AWS IAM explained for RedTeam & BlueTeam

https://infosecwriteups.com/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7

#aws #iam #redteam #blueteam

Suspicious Named Pipe Events

https://medium.com/falconforce/falconfriday-suspicious-named-pipe-events-0xff1b-fe475d7ebd8

#windows #pipe #events #blueteam #redteam

Active Directory ACL Visualizer and Explorer

adalanche tool gives instant results, showing you what permissions users and groups have in an Active Directory. It is useful for visualizing and exploring who can take over accounts, machines or the entire domain, and can be used to find and show misconfigurations.

https://github.com/lkarlslund/adalanche

#ad #acl #visualizer #blueteam #redteam

Active Directory Checklist — Attack & Defense Cheatsheet

https://cybersecuritynews.com/active-directory-checklist/

#ad #cheatsheet #redteam #blueteam

Cobalt Strike, a Defender’s Guide

In this research, exposes adversarial Tactics, Techniques and Procedures (TTPs) as well as the tools use to execute mission objectives. In most of cases, the threat actors utilizing Cobalt Strike. Therefore, defenders should know how to detect Cobalt Strike in various stages of its execution. The primary purpose of this articles is to expose the most common techniques from the intrusions track and provide detections. Having said that, not all of Cobalt Strike’s features will be discussed.

# https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
# https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/

#cobaltstrike #research #blueteam

Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign

StellarParticle, an adversary campaign associated with COZY BEAR, was active throughout 2021 leveraging novel tactics and techniques in supply chain attacks observed by CrowdStrike incident responders

https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/

#threatintel #dfir #blueteam #malware

SysWhispers is dead, long live SysWhispers!

In a journey around the fantastic tool SysWhispers, cover some of the strategies that can be adopted to detect it, both statically and dynamically.

https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/

#edr #evasion #syscall #redteam #blueteam

Windows Security Log Quick Reference Cheat Sheet

#windows #security #log #blueteam

Container Security Checklist

Checklist for container security devsecops practices

https://github.com/krol3/container-security-checklist

#kubernetes #docker #security #cheatsheet #blueteam

ntTraceControl — Powershell Event Tracing Toolbox

Want to simulate any ETW logs using powershell, even the security one?
Do you want to import any evtx files into the current eventlog session?

ntTraceControl is a set of Powershell commands to forge/generate Windows logs. Simply put, ntTraceControl supports Detection teams by simplifying the testing of detection use cases and alerts without using complex infrastructure, tools, or the testing of vulnerabilities.

https://github.com/airbus-cert/ntTraceControl

#etw #simulate #powershell #redteam #blueteam