security

Notes on cyber security, network monitoring, and SOC operations from books and papers that I’ve read and the experience I’ve had working in a SOC.

Currently I’m interested in applying data science specifically to blue team cyber security, and finding practical ways to do cloud security.

If you want to see a directory of all posts go here.

---

Collections

Hunting for Persistence in Linux

• Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)
• Hunting for Persistence in Linux (Part 2): Account Creation and Manipulation
• Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cron
• Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configuration
• Hunting for Persistence in Linux (Part 5): Systemd Generators

Data Analysis for Cyber Security 101

• Data Analysis for Cyber Security 101: Detecting Lateral Movement
• Data Analysis for Cyber Security 101: Detecting Data Exfiltration

---

Blog Posts

• Hunting for Persistence in Linux (Part 5): Systemd Generators

  How attackers can insert backdoors early in the boot process using systemd generators

• Hunting for Persistence in Linux (Part 4): Initialization Scripts and Shell Configuration

  How attackers create can maintain persistence by inserting scripts and executables in special locations that will run on boot or logon

• Hunting for Persistence in Linux (Part 3): Systemd, Timers, and Cron

  How attackers use newly created and existing accounts for peristence and how to detect them.

• Hunting for Persistence in Linux (Part 2): Account Creation and Manipulation

  How attackers use newly created and existing accounts for peristence and how to detect them.

• Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)

  An introduction to monitoring and logging in linux to look for persistence. With examples how to setup and detect web shell backdoors.

• DEFCON 29 Red Team Village CTF Writeup: Supply Chain Attack

  Writeup of the supply chain attack portion of the Red Team Village Finals CTF of DEFCON 29

• POC Exploit from a CVE: Apache Airflow 1.10.10 RCE

  This is a quick overview of the process of how to write a POC exploit from reported RCE vulnerability in Apache Airflow

• DEFCON 28 OpenSOC Blue Team CTF: Lessons and Tips

  Review of the DEFCON 28 OpenSOC Blue Team CTF Finals and some tips and lessons for future participants and beginners

• U2F with Duo Web Phishable by default

  Without changes to evilginx, we can bypass U2F on Duo with default configurations. This is an analysis of how implementation and configuration of U2F can lead to a scenario where U2F/WebAuthn does not protect you against phishing attacks (until hostname whitelisting is enabled)

• Bypassing LastPass’s “Advanced” YubiKey MFA: A MITM Phishing Attack

  How to deploy a phishing attack on LastPass users, even when they are protected with Yubikey physical keys. This is to appreciate what is U2F and why it is important. I will also give an overview of how LastPass encrypts and handles your vault

• Data Analysis for Cyber Security 101: Detecting Lateral Movement

  Use network flow logs to detect lateral movement. An introduction to lateral movement and outlier detection for cybersecurity.

• Data Analysis for Cyber Security 101: Detecting Data Exfiltration

  Using network flow data to create basic alerts to detect data theft