SOCLabs @DetectionLabs

We are building a SIEM learning and training platform for detection engineers. soc-labs.top Joined April 2024

Tweets

33
Followers

53
Following

188
Likes

43

SOCLabs @DetectionLabs

2 days ago

I did a great detection rule. soc-labs.top/en/detections/… via @DetectionLabs

0 0 0 14 1

Found an interesting detail during a DFIR case: On macOS, the last log does not record all SSH logins. When an attacker runs: ssh [email protected] "command" the login won’t show up in last. ⚠️ This means attackers can bypass the usual login traces.

0 0 0 48 1

Download Image

Clint Gibler @clintgibler

2 weeks ago

😈 ChromeAlone - Transform Chromium browsers into a C2 Implant. A la Cobalt Strike or Meterpreter. @defcon talk and tool release by @praetorianlabs' Michael Weber. ChromeAlone contains a number of out of the box components, including: - A malicious Chrome extension that can…

0 32 98 9K 51

Download Image

SOCLabs @DetectionLabs

2 weeks ago

A critical server’s login sources are usually limited to a few stable IPs ⚠️ When a new, unfamiliar IP suddenly shows up in the logs— it could be the first sign of an intrusion 🎯 New Challenge: 《IP Access Baseline Deviation Detection》 👀 Can you detect it right away?…

0 1 2 74 0

Download Image

Fabian Bader @fabian_bader

3 weeks ago

Two years ago I published a two part series on #MSGraph logs and how to use them for threat hunting. Now comes part 3 and the logs are finally available to the masses. #EntraID #KQL #Security cloudbrothers.info/en/detect-thre…

1 51 153 10K 130

SOCLabs @DetectionLabs

a month ago

🎣 New Detection Challenge Live! We've just released our latest security detection challenge: "Double Extension Spoofing" Double extension spoofing is a classic phishing technique where attackers disguise executable files as regular documents. Can you spot this phishing trick?…

0 4 6 407 0

Download Image

SOCLabs @DetectionLabs

2 months ago

🚨 Just released: Browser Credential Theft Detection Challenge! 🕵️‍♂️🔐 It covers credential theft methods for multiple browsers 🛡️ Test if you can complete the challenge and validate your detection rules! 👇 Try it now:soc-labs.top/en/detections/… #ThreatDetection #BlueTeam #SIEM…

0 4 8 627 4

Download Image

SOCLabs @DetectionLabs

2 months ago

🚨 New Detection Challenge! 🚨 SOCLabs just launched a Password Spraying & Credential Access Detection challenge! Test your SIEM query skills and see if you can catch the attack. Ready to level up? Try it now on SOCLabs! 🔍💻 👉 soc-labs.top/en/detections/… #CyberSecurity #SIEM…

0 1 9 522 4

Download Image

PCrisk @pcrisk

2 months ago

ClickFix variant targeting Mac users through X ads. Tries tricking users into "cleaning" their Macs by running a terminal command. Domain: hxxps://top-fixer[.]com/?p=141 Distributes install[.]sh file: virustotal.com/gui/file/525be…

1 7 26 4K 17

Download Image

Justin Ibarra @br0k3ns0und

2 months ago

Thanks for the shoutout to the Zen of Security Rules br0k3nlab.com/resources/zen-… Cool initiative to see this applied to threat hunting as well 🤙 Thanks for sharing @_w0rk3r

sydney @letswastetime

2 months ago

Thanks for the shoutout to the Zen of Security Rules br0k3nlab.com/resources/zen-… Cool initiative to see this applied to threat hunting as well 🤙 Thanks for sharing @_w0rk3r

1 6 19 1K 3

0 3 8 634 2

SEKTOR7 Institute @SEKTOR7net

2 months ago

An increased visibility into threads' call stacks helps with more reliable malware detection. The approach is based on ETW telemetry and module's Export Directory data for information enrichment. A post by John Uhlmann of @elasticseclabs. Great read! #redteam #blueteam #maldev…

2 24 73 5K 41

Download Image

Dodge This Security @shotgunner101

2 months ago

Used Claude to generate a Splunk query to hunt for browser exploits and potential @mrd0x #FileFix #clickfix like behaviors in Sysmon Process Create events. Ran it in a fortune 50 environment and for a 7 day period only had 200~ events out of 200 Million pastebin.com/PJGZuArj

2 12 103 12K 76

SOCLabs @DetectionLabs

2 months ago

Inspired by this new FileFix technique from @mrd0x , we've launched a hands-on detection challenge! Write and test SIEM rules Splunk, Elastic, KQL, Sigma, OpenSearch in your browser. Try it now: 👉 https:soc-labs.top/en/detections/… #SIEM #DetectionEngineering #CyberSecurity #FileFix

mr.d0x @mrd0x

2 months ago

20 191 747 171K 453

Download Image

1 9 44 4K 18

SOCLabs @DetectionLabs

3 months ago

And us

Christopher Peacock @SecurePeacock

3 months ago

And us

7 25 249 25K 218

0 0 0 115 0

Alex Neff @al3x_n3ff

3 months ago

Did you know that you can kerberoast without any valid credentials? All you need is an account that is ASREProastable. This allows you to request service tickets for any account with a set SPN🔥 NetExec now has a native implementation of this technique, thanks to Azox

7 117 474 30K 237

Download Image

SOCLabs @DetectionLabs

3 months ago

Have you ever detected suspicious ipconfig commands? Check out this great article (by monik123 ) on how to spot suspicious ipconfig process chains 👇: medium.com/@monik123/dete…… #Cybersecurity #SIEM #DetectionEngineering #ThreatDetection #BlueTeam

0 0 2 163 0

Elastic Security Labs @elasticseclabs

3 months ago

#ElasticSecurityLabs has uncovered EDDIESTEALER, a novel Rust-based info stealer distributed via fake CAPTCHA campaigns. This malware targets credentials, browser info, & crypto wallets. Read our full analysis here: go.es.io/3St6tnY #Cybersecurity #MalwareAnalysis