Player FM - Internet Radio Done Right
21 subscribers
Checked 2M ago
five 年前已添加!
内容由IMF Security and Brian and Michael提供。所有播客内容(包括剧集、图形和播客描述)均由 IMF Security and Brian and Michael 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
Player FM -播客应用
使用Player FM应用程序离线!
使用Player FM应用程序离线!
值得一听的播客
赞助
L
Lipstick on the Rim


1 Amy Schumer & Brianne Howey on the Importance of Female Friendships, Navigating Hollywood's Double Standards, Sharing Their Birth Stories, and MORE 50:05
This week, in what might be the funniest episode yet, Molly and Emese are joined by co-stars Amy Schumer and Brianne Howey. They get candid about motherhood, career evolution, and their new film, Kinda Pregnant —which unexpectedly led to Amy’s latest health discovery. Amy opens up about how public criticism led her to uncover her Cushing syndrome diagnosis, what it’s like to navigate comedy and Hollywood as a mom, and the importance of sharing birth stories without shame. Brianne shares how becoming a mother has shifted her perspective on work, how Ginny & Georgia ’s Georgia Miller compares to real-life parenting, and the power of female friendships in the industry. We also go behind the scenes of their new Netflix film, Kinda Pregnant —how Molly first got the script, why Amy and Brianne were drawn to the project, and what it means for women today. Plus, they reflect on their early career struggles, the moment they knew they “made it,” and how motherhood has reshaped their ambitions. From career highs to personal challenges, this episode is raw, funny, and packed with insights. Mentioned in the Episode: Kinda Pregnant Ginny & Georgia Meerkat 30 Rock Last Comic Standing Charlie Sheen Roast Inside Amy Schumer Amy Schumer on the Howard Stern Show Trainwreck Life & Beth Expecting Amy 45RPM Clothing Brand A Sony Music Entertainment production. Find more great podcasts from Sony Music Entertainment at sonymusic.com/podcasts and follow us at @sonypodcasts To bring your brand to life in this podcast, email podcastadsales@sonymusic.com Learn more about your ad choices. Visit podcastchoices.com/adchoices…
BDIR Podcast Episode-009 - MITRE ATT&CK Part 2
Manage episode 262367382 series 2681668
内容由IMF Security and Brian and Michael提供。所有播客内容(包括剧集、图形和播客描述)均由 IMF Security and Brian and Michael 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
Newsworthy Items: Over 1 BILLION Pwned Dell Breach Marriott/Starwood Breach Malware of the month - LOKIBot Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share
15集单集
Manage episode 262367382 series 2681668
内容由IMF Security and Brian and Michael提供。所有播客内容(包括剧集、图形和播客描述)均由 IMF Security and Brian and Michael 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品,您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
Newsworthy Items: Over 1 BILLION Pwned Dell Breach Marriott/Starwood Breach Malware of the month - LOKIBot Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share
15集单集
所有剧集
×T
The Incident Response Podcast

Recorded June 2020 TOPIC: Fileless Malware, we think NOT OUR SPONSORS: OUR GUESTS WILL BE: Tyler Hudak - Practice Lead, Incident Response - TrustedSec @secshoggoth www.trustedsec.com Martin Brough - Cybersecurity Expert for Acronis @TheHackerNinja Website - infosec512.com Upcoming Training: SANS DFIR Summit - Running Processes, the Red Team and Bad Actors are using them July 17-18 Article in eForensics Magazine on ARTHIR covered in Episode 011 Visit the website and register to get the free edition BSides Cleveland - Tyler’s Forensic Analysis Friday June 19th - Tactical WIndows Forensics https://www.bsidescleveland.com/training Will be held and/or released at another event soon Preparing for an Incident - NCC Group webinar.. Free to all July 22nd newsroom.nccgroup.com/events Job Opp: NCC Group has a position, remote, Incident Response engineer, with AWS, GCP, Azure experience. You get to work with ME. https://nccgroup.wd3.myworkdayjobs.com/en-US/NCC_Group/job/Manchester/Senior-Cyber-Incident-Response_R2595 NEWS-WORTHY: Cylance blocks LOG-MD-Premium Running Process check Ticket opened, users must exclude LOG-MD from being checked Windows malware opens RDP ports on PCs for future remote access https://www-zdnet-com.cdn.ampproject.org/c/s/www.zdnet.com/google-amp/article/windows-malware-opens-rdp-ports-on-pcs-for-future-remote-access/ Exploit code for wormable flaw on unpatched Windows devices published online (SMBGhost) - Processing of a malformed compressed message - Eternal Darkness/SMBGhost affects version 3.11 of the protocol, which as ThreatPost points out, is the same version that was targeted by the WannaCry ransomware a couple of years ago The US Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends using a firewall to block SMB ports from the internet and to apply patches to critical- and high-severity vulnerabilities as soon as possible ENABLE THE WINDOWS FIREWALL !!!! BLock SMB to workstations, and you will get better logging too ;-) https://arstechnica.com/information-technology/2020/06/exploiting-wormable-flaw-on-unpatched-windows-devices-is-about-to-get-easier/ Microsoft warns of vulnerabilities in SMBv3 (Eternal Darkness) Microsoft warns of vulnerabilities in SMBv3 Netwalker Fileless Ransomware Injected via Reflective Loading https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ 80% of hacking-related breaches leverage compromised credentials https://securityboulevard.com/2020/06/80-of-hacking-related-breaches-leverage-compromised-credentials/ SITE-WORTHY: THE IR Crew MITRE ATTACK https://attack.mitre.org/ Guest - Tyler https://www.incidentresponse.com/playbooks/ Guest - Martin Sandbox - https://app.any.run TOOL-WORTHY: The IR crew LOG-MD-Professional Volatility Guest 1 - Tyler MFTECmd https://github.com/EricZimmerman/MFTECmd/releases KAPE, or rawcopy, or other tools to capture MFT before processing Guest 2 - Martin NetworkMiner https://www.netresec.com/?page=NetworkMiner MALWARE OF THE MONTH: Dridex fileless malware: Key Detection points Well… in memory only “fileless” Rundll32 calling malicious DLL Parent Child relationship Rundll32.exe calling SysWow64\Rundll32.exe PREVENTION Scan email attachments Block Macro execution Block uncategorized websites Application Whitelist Users directory Lock down PowerShell EDR TOPIC OF THE DAY: Fileless Malware, we don’t think so What is “Fileless Malware”? Cyberreason - Unlike file-based attacks, fileless malware does not leverage traditional executable files. Fileless attacks abuse tools built-in to the operating system to carry out attacks. Essentially, Windows is turned against itself. Without an executable, there is no signature for antivirus software to detect. This is part of what makes fileless attacks so dangerous - they are able to easily evade antivirus products. McAfee - Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect and remove. CarbonBlack - Fileless malware refers to a cyberattack technique that uses existing software, allowed applications, and authorized protocols to carry out malicious activities. WikiPedia - Fileless malware is a variant of computer related malicious software that exists exclusively as a computer memory-based artifact i.e. in RAM. It does not write any part of its activity to the computer's hard drive meaning that it's very resistant to existing Anti-computer forensic strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern-analysis, time-stamping, etc., and leaves very little by way of evidence that could be used by digital forensic investigators to identify illegitimate activity. As malware of this type is designed to work in-memory, its longevity on the system exists only until the system is rebooted. MGs definition So what do WE think Fileless Malware is? The IR crew Tyler Martin A better way to define Fileless Malware and WHY Memware Regware WMIware PowerShellware Wormware LolBin/LolBasware And malware .NETware compile on the fly (compileware) bootware How does this change our evaluation of malware? How does this change our IR or THreat Hunting process? How does this change how we detect and alert on malware? Final thoughts Other Articles: ------------------- Cybereason - FILELESS MALWARE 101: UNDERSTANDING NON-MALWARE ATTACKS https://www.cybereason.com/blog/fileless-malware McAfee - What Is Fileless Malware? https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-fileless-malware.html…
T
The Incident Response Podcast

Recorded May 2020 TOPIC: Getting back to basics, IR 101 OUR SPONSORS: NEWS-WORTHY: Best EDR Security Services In 2020 for Endpoint Protection https://www.softwaretestinghelp.com/edr-security-services/ How to Avoid Spam—Using Disposable Contact Information https://www.wired.com/story/avoid-spam-disposable-email-burner-phone-number/ Shiny new Azure login attracts shiny new phishing attacks https://nakedsecurity.sophos.com/2020/05/18/shiny-new-azure-login-attracts-shiny-new-phishing-attacks/ Upgrading from EDR to MDR is Critical but Easier than You Think https://securityboulevard.com/2020/05/upgrading-from-edr-to-mdr-is-critical-but-easier-than-you-think/ The ransomware that attacks you from inside a virtual machine https://nakedsecurity.sophos.com/2020/05/22/the-ransomware-that-attacks-you-from-inside-a-virtual-machine/ SITE-WORTHY: Malware Archaeology - Cheat Sheets https://www.MalwareArchaeology.com/cheat-sheets TOOL-WORTHY: LOG-MD - The Log anD Malicious Discovery tool “LOG-MD -a” will give you how you compare against the cheat sheets https://www.LOG-MD.com MALWARE OF THE MONTH: Qakbot Typical delivery via a Office doc or URL Created a folder in C:\Users Key Detection points Enable better logging AutoRuns - Uses Run key and Scheduled Task WMIPrvSe launch binary in C:\Users Binary in root of \Username directory C:\Users\\.exe C:\Users\\AppData\Roaming\Microsoft\ Syswow64\Explorer.exe used Parent of Explorer.exe is NEVER a binary in C:\Users Process injection of Syswow64\Explorer.exe Ping 127.0.0.1 Scheduled Task created by a binary in C:\Users Syswow64\Explorer,exe opening all the browsers Binary in C:\User calling out to foreign country PREVENTION Block Office macros Don’t allow uncategorized websites EDR Software Whitelisting C:\Users TOPIC OF THE DAY: Getting back to basics, IR 101 What is getting back to basics - IR 101 This will likely be multiple episodes We will start with Windows Why is this important? WHEN you have an incident, data we, and you need will be available This is probably the #1 finding and recommendation we have made to organizations we have been involved with over the years Security tools fail, so other data you collect can help discover what happened where, when, and how What is the problem we are wanting our listeners to solve? To be better prepared in the event of an incident to speed up investigations Give your SOC, IT, or Security people the data they need to investigate events Make log management data better if you are collecting all the things And of course… help your IR Consultancy do a better job FASTER Other Articles: ------------------- CIS Benchmarks https://www.cisecurity.org/cis-benchmarks/ DerbyCon talk on EDR https://www.irongeek.com/i.php?page=videos/derbycon7/t416-edr-etdr-next-gen-av-is-all-the-rage-so-why-am-i-enraged-michael-gough DerbyCon talk on Winnti https://www.irongeek.com/i.php?page=videos/derbycon5/teach-me01-a-deep-look-into-a-chinese-advanced-attack-understand-it-learn-from-it-and-how-to-detect-and-defend-against-attacks-like-this-michael-gough…
T
The Incident Response Podcast

Formerly the Brakeing Down Incident Response Podcast Recorded Oct 2019 TOPIC: Laughing at Binaries - LOLBin/LOLBas OUR GUEST WILL BE: Oddvar Moe , Sr. Security Consultant TrustedSec - Red Teamer @Oddvarmoe Blog - https://oddvar.moe/ lolbas-project.com https://github.com/api0cradle/UltimateAppLockerByPassList https://github.com/api0cradle/PowerAL OUR SPONSORS: NEWS-WORTHY: Cyber Security Awareness Month Share something that can help SMBs, your family or friends Flaw with SUDO that lets you get admin priv when denied Patch patch patch... Microsoft Enables Tamper Protection by Default for all Windows 10 Users to Defend Against Attacks https://go.newsfusion.com//security/item/1524577 Most Americans do not know what MFA is???? https://securityboulevard.com/2019/10/most-americans-dont-know-what-2fa-is-pew-research-shows/ Hackers bypassing some types of 2FA security FBI warns https://nakedsecurity.sophos.com/2019/10/11/hackers-bypassing-some-types-of-2fa-security-fbi-warns/ SITE-WORTHY: Malware Archaeology Logging tips - List of Binaries to monitor https://www.malwarearchaeology.com/logging Guest - LolBin/LolBas - api0cradle - aka Oddvar Moe https://lolbas-project.github.io/ https://github.com/LOLBAS-Project/LOLBAS https://gtfobins.github.io/ http://www.hexacorn.com/blog/ TOOL-WORTHY: HUMIO - Free 2GB/day 7 day retention https://www.Humio.com Guest: https://github.com/PowerShellMafia/CimSweep - Matt Graeber – Agentless using CIM/WMI http://nirsoft.net/ (DLL Export viewer, Reg DLL View, Password recovery, network tools +++) Get injected-thread by Jared Atkinson - https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2 https://github.com/Neo23x0/sigma - Standardized ruleset for SIEMs MALWARE OF THE MONTH: New Dridex version Delivered via Office document or Email with URL wscript/csript downloads bad binary named Chrome.exe Calls Scheduled task for persistence Chrome calls msra.exe for comms C:\Windows\syswow64\Msra.exe chrome.exe So another LOLBin ? This is what prompted this podcast TOPIC OF THE DAY: Laughing at Binaries - LOLBin/LOLBas What is a LOLBin and LOLBas? It stands for Living off the Land Binary and Scripts Libraries too, Dlls What started all this? @SubTee Casey Smith efforts on Application Whitelisting bypasses from 2015 ish where he found ways to use existing binaries on the system to do bad things like RegSvr32, RegAsm, RunDll32, and several others Why are these an issue for us Defenders? Well Pentesters and Red Teams use them to get around security solutions like AV, EDR and App Whitelisting Do these normally execute? If so how noisy are they? Some are noisy What do we need to watch out for? Command line parameters are key What is are the parameters they are executing with these utilities Are there any lists people can use? Malware Archaeology Logging page has a list and link to Oddvar’s page What about security solutions, do we need to be concerned with these? Yes, many AV and EDRs will not have alerts for these items You will need to build some alerts and filter out the good/noise What about logging theme? Use the list(s) and build a lookup list that you can add to 4688 events or Sysmon 1 and 7 events and monitor them What about MITRE ATT&CK, do they reference these? Yes, there are several of these mentioned in MITRE ATT&CK, so map your tools to ATT&CK Techniques Are there ways to test for these LOLs What else do people need to watch out for? Other Articles: ------------------- Casey Smith @SubTee - Red Canary Bypassing Application Whitelisting SHMOOCon 2015 - https://youtu.be/XVuboBH5TYo SANS https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1524509113.pdf DerbyCon 2016 - http://www.irongeek.com/i.php?page=videos/derbycon6/522-establishing-a-foothold-with-javascript-casey-smith DerbyCon 2019 - http://www.irongeek.com/i.php?page=videos/derbycon9/stable-28-net-manifesto-win-friends-and-influence-the-loader-casey-smith Oddvar Moe talk on LOLBin at DerbyCon 2018 https://www.youtube.com/watch?v=NiYTdmZ8GR4 Alternate Data Streams: https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f…
T
The Incident Response Podcast

www.LOG-MD.com/podcasts
Newsworthy Items: • INSURANCE COMPANY REFUSES TO PAY NOTPETRYA BILL, SAYS IT WAS AN ACT OF WAR, COMPANY SUES FOR $100M • 2-FACTOR AUTH BYPASSED ??? • 773 MILLLLLION PASSWORDS CIRCULATING THE INTERNET FROM PAST BREACHES • BYPASS BLACKLISTED WORDS FILTER (OR FIREWALLS) VIA WILDCARDS Malware of the month - First Sednit UEFI Rootkit Unveiled Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share…
T
The Incident Response Podcast

Newsworthy Items: Over 1 BILLION Pwned Dell Breach Marriott/Starwood Breach Malware of the month - LOKIBot Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share
Newsworthy Items: 1. NSS Labs fires off anti-malware-testing lawsuit at infosec toolmakers 2. Gartner says EDR will be a 1.5 BILLION, with a B business by 2020 3. Forrester Report on is EDR overblown
Newsworthy Items: ----------------------- After Sept 21st Credit Freezes are FREEEEEE - Article - by Krebs "Do you use a Tumi bag? Registered it with Tumi's Tracer service? British airways website hacked 380K users affected How Hackers Slipped by British Airways' Defenses - Wired Hackers Can Steal a Tesla Model S in Seconds by Cloning Its Key Fob - WIRED Exploit vendor drops Tor Browser zero-day on Twitter - zdnet Bad Actors Sizing Up Systems Via Lightweight Recon Malware Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share Malware of the month - EMOTET…
Newsworthy Items: The most expensive Cyber attack EVER !!! (wired) City of Atlanta 17 million ransom attack APT32 proves what we say about logging - Monitor Scheduled Tasks Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share…
Newsworthy Items - New Sysmon and Autoruns versions released. Be careful of VirusTotal uploads Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share
Newsworthy Items - The FBI asks us to reboot our routers Malware of the month - None, so send us something interesting... Site-worthy - websites of the trade to share Tool-worthy - some tools of the trade to share
News-Worthy Site-Worthy Tool-Worthy
News-Worthy Site-Worthy Tool-Worthy
News-Worthy Site-Worthy Tool-Worthy
"Incident Response, Malware Discovery, and Basic Malware Analysis, Detection and Response, Active Defense, Threat Hunting, and where does it fit within DFIR"
欢迎使用Player FM
Player FM正在网上搜索高质量的播客,以便您现在享受。它是最好的播客应用程序,适用于安卓、iPhone和网络。注册以跨设备同步订阅。