, Turkey, and I’m 25 years old. I finished my education in Computer Engineering in 2017, and I […]