blueteam - you sneakymonkey!

blueteam

A collection of 9 posts

TRICKBOT - Analysis Part II

trickbot Featured

TRICKBOT - Analysis Part II

Some further TTPs used by TRICKBOT [1] from an infected host that I thought was interesting to share. The sample used here is from an EMOTET to TRICKBOT infection "GTAG:mor14" courtesy of Malware-Traffic-Analysis. 👏👏 Samples Used * C:\Users\AUSER\AppData\Roaming\netcloud\բնութագրվում է.exe * C:\Users\AUSER\AppData\Roaming\

TRICKBOT - Analysis

TRICKBOT - Analysis

Research into how to decode the TRICKBOT config, quickly analyse to provide context and help incident response/blue teams.

blueteam Featured

Blue Team Tips

What are the best recommendations to a completely vulnerable, easily pwnable network? Where do you start? what tools? what logging? #DFIR #BlueTeamTips

Blue Team Basics - Local Admin Password Administration

Blue Team Basics - Local Admin Password Administration

I used to be a Domain Administrator for a large AD deployment. Centralised account and access management was always a struggle so any solution to aid the manageability of administrative credentials is a massive security bonus. I've had several people recommend this solution over the last few months so I'll

GrrCon 2017 DFIR write up - Level 1

GrrCon 2017 DFIR write up - Level 1

#GrrCon 2017 #DFIR #CTF challenge. Several host images and memory dumps need to be analysed and investigated. Submit IOCs as you progress...

Blue Team Basics - PCAP File Extraction

Blue Team Basics - PCAP File Extraction

A few methods of how to carve data out of PCAPs. Whether this be a single analysis of some network traffic or part of a malware analysis lab. Using Wireshark Ideal for investigating smaller PCAPs but you tend to see a performance slip off after anything over 800MB. 1. Run

RaspberryPi NSM

RaspberryPi NSM

Foxhound: Blackbox - A RaspberryPi 3 NSM (Network Security Monitor) based on Bro, Netsniff-NG, Loki and Critical Stack. Suitable for a home 'blackbox' deployment - it will record everything that happens on your network. Use it to detect threats and/or to provide network forensics to a malware lab. Primarily

Blue Team Basics - Honeynets

Blue Team Basics - Honeynets

Creating a honeynet "All warfare is based on deception....when we are near, we must make the enemy believe we are far away" Sun Tzu, The Art of War Introduction A honeypot or numerous honeypot's (a honeynet) purpose is to gather threat intelligence (TTPs), divert attack efforts and fundamentally detect