Attack Surface Analyzer

Attack Surface Analyzer is a Microsoft developed open source security tool that analyzes the attack surface of a target system and reports on potential security vulnerabilities introduced during the installation of software or system misconfiguration:

— https://github.com/microsoft/AttackSurfaceAnalyzer

Good News and New Changes in Sys-Admin Open BLD ecosystem

99.9% uptime - https://lab.sys-adm.in

New security concepts
- Security - Open BLD ecosystem fundamentally changed preventing/attacking mitigation mechanisms, now Sys-Admin Open BLD infrastructire has centralized automated hacking IP mitigation system
- Updates - With open Sys-Admin activitieas now we are have two new instruments which can change security protection prism whis based on open source tools/instruments: ip2drop 🧘, cactusd 🌵
- Speed - Extremely improved speed (🏎 faster than IBM Quad9)

Results
- Open BLD ecosystem servers partially migrated from fail2ban to ip2drop
- All servers has new firewall settings and improvements (like as ipset)

Enjoy this - https://lab.sys-adm.in

Free Elastic training

Observability with ELK with practice:

— https://www.elastic.co/training/free

Sandbox Escape in vm2@3.9.16. PoC.

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context.

https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

Credits: https://github.com/advisories/GHSA-7jxr-cg7f-gpgv

Get started using Attack simulation training

If your organization has Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, which includes Threat Investigation and Response capabilities, you can use Attack simulation training in the Microsoft 365:

— More details…

Just put it here.. - https://github.com/fin3ss3g0d/evilgophish

Designing and Developing Modern Applications

free Zoom Conference. I known personally some participiants from speakers, so shoult be interecting, maybe:

— https://akvelon.global/devday2023/

EDR Telemetry

This repo provides a list of telemetry features from EDR products and other endpoint agents such as Sysmon broken down by category. The main motivation behind this project is to enable security practitioners to compare and evaluate the telemetry potential from those tools while encouraging EDR vendors to be more transparent about the telemetry features they do provide to their users and customers:

— https://github.com/tsale/EDR-Telemetry

Discord DLL hijacking / Automation via Excel Macros

— https://github.com/MitchHS/Discord-DLL-Hijacking

Massive Abuse of Abandoned Eval PHP WordPress Plugin

https://blog.sucuri.net/2023/04/massive-abuse-of-abandoned-evalphp-wordpress-plugin.html

LOOBins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes:

— https://github.com/infosecB/LOOBins

Mihari is a tool for OSINT based threat hunting

— https://github.com/ninoseki/mihari

APT Simulator

APT Simulator is a Windows Batch noscript that uses a set of tools and output files to make a system look as if it was compromised. In contrast to other adversary simulation tools, APT Simulator is designed to make the application as simple as possible..:

— https://github.com/NextronSystems/APTSimulator

#tool #review

/ Free Copilot analog from Amazon

https://aws.amazon.com/codewhisperer/

New side-channel attack to Intel CPU report

Abstract—The transient execution attack is a type of attack leveraging the vulnerability of modern CPU optimization technologies. New attacks surface rapidly. The side-channel is a key part of transient execution attacks to leak data

Kubernetes Goat

The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security:

— https://github.com/madhuakula/kubernetes-goat

Subdomain enumeration with Subxenum Python tool

— https://github.com/Adkali/Subxenum

Attack Campaign that Uses Fake Google Chrome Error to Distribute Malware from Compromised Websites

Research:

— https://insight-jp.nttsecurity.com/post/102icvb/attack-campaign-that-uses-fake-google-chrome-error-to-distribute-malware-from-com