Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research! https://xitter.cf/t.co/j62Xx21lEc
Datastore
Joined September 2019
- Tweets66
- Following5
- Followers2.1K
- Likes98
Security Datasets retweeted
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
Security Datasets retweeted
๐จ We decided to re-brand Mordor to @SecDatasets ๐ Weโll cover new types of datasets to extend its application ๐ more coming soon.. ๐ป
Help us build the largest library of datasets for the InfoSec community! ๐
Site: securitydatasets.com/introduโฆโฆ
Repo: github.com/OTRF/Security-Datโฆ
Security Datasets retweeted
Importance of data sets for SecOps research and rule testing with projects by @SBousseaden, @Mordor_Project, @Cyb3rWard0g's SimuLand
Security Datasets retweeted
๐จ In less than 24h ๐, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone ๐ expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike
๐๏ธMetadata: mordordatasets.com/notebooksโฆ
๐Dataset: raw.githubusercontent.com/OTโฆ
APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with
- NamedPipe Creation
- Service installation & exec pattern
- HTTP beaconing
github.com/NextronSystems/APโฆ
If you want to help, add some steps in here:
github.com/NextronSystems/APโฆ
Security Datasets retweeted
It's time to go to SimuLand! ๐ ๐ก๐ข
But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses.
Get the details: msft.it/6017VxcHv
Security Datasets retweeted
Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g ๐ป๐
mordordatasets.com/notebooksโฆ
1โฃ A few tool-based comments at the host level
2โฃ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
New version of #AADInternals out now, including remote dumping of #ADFS configuration database๐ฅ
Read the blog at: o365blog.com/post/adfs/
Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!
Security Datasets retweeted
Big news ya'll: @Cyb3rWard0g will be hosting our next Atomic Friday on December 11! Join us for a deep dive into @Mordor_Project and learn strategies for expediting data analysis. bit.ly/33AKlil
Security Datasets retweeted
Don`t Forget to checkout Project SimuLand for
โ๏ธCloud Datasets
mordordatasets.com/notebooksโฆ
Security Datasets retweeted
So cool to see this! ๐
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below ๐ Thank you @jxy__s !
๐ mordordatasets.com/notebooksโฆ
Security Datasets retweeted
HOW to contribute a @Mordor_Project dataset in 2 mins โณw/ the help of @redcanary ART & then contribute to @sigma_hq after exploring the data! @OTR_Community
โป๏ธ Clear, Exec & Collect: youtu.be/6iteEfbuwU8
๐ Data: mordordatasets.com/notebooksโฆ
๐น Rule: github.com/OTRF/sigma/blob/mโฆ
Security Datasets retweeted
Check out mordordatasets.com/notebooksโฆ and threathunterplaybook.com/notโฆ - Mordor Dataset and Playbook entry for wuauclt.exe abuse with many thanks to @Cyb3rWard0g ๐ค for his epic work as ever! Will be updating blog with these links too for reference ๐ช
I found an interesting #LOLBIN using Windows Update Client (wuauclt.exe) as a loader - blog, pull request to LOLBAS and in the wild sample here dtm.uk/wuauclt/ - I am hoping to finalise some of my work on the methodology I used soon @MDSecLabs so keep your eyes posted.
Security Datasets retweeted
Since I last discussed @brimsecurity use with @Cyb3rWard0g & @Cyb3rPandaH's Mordor APT29 datasets in #toolsmith 144, @OliverRochford has been hard at work for Brim, exploring further & documenting his practice well. Check out medium.com/brim-securitys-knโฆ & the prior post. Great work!
Security Datasets retweeted
#Day3 #100DaysOfBlueTeam Today I learned a few things about some open source projects. I must admit I was not expecting the music theme for the example of @Mordor_Project ๐คฃ youtu.be/kBe6-D1_ais
Security Datasets retweeted
Always a pleasure to collaborate with you @domchell ! ๐Sharing @Mordor_Project datasets, @HunterPlaybook #Jupyter notebooks and detection rules in @sigma_hq format should be the new standard in the Infosec community when sharing offensive research ๐ @OTR_Community ๐ป
Security Datasets retweeted
Gracias familia @ekoparty @BlueSpaceSec ! ๐
A @Cyb3rPandaH y a mรญ nos gustรณ el haber compartido todo en espaรฑol ๐ต๐ช๐ฆ๐ท ๐! @OTR_Community
๐ป BlueSpace Keynote: github.com/OTRF/Community-Prโฆ
๐ Mordor: github.com/OTRF/Community-Prโฆ
๐ Jupyter + ๐ผ Pandas Workshop: github.com/OTRF/workshop-ekoโฆ
Security Datasets retweeted
๐ข@Cyb3rWard0g y @Cyb3rPandaH estรกn haciendo un live Q&A๐ข
ยกVengan al channel bluespace-voice para charlar y hacerles preguntas! ๐ฑ
Security Datasets retweeted
Si te quedaste con ganas de mรกs, @Cyb3rPandaH y @Cyb3rWard0g nos traen ๐ฐ๐๐๐๐๐๐๐ ๐ ๐ธ๐๐๐๐๐ ๐ฐ๐๏ธ -
๐ฎ๐๐๐๐๐๐๐๐๐๐๐ ๐๐๐๐๐ ๐๐๐๐ ๐๐ ๐๐๐๐๐๐๐๐๐๐๐รณ๐ ๐๐ ๐๐๐๐๐๐๐๐ ๐๐๐ ๐๐ ๐๐๐๐๐๐๐๐๐ ๐ฅ๐ฅ
Te animรกs? โ๏ธ๐ก๏ธ#Ekoparty #pwndemic
Security Datasets retweeted
Thank you for sharing @castello_johnny ๐ป! Very happy to see @Mordor_Project datasets being used as testing data for some of the queries ๐ฑ๐ฅ
KQL Blog post: kustoking.com/sql-to-kql-funโฆ
Python Pandas Notebook: infosecjupyterbook.com/use-cโฆ
It's almost a year that I've been using @Microsoft #AzureSentinel and #Kusto at @wortell so the beginning of #MSIgnite is a good moment to start sharing.
So here is the Royal Announcement, my new blog is live at kustoking.com
Security Datasets retweeted
The "noise" can change depending on how the shellcode is copied over (i.e. one byte at the time vs chunks & the APIs being used). The proof of concept focuses on ExecuteExcel4Macro method with APIs such as VirtualAlloc, RtlMoveMemory & QueueUserAPC
gist.githubusercontent.com/Cโฆ
Security Datasets retweeted
๐จ๐ขSรณlo keynotes del #EkoBlueSpace no era suficiente. Esta @ekoparty @Cyb3rPandaH y @Cyb3rWard0g tambiรฉn presentan Mordor Datasetsโผ๏ธ ๐ฅณ
๐จ๐ข#EkoBlueSpace Keynotes wasnโt enough. @Cyb3rPandaH & @Cyb3rWard0g will be introducing Mordor Datasets tooโผ๏ธ ๐ฅณ
#ekoparty #pwndemic
ALT Entrando a Mordor - Compartiendo datos para la investigaciรณn de amenazas con la comunidad