Detecting a Red Team (and Threat Actor) Favorite — Introduction and Objectives In this article we’ll take on the mighty Impacket, an open-source Python library for conducting network-based attacks. This is not some obscure, boutique offensive tool; as the folks at RedCanary showed in their wonderful 2023 Threat Detection Report, Impacket was the second most prevalent threat that they observed last year…

I opened a dozen malicious OneNote files and clicked on every link so you don’t have to — Introduction/Objectives Early in 2023, I started hearing about a new (to me, anyway) type of malware delivery — .one files opened using Microsoft OneNote: As tweets like the one above gradually seeped into my consciousness, I decided to learn more, as I am always curious to know about new techniques…

Introduction In this article I’ll delve into HTML smuggling detection, following the detection engineering process I’ve described over my last two posts. This process includes research, testing, and development of new detection concepts. Unlike my previous posts however, this time we’ll be observing, profiling, and detecting real QakBot malware in the…

Introduction In my last post I shared a straightforward process that I use to sharpen my detection engineering skills using threat intel reports as an inspiration and starting point for researching and detecting real-world attacker techniques. Since then, I’ve heard from several people within and outside of my organization who are…

Introduction In this article, I’ll discuss the importance of a repeatable, easy-to-follow process for detection engineering, and give an example walkthrough of my process based on a recent alert from the Cybersecurity and Infrastructure Security Administration (CISA) regarding Hive ransomware group. This is intended for folks who are fairly new to…

A few months ago I decided to check and see whether there was a Sigma backend for InsightIDR, the cloud-based SIEM from Rapid7. Imagine my shock (😱) when I discovered that none existed! There are Sigma backends for more than a dozen SIEM platforms, including plenty I’d never heard of…

I recently sat down to think and write about a common stereotype in the security industry — that of the “basement hacker.” You know, the kind that pops up when you Google image search the term “hacker.” As defenders, we spend so much time thinking about how to counter threat actors, but relatively little time thinking or learn about who they actually are. In my article, “Why the ‘Basement Hacker’ Stereotype Is Wrong — and Dangerous” I explore this stereotype, and argue that it is outdated and inaccurate. I also examine the negative impacts of this stereotype, ways to counter it, and propose topics for further research to improve our understanding of our adversaries.

The following is a new analyst’s perspective on the well-trodden concept of alert fatigue in cybersecurity. I chose this topic because I noticed a lack of content written about this phenomenon without the usual “the system is broken, and only I know how to fix it!” subtext. Also, of the…

There’s a lot of emerging interest in professional certification within the GIS industry, and they are tightly integrated with the professional standards of the cybersecurity industry (where I am attempting to expand my skills). Now that I have some exposure to the culture of professional certification across these two highly-technical…