@OSSEM_Project

Open Source Security Event Metadata ! Data engineers! #ThreatHunting @OTR_Community

 https://ossemproject.com/intro
github.com/OTRF/OSSEM
Joined September 2019
  • Tweets31
  • Following7
  • Followers1.5K
4Media
Replying to @olafhartong @MITREattack @FDezeure @redcanary @mvelazco
Thank you so much for sharing the @OSSEM_Project Detection Model 🙏 and all your contributions to it! Very happy to see the project helping others in the community 🌎🎊 github.com/OTRF/OSSEM-DM/tre…
3
7
Replying to @OSSEM_Project @Cyb3rPandaH
Will be coming on Windows soon ;)
2
3
4
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
6
142
22
315
🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻 Help us build the largest library of datasets for the InfoSec community! 🚀 Site: securitydatasets.com/introdu…… Repo: github.com/OTRF/Security-Dat…

GitHub - OTRF/Security-Datasets: Re-play Security Events

Re-play Security Events. Contribute to OTRF/Security-Datasets development by creating an account on GitHub.

github.com
1
52
2
107
🚨 New version of the Windows Security Events connector from #AzureSentinel reached public preview Looking for a way to test & filter the collection of event logs via XPath queries? I got you! 💜🍻 @MSThreatProtect #MSTIC @OTR_Community @OSSEM_Project techcommunity.microsoft.com/…
5
33
5
115
🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 🗒️Metadata: mordordatasets.com/notebooks… 😈Dataset: raw.githubusercontent.com/OT…
Florian Roth ⚡️
@cyb3rops11 Jun 2021
APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with - NamedPipe Creation - Service installation & exec pattern - HTTP beaconing github.com/NextronSystems/AP… If you want to help, add some steps in here: github.com/NextronSystems/AP…
79
2
186
Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community 1⃣ Creation: mordordatasets.com/notebooks… 2⃣ Update: mordordatasets.com/notebooks… @HunterPlaybook Library Doc: github.com/OTRF/ThreatHunter…
John Lambert
@JohnLaTwC18 Dec 2020
microsoft.com/security/blog/…
28
91
💥😱 @tiraniddo added "named pipe RPC client transport" to NtObjectManager 🔥 Thank you very much James for all your work 👏! I'll create PS scripts to cover a few scenarios 🍻 (Img 4) If anyone would like to help me, let me know 😉 @OTR_Community github.com/Cyb3rWard0g/WinRp…
2
46
2
133
Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜
Red Canary, a Zscaler company
@redcanary15 Dec 2020
THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! bit.ly/33AKlil
4
8
#Eko2020 | @BlueSpaceSec | Roberto y Jose Luis Rodriguez: Open Threat Research (Keynote) "Open Threat Research: Compartiendo herramientas Open Source con el mundo para el desarrollo de detecciones desde casa", una charla de @Cyb3rWard0g y @Cyb3rPandaH. youtube.com/watch?v=6-UVaP_0…
9
1
14
🚨 New version of our "attackcti" Python 🐍 library to query @MITREattack in STIX format via their public TAXII server has been released! 1⃣ ICS ATT&CK Integration ✅ 2⃣ Basic Notebook to explore ICS Content ✅ 📔 Binder: mybinder.org/v2/gh/OTRF/ATTA… 📦Repo: github.com/OTRF/ATTACK-Pytho…
28
1
78
In their #THIRSummit talk, @Cyb3rPandaH & @jamieantisocial illustrates how we can avoid the typical cat and mouse games by modeling the data sources defined in ATT&CK to recognize, track, and even predict the malicious scent of adversaries. Watch it now: youtu.be/eKeydMrXsOE
6
1
18
Thank you @jaredhaight 😊🙏 With the latest updates to @MITREattack data sources by @Cyb3rPandaH , we are translating that doc to YAML files to create additional documentation and hopefully get contributions from the InfoSec Community 😊 github.com/OTRF/OSSEM-DM/tre…
This Post is from an account that no longer exists. Learn more
12
54
Coinciding with @jamieantisocial's and his #ThreatHuntingSummit talk, we've just released part 1 of a blog series by ATT&CK team member @Cyb3rPandaH on a proposed method of enhancing an often overlooked part of ATT&CK, data sources. Check it out at medium.com/mitre-attack/defi….
3
65
7
108
If you are a student or new to the InfoSec community and would like to attend the #ThreatHuntingSummit 2020 @sansforensics virtually😃, fill out this form by 3 pm (EST) today to win a guest pass (Only one available) Thank you @Cyb3rPandaH 🙏💜 bit.ly/THS20GuestPass
3
24
52
Replying to @Cyb3rPandaH @Cyb3rWard0g @MITREattack @OSSEM_Project @ProjectJupyter
Recipe 🗒️ 1. Query Windows techniques (attackcti -> @MITREattack TAXII server) 2. ⬇️ & Parse @OSSEM_Project att&ck DS yaml 3. Join 1⃣ & 2⃣ on data sources 4. Profit 💸💰 (tactic/technique ➡️ security events) 5. Identify opportunities 💜🌎 ONE CLICK: mybinder.org/v2/gh/hunters-f…
1
12
2
36
I'd like to help & adapt! Would u (❤️&💙) join a community driven effort 💜 ⚔️ to: a) Explore known ❤️ tradecraft (Behavior focused) via OffSec Tools b) Validate & contribute detections, datasets & mitigations c) Get together & do a+b when new ❤️ tradecraft is released
94%YES
6%NO
418 votes • Final results
9
26
3
50
Join us tomorrow 10/28 at the 1st @HuntersForge networking event 🍻! Thank you to @corelight_inc @SOC_Prime & @VAEinc for making it possible 🙏. Get to know the community behind @THE_HELK @OSSEM_Project @HunterPlaybook @Mordor_Project & more! Event Info meetup.com/NOVA-Threat-Hunte…
2
10
2
26
Load more