Offensive Security | Defensive Security | Networking
255.255.255.255
Joined September 2022
- Tweets504
- Following264
- Followers168
- Likes1.1K
I thought IOC analysis was mostly about collecting indicators.
This lab changed that.
I investigated a simulated threat actor campaign and started asking:
- Why these domains?
- Why this infrastructure?
- What does the pattern tell us about the actor?
@_DeejustDee
4️⃣ It is about understanding the evidence, the gaps, and how confident you should actually be.
Check the full investigation + evidence breakdown:
github.com/Fabelt14/Cybersec…
12
3️⃣ I then correlated the infrastructure with malware metadata, persistence mechanisms, TTPs, victimology and operational timing.
The combined evidence supported an APT28 attribution hypothesis at Medium Confidence.
But attribution is not just about finding a name.
24
2️⃣ The naming also appeared designed to blend malicious traffic into legitimate enterprise activity.
The IOC was no longer just an indicator. It was a clue to the actor's decisions.
9
That is where the investigation got interesting.
The domains used names like:
update, verify, check and secure
At first, they looked ordinary.
But several domains shared infrastructure characteristics, including nameservers and C2 IPs.
11
Learning SOC analysis gives you a different perspective on how attackers think.
That's an advantage when you get into ethical hacking.
Because why u go route traffic to "system-update,org"?
What do you want the SOC analyst to think?
“Oh, just another system update” 😂
Threat actor profiling helps organizations prioritize security spending based on the capabilities of the adversaries they actually face.
Defending against APTs may justify investments in advanced EDR solutions while stopping script kiddies might require basic security.
#cyber
1
5
216
People do not decide their futures, they decide their habits and their habits decide their futures.
- F. M. Alexander
2
88
Threat actor profiling helps organizations prioritize security spending based on the capabilities of the adversaries they actually face.
Defending against APTs may justify investments in advanced EDR solutions while stopping script kiddies might require basic security.
#cyber
Pɍịmẹ̄ ⚡♟️ retweeted
Grace Beyond Her Bandwidth because God is in her Story!!! ❤️
This new age is to do great exploit. 🥂🎂
This week has been really rough for me, I won't lie. But completing this lab made my day.
All these challenges sef made it worse, but as Richard Templar said:
Life is a pizza.
You can't separate what you like from what you don't like, you just have to eat it like that.
3
94
Pɍịmẹ̄ ⚡♟️ retweeted
I finally put together the exact structure I use for my cybersecurity projects on GitHub.
Not saying it’s perfect.
It’s simply what works for me.
So steal whatever is useful, adapt it to your own projects, and make yours even better than mine.
I swear to God
@cardtonic i go carry una for mind cuz those cybersecurity questions are not fundamental
1
1
77
