| DATE |
|
NAME |
INFO |
CATEGORIE |
WEB |
|
13.10.26 |
 |
Auditing
the auditor: Unmasking Apex Accelerator |
REF8801 exposes how Apex Accelerator combines convincing Web3 services with
malicious npm packages, attacker-controlled AI infrastructure, and cross-platform
malware delivery.Elastic Security Labs identified a malicious npm package,
@apexacc/cli, which led us to an operation posing as a Web3 accelerator. |
Security |
Elastic Security Labs |
|
10.10.26 |
|
More RMM Tools In the Wild |
It seems that a trend started… I continue my
journey discovering more RMM ("Remote Management & Monitoring") tools abused by
threat actors! A few days ago, I wrote a diary[1]
about ScreenConnect used in the wild. Today, I found another one. |
Security |
SANS |
|
6.10.26 |
|
User Agent Strings Curiosities |
Sometimes I have to smile, or my interest is triggered, when I
review new User Agent Strings in the honeypot logs. |
Security |
SANS |
|
6.10.26 |
|
TTY Logs and the Data it Captures |
For an experiment, I created a script [1]
that parses and send the TTY logs collected from actors or bots activity that
run various commands after they successfully login the DShield sensor. Those TTY
logs are sent daily at the end of each day to the DShield SIEM [2]
to be correlated with all the data. |
Security |
SANS |
|
21.9.26 |
|
One SOC, 100 projects: running centralized alert triage
on Elastic Security Serverless |
We linked one
Elastic Security project to 100 others and ran the full prebuilt detection
catalog from the origin, with all the ingest landing in the linked projects. It
held up, and where it deliberately does not reach is the interesting part.
|
Security |
ELASTIC |
|
17.9.26 |
|
Scans Targeting Hospitality Applications |
Earlier today, I noted an odd request showing
up in our "First Seen" report.. |
Security |
SANS |
|
3.9.26 |
|
Honeypot-Omaha and batch.py [Guest Diary] |
Honeypot-Omaha is a DShied
Sensor located at the Internet Storm Center (ISC) that is set up as a decoy for
the original target and deployed over the internet. It is a flawed and very
vulnerable system that was intentionally designed to attract threat actors with
malicious intents. I view it as a massive log aggregator that collects data that
an analyst like myself can then analyse, hypothesize, synthesize and then
generate a cohesive and coherent report. |
Security |
SANS |
|
28.8.26 |
|
Who Has Admin Rights in your Entra ID Directory? |
A common thing that folks
should "worry" about in Entra (or any platform really) is "who has
rights to administer"? Who can delete or change key things, or modify
them in ways that might not be obvious (accidentally or on purpose). Yes,
we trust our people, but if they've moved on to other roles or to other
organizations, they change from "our people" to "used to be our people". |
Security |
SANS |
|
21.8.26 |
|
Even MOAR Powershell, looking at Entra logins - the good, the bad and the
password sprays |
One thing that folks never seem to do after "going to the
CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily
when things were on premise. |
Security |
SANS |
|
21.8.26 |
|
Who Got Missed in the MFA Rollout? More Powershell + Graph + Entra scripting! |
In
every MFA rollout, there will come a time where you think you are closing in on
"done", and some automation to list what's left would be handy. Something
quicker than scrolling through the web interface through thousands of accounts
... |
Security |
SANS |
| |
|
|
|
|
|