BDIR Podcast Episode-007 The Incident Response podcast

The Incident Response Podcast

The Incident Response Podcast podcast artwork

Tech Podcasting Tech News IMF Security Brian Michaels

Player FM - Internet Radio Done Right

21 subscribers

추가했습니다 five 년 전

IMF Security and Brian and Michael에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 IMF Security and Brian and Michael 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.

A

All About Change

All About Change podcast artwork

All About Change podcast artwork

1
Chris Nowinski - Protecting Athletes from Head Injuries & Preventing CTE 27:28

6일 전27:28

나중에 재생

나중에 재생

27:28

Chris Nowinski is a former football player at Harvard University and professional wrestler with WWE, World Wrestling Entertainment. After enduring a career-ending head injury, Chris has dedicated his professional life to serving patients and families affected by brain trauma, particularly Chronic traumatic encephalopathy, or CTE, a progressive neurodegenerative disease that develops after repeated head injuries. Jay and Chris discuss the state of head injuries in American athletics, the difference between advocating for head safety at youth and professional levels, Chris’ newest research, and much more. Episode Chapters (00:00) Intro (00:50) changes in the culture around concussions in the past two decades (02:39) padded helmet technology (03:55) concussion reporting in the NFL (10:35) Chris’ career path and concussion history (14:52) connecting with activists who haven’t themselves suffered a traumatic brain injury (17:42) SHAAKE - a new sign to identify concussions (20:53) Unions can help players advocate for safety policies (23:10) final thoughts and goodbye For video episodes, watch on www.youtube.com/@therudermanfamilyfoundation Stay in touch: X: @JayRuderman | @RudermanFdn LinkedIn: Jay Ruderman | Ruderman Family Foundation Instagram: All About Change Podcast | Ruderman Family Foundation To learn more about the podcast, visit https://allaboutchangepodcast.com/…

The Incident Response Podcast « »
BDIR Podcast Episode-007

6년 전 1:06:00

공유

MP3•에피소드 홈

IMF Security and Brian and Michael에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 IMF Security and Brian and Michael 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.

Newsworthy Items: ----------------------- After Sept 21st Credit Freezes are FREEEEEE - Article - by Krebs "Do you use a Tumi bag? Registered it with Tumi's Tracer service? British airways website hacked 380K users affected How Hackers Slipped by British Airways' Defenses - Wired Hackers Can Steal a Tesla Model S in Seconds by Cloning Its Key Fob - WIRED Exploit vendor drops Tor Browser zero-day on Twitter - zdnet Bad Actors Sizing Up Systems Via Lightweight Recon Malware Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share Malware of the month - EMOTET

… continue reading

15 에피소드

#Tech #Podcasting #Tech News #IMF Security #Brian Michaels

The Incident Response Podcast

The Incident Response Podcast podcast artwork

BDIR Podcast Episode-007

The Incident Response Podcast

21 subscribers

published 6년 전

공유

MP3•에피소드 홈

IMF Security and Brian and Michael에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 IMF Security and Brian and Michael 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.

Newsworthy Items: ----------------------- After Sept 21st Credit Freezes are FREEEEEE - Article - by Krebs "Do you use a Tumi bag? Registered it with Tumi's Tracer service? British airways website hacked 380K users affected How Hackers Slipped by British Airways' Defenses - Wired Hackers Can Steal a Tesla Model S in Seconds by Cloning Its Key Fob - WIRED Exploit vendor drops Tor Browser zero-day on Twitter - zdnet Bad Actors Sizing Up Systems Via Lightweight Recon Malware Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share Malware of the month - EMOTET

… continue reading

15 에피소드

#Tech #Podcasting #Tech News #IMF Security #Brian Michaels

모든 에피소드

×

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
Fireless Malware, we think not - Ep 014 1:27:47

5 years 전1:27:47

나중에 재생

나중에 재생

1:27:47

Recorded June 2020 TOPIC: Fileless Malware, we think NOT OUR SPONSORS: OUR GUESTS WILL BE: Tyler Hudak - Practice Lead, Incident Response - TrustedSec @secshoggoth www.trustedsec.com Martin Brough - Cybersecurity Expert for Acronis @TheHackerNinja Website - infosec512.com Upcoming Training: SANS DFIR Summit - Running Processes, the Red Team and Bad Actors are using them July 17-18 Article in eForensics Magazine on ARTHIR covered in Episode 011 Visit the website and register to get the free edition BSides Cleveland - Tyler’s Forensic Analysis Friday June 19th - Tactical WIndows Forensics https://www.bsidescleveland.com/training Will be held and/or released at another event soon Preparing for an Incident - NCC Group webinar.. Free to all July 22nd newsroom.nccgroup.com/events Job Opp: NCC Group has a position, remote, Incident Response engineer, with AWS, GCP, Azure experience. You get to work with ME. https://nccgroup.wd3.myworkdayjobs.com/en-US/NCC_Group/job/Manchester/Senior-Cyber-Incident-Response_R2595 NEWS-WORTHY: Cylance blocks LOG-MD-Premium Running Process check Ticket opened, users must exclude LOG-MD from being checked Windows malware opens RDP ports on PCs for future remote access https://www-zdnet-com.cdn.ampproject.org/c/s/www.zdnet.com/google-amp/article/windows-malware-opens-rdp-ports-on-pcs-for-future-remote-access/ Exploit code for wormable flaw on unpatched Windows devices published online (SMBGhost) - Processing of a malformed compressed message - Eternal Darkness/SMBGhost affects version 3.11 of the protocol, which as ThreatPost points out, is the same version that was targeted by the WannaCry ransomware a couple of years ago The US Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends using a firewall to block SMB ports from the internet and to apply patches to critical- and high-severity vulnerabilities as soon as possible ENABLE THE WINDOWS FIREWALL !!!! BLock SMB to workstations, and you will get better logging too ;-) https://arstechnica.com/information-technology/2020/06/exploiting-wormable-flaw-on-unpatched-windows-devices-is-about-to-get-easier/ Microsoft warns of vulnerabilities in SMBv3 (Eternal Darkness) Microsoft warns of vulnerabilities in SMBv3 Netwalker Fileless Ransomware Injected via Reflective Loading https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ 80% of hacking-related breaches leverage compromised credentials https://securityboulevard.com/2020/06/80-of-hacking-related-breaches-leverage-compromised-credentials/ SITE-WORTHY: THE IR Crew MITRE ATTACK https://attack.mitre.org/ Guest - Tyler https://www.incidentresponse.com/playbooks/ Guest - Martin Sandbox - https://app.any.run TOOL-WORTHY: The IR crew LOG-MD-Professional Volatility Guest 1 - Tyler MFTECmd https://github.com/EricZimmerman/MFTECmd/releases KAPE, or rawcopy, or other tools to capture MFT before processing Guest 2 - Martin NetworkMiner https://www.netresec.com/?page=NetworkMiner MALWARE OF THE MONTH: Dridex fileless malware: Key Detection points Well… in memory only “fileless” Rundll32 calling malicious DLL Parent Child relationship Rundll32.exe calling SysWow64\Rundll32.exe PREVENTION Scan email attachments Block Macro execution Block uncategorized websites Application Whitelist Users directory Lock down PowerShell EDR TOPIC OF THE DAY: Fileless Malware, we don’t think so What is “Fileless Malware”? Cyberreason - Unlike file-based attacks, fileless malware does not leverage traditional executable files. Fileless attacks abuse tools built-in to the operating system to carry out attacks. Essentially, Windows is turned against itself. Without an executable, there is no signature for antivirus software to detect. This is part of what makes fileless attacks so dangerous - they are able to easily evade antivirus products. McAfee - Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect and remove. CarbonBlack - Fileless malware refers to a cyberattack technique that uses existing software, allowed applications, and authorized protocols to carry out malicious activities. WikiPedia - Fileless malware is a variant of computer related malicious software that exists exclusively as a computer memory-based artifact i.e. in RAM. It does not write any part of its activity to the computer's hard drive meaning that it's very resistant to existing Anti-computer forensic strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern-analysis, time-stamping, etc., and leaves very little by way of evidence that could be used by digital forensic investigators to identify illegitimate activity. As malware of this type is designed to work in-memory, its longevity on the system exists only until the system is rebooted. MGs definition So what do WE think Fileless Malware is? The IR crew Tyler Martin A better way to define Fileless Malware and WHY Memware Regware WMIware PowerShellware Wormware LolBin/LolBasware And malware .NETware compile on the fly (compileware) bootware How does this change our evaluation of malware? How does this change our IR or THreat Hunting process? How does this change how we detect and alert on malware? Final thoughts Other Articles: ------------------- Cybereason - FILELESS MALWARE 101: UNDERSTANDING NON-MALWARE ATTACKS https://www.cybereason.com/blog/fileless-malware McAfee - What Is Fileless Malware? https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-fileless-malware.html…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
Getting back to basics, IR 101 - Episode 013 50:36

5 years 전50:36

나중에 재생

나중에 재생

50:36

Recorded May 2020 TOPIC: Getting back to basics, IR 101 OUR SPONSORS: NEWS-WORTHY: Best EDR Security Services In 2020 for Endpoint Protection https://www.softwaretestinghelp.com/edr-security-services/ How to Avoid Spam—Using Disposable Contact Information https://www.wired.com/story/avoid-spam-disposable-email-burner-phone-number/ Shiny new Azure login attracts shiny new phishing attacks https://nakedsecurity.sophos.com/2020/05/18/shiny-new-azure-login-attracts-shiny-new-phishing-attacks/ Upgrading from EDR to MDR is Critical but Easier than You Think https://securityboulevard.com/2020/05/upgrading-from-edr-to-mdr-is-critical-but-easier-than-you-think/ The ransomware that attacks you from inside a virtual machine https://nakedsecurity.sophos.com/2020/05/22/the-ransomware-that-attacks-you-from-inside-a-virtual-machine/ SITE-WORTHY: Malware Archaeology - Cheat Sheets https://www.MalwareArchaeology.com/cheat-sheets TOOL-WORTHY: LOG-MD - The Log anD Malicious Discovery tool “LOG-MD -a” will give you how you compare against the cheat sheets https://www.LOG-MD.com MALWARE OF THE MONTH: Qakbot Typical delivery via a Office doc or URL Created a folder in C:\Users Key Detection points Enable better logging AutoRuns - Uses Run key and Scheduled Task WMIPrvSe launch binary in C:\Users Binary in root of \Username directory C:\Users\\.exe C:\Users\\AppData\Roaming\Microsoft\ Syswow64\Explorer.exe used Parent of Explorer.exe is NEVER a binary in C:\Users Process injection of Syswow64\Explorer.exe Ping 127.0.0.1 Scheduled Task created by a binary in C:\Users Syswow64\Explorer,exe opening all the browsers Binary in C:\User calling out to foreign country PREVENTION Block Office macros Don’t allow uncategorized websites EDR Software Whitelisting C:\Users TOPIC OF THE DAY: Getting back to basics, IR 101 What is getting back to basics - IR 101 This will likely be multiple episodes We will start with Windows Why is this important? WHEN you have an incident, data we, and you need will be available This is probably the #1 finding and recommendation we have made to organizations we have been involved with over the years Security tools fail, so other data you collect can help discover what happened where, when, and how What is the problem we are wanting our listeners to solve? To be better prepared in the event of an incident to speed up investigations Give your SOC, IT, or Security people the data they need to investigate events Make log management data better if you are collecting all the things And of course… help your IR Consultancy do a better job FASTER Other Articles: ------------------- CIS Benchmarks https://www.cisecurity.org/cis-benchmarks/ DerbyCon talk on EDR https://www.irongeek.com/i.php?page=videos/derbycon7/t416-edr-etdr-next-gen-av-is-all-the-rage-so-why-am-i-enraged-michael-gough DerbyCon talk on Winnti https://www.irongeek.com/i.php?page=videos/derbycon5/teach-me01-a-deep-look-into-a-chinese-advanced-attack-understand-it-learn-from-it-and-how-to-detect-and-defend-against-attacks-like-this-michael-gough…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
Ep 012 - Laughing at Binaries - LOLBin/LOLBas 49:30

5 years 전49:30

나중에 재생

나중에 재생

49:30

Formerly the Brakeing Down Incident Response Podcast Recorded Oct 2019 TOPIC: Laughing at Binaries - LOLBin/LOLBas OUR GUEST WILL BE: Oddvar Moe , Sr. Security Consultant TrustedSec - Red Teamer @Oddvarmoe Blog - https://oddvar.moe/ lolbas-project.com https://github.com/api0cradle/UltimateAppLockerByPassList https://github.com/api0cradle/PowerAL OUR SPONSORS: NEWS-WORTHY: Cyber Security Awareness Month Share something that can help SMBs, your family or friends Flaw with SUDO that lets you get admin priv when denied Patch patch patch... Microsoft Enables Tamper Protection by Default for all Windows 10 Users to Defend Against Attacks https://go.newsfusion.com//security/item/1524577 Most Americans do not know what MFA is???? https://securityboulevard.com/2019/10/most-americans-dont-know-what-2fa-is-pew-research-shows/ Hackers bypassing some types of 2FA security FBI warns https://nakedsecurity.sophos.com/2019/10/11/hackers-bypassing-some-types-of-2fa-security-fbi-warns/ SITE-WORTHY: Malware Archaeology Logging tips - List of Binaries to monitor https://www.malwarearchaeology.com/logging Guest - LolBin/LolBas - api0cradle - aka Oddvar Moe https://lolbas-project.github.io/ https://github.com/LOLBAS-Project/LOLBAS https://gtfobins.github.io/ http://www.hexacorn.com/blog/ TOOL-WORTHY: HUMIO - Free 2GB/day 7 day retention https://www.Humio.com Guest: https://github.com/PowerShellMafia/CimSweep - Matt Graeber – Agentless using CIM/WMI http://nirsoft.net/ (DLL Export viewer, Reg DLL View, Password recovery, network tools +++) Get injected-thread by Jared Atkinson - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2 https://github.com/Neo23x0/sigma - Standardized ruleset for SIEMs MALWARE OF THE MONTH: New Dridex version Delivered via Office document or Email with URL wscript/csript downloads bad binary named Chrome.exe Calls Scheduled task for persistence Chrome calls msra.exe for comms C:\Windows\syswow64\Msra.exe chrome.exe So another LOLBin ? This is what prompted this podcast TOPIC OF THE DAY: Laughing at Binaries - LOLBin/LOLBas What is a LOLBin and LOLBas? It stands for Living off the Land Binary and Scripts Libraries too, Dlls What started all this? @SubTee Casey Smith efforts on Application Whitelisting bypasses from 2015 ish where he found ways to use existing binaries on the system to do bad things like RegSvr32, RegAsm, RunDll32, and several others Why are these an issue for us Defenders? Well Pentesters and Red Teams use them to get around security solutions like AV, EDR and App Whitelisting Do these normally execute? If so how noisy are they? Some are noisy What do we need to watch out for? Command line parameters are key What is are the parameters they are executing with these utilities Are there any lists people can use? Malware Archaeology Logging page has a list and link to Oddvar’s page What about security solutions, do we need to be concerned with these? Yes, many AV and EDRs will not have alerts for these items You will need to build some alerts and filter out the good/noise What about logging theme? Use the list(s) and build a lookup list that you can add to 4688 events or Sysmon 1 and 7 events and monitor them What about MITRE ATT&CK, do they reference these? Yes, there are several of these mentioned in MITRE ATT&CK, so map your tools to ATT&CK Techniques Are there ways to test for these LOLs What else do people need to watch out for? Other Articles: ------------------- Casey Smith @SubTee - Red Canary Bypassing Application Whitelisting SHMOOCon 2015 - https://youtu.be/XVuboBH5TYo SANS https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1524509113.pdf DerbyCon 2016 - http://www.irongeek.com/i.php?page=videos/derbycon6/522-establishing-a-foothold-with-javascript-casey-smith DerbyCon 2019 - http://www.irongeek.com/i.php?page=videos/derbycon9/stable-28-net-manifesto-win-friends-and-influence-the-loader-casey-smith Oddvar Moe talk on LOLBin at DerbyCon 2018 https://www.youtube.com/watch?v=NiYTdmZ8GR4 Alternate Data Streams: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
Ep 011 - ARTHIR - ATT&CK Remote Threat Hunting Incident Response tool 40:13

5 years 전40:13

나중에 재생

나중에 재생

40:13

www.LOG-MD.com/podcasts

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-010 1:19:00

6 years 전1:19:00

나중에 재생

나중에 재생

1:19:00

Newsworthy Items: • INSURANCE COMPANY REFUSES TO PAY NOTPETRYA BILL, SAYS IT WAS AN ACT OF WAR, COMPANY SUES FOR $100M • 2-FACTOR AUTH BYPASSED ??? • 773 MILLLLLION PASSWORDS CIRCULATING THE INTERNET FROM PAST BREACHES • BYPASS BLACKLISTED WORDS FILTER (OR FIREWALLS) VIA WILDCARDS Malware of the month - First Sednit UEFI Rootkit Unveiled Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-009 - MITRE ATT&CK Part 2 1:00:00

6 years 전1:00:00

나중에 재생

나중에 재생

1:00:00

Newsworthy Items: Over 1 BILLION Pwned Dell Breach Marriott/Starwood Breach Malware of the month - LOKIBot Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-008 51:00

6 years 전51:00

나중에 재생

나중에 재생

51:00

Newsworthy Items: 1. NSS Labs fires off anti-malware-testing lawsuit at infosec toolmakers 2. Gartner says EDR will be a 1.5 BILLION, with a B business by 2020 3. Forrester Report on is EDR overblown

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-007 1:06:00

6 years 전1:06:00

나중에 재생

나중에 재생

1:06:00

Newsworthy Items: ----------------------- After Sept 21st Credit Freezes are FREEEEEE - Article - by Krebs "Do you use a Tumi bag? Registered it with Tumi's Tracer service? British airways website hacked 380K users affected How Hackers Slipped by British Airways' Defenses - Wired Hackers Can Steal a Tesla Model S in Seconds by Cloning Its Key Fob - WIRED Exploit vendor drops Tor Browser zero-day on Twitter - zdnet Bad Actors Sizing Up Systems Via Lightweight Recon Malware Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share Malware of the month - EMOTET…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-006 1:30:00

7 years 전1:30:00

나중에 재생

나중에 재생

1:30:00

Newsworthy Items: The most expensive Cyber attack EVER !!! (wired) City of Atlanta 17 million ransom attack APT32 proves what we say about logging - Monitor Scheduled Tasks Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share…

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-005 1:37:00

7 years 전1:37:00

나중에 재생

나중에 재생

1:37:00

Newsworthy Items - New Sysmon and Autoruns versions released. Be careful of VirusTotal uploads Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-004 1:15:00

7 years 전1:15:00

나중에 재생

나중에 재생

1:15:00

Newsworthy Items - The FBI asks us to reboot our routers Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-003 1:27:00

7 years 전1:27:00

나중에 재생

나중에 재생

1:27:00

News-Worthy Site-Worthy Tool-Worthy

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-002 2:04:00

7 years 전2:04:00

나중에 재생

나중에 재생

2:04:00

News-Worthy Site-Worthy Tool-Worthy

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-001 1:00:00

7 years 전1:00:00

나중에 재생

나중에 재생

1:00:00

News-Worthy Site-Worthy Tool-Worthy

T

The Incident Response Podcast

The Incident Response Podcast podcast artwork

1
BDIR Podcast Episode-000 1:05:00

7 years 전1:05:00

나중에 재생

나중에 재생

1:05:00

"Incident Response, Malware Discovery, and Basic Malware Analysis, Detection and Response, Active Defense, Threat Hunting, and where does it fit within DFIR"

플레이어 FM에 오신것을 환영합니다!

플레이어 FM은 웹에서 고품질 팟캐스트를 검색하여 지금 바로 즐길 수 있도록 합니다. 최고의 팟캐스트 앱이며 Android, iPhone 및 웹에서도 작동합니다. 장치 간 구독 동기화를 위해 가입하세요.

500개 이상의 주제를 청취

탐색하는 동안 이 프로그램을 들어보세요.