Amateur Security Archaeologists, trying not to break things.
Good morning folks! I have a lot of updates on the threat side of things, some talk of elections & AI, and more that we all should be aware of:
Cisco’s Talos just released an awesome 2023 Year In Review that helps break down the trends and strains that kept them up late at night changed the threat landscape. Of note?
Continue reading
Good morning folks! I know I slacked off last week, but I finally have some updates on the threat side of things that we all should be aware of:
Continue readingAs we saw in our last post, Threat Intelligence is a huge focus. But what good does intelligence do if we never act on it? If your organization is leveraging a SIEM or XDR, or using tools that allow for custom detection content to be added, then you use detection and analytics. ATT&CK includes data on detection and mitigation techniques, which presents you with sound guidance on where to start detecting each technique’s use in your environments. These underappreciated features of the ATT&CK database are fantastic in guiding all manner of blue team operators, and they provide a jump start to achieving greater security. Detection (or what they now call Data sources) and Mitigations give us homework. Before we can act, we must see – so let’s see how ATT&CK can help with Detection.
Continue reading
Good morning folks! I have some updates on the threat side of things that I think are interesting and might help in conversations with your friends and colleagues.
Cisco Talos has updated their blog on the IOS-XE implant that caused a ruckus a couple of weeks ago. They now know it is still progressing, and the Lua-based implant is called BadCandy and already at version 3.0. Some of us would kill for that sort of release cycle! As before, fixed code is available for all impacted devices, but if you are struggling to make the upgrade happen, new curl commands are available to check for compromise.
Continue readingAs you saw in the previous post, ATT&CK is loaded with potential to hit a lot of use cases. Most CTI organizations are at least considering the use of ATT&CK to structure their reports and feeds. It provides analysts with a common language and structure. ATT&CK fosters better collaboration and easier consumption of the findings for all, including you and your tools.
Mike© 2025 Raiders of the Lost ARP
Theme by Anders Noren — Up ↑
