Sources & Methods Newsletter (@srcmtd) profile picture

Sources & Methods Newsletter

@srcmtd

Monthly newsletter for cyber threat intelligence (CTI) information sources, tools, and articles — avatar by smashingstocks

 US
newsletter.sourcesmethods.com
Joined January 2022
  • Tweets148
  • Following105
  • Followers17
1Media
Photo by Sources & Methods Newsletter (@srcmtd)
Happy Holidays! Issue 004 is here 🎁 newsletter.sourcesmethods.co…
1
2
184
Sources & Methods Newsletter retweeted
Tony Lambert (@ForensicITGuy) profile picture
Tony Lambert@ForensicITGuy22 Dec 2022
I'm so proud of things my teammates have published and worked on this year. Stuff like the monthly @redcanary Intel Insights: redcanary.com/blog/intellige…
3
10
49
9,385
Sources & Methods Newsletter retweeted
Alexandre Dulaunoy @adulau@infosec.exchange (@adulau) profile picture
Alexandre Dulaunoy @[email protected]@adulau20 Dec 2022
Maybe something important for your next year calendar, the CTI-summit.org 2023 and hack.lu 2023 will take place in Luxembourg next year from Monday 16th October until Thursday 19th October.
2
33
1
58
11,431
Sources & Methods Newsletter retweeted
Katie Nickels (@likethecoins) profile picture
Katie Nickels@likethecoins20 Dec 2022
This is a very cool process for creating intelligence requirements from the Red Hat infosec team! I'm a big fan of the Venn Diagram approach to explaining threat modeling. (h/t @cocaman) ✍️ Process: github.com/redhat-infosec/pr… 📊 Spreadsheet: docs.google.com/spreadsheets…
Image from Katie Nickels (@likethecoins)
1
46
1
147
16,313
Sources & Methods Newsletter retweeted
SpecterOps (@SpecterOps) profile picture
SpecterOps@SpecterOps21 Dec 2022
ICYMI: @_wald0 dropped a new blog post today: Passwordless Persistence and Privilege Escalation in Azure You can read it here: posts.specterops.io/password…
2
65
2
136
19,457
Sources & Methods Newsletter retweeted
Jon Bateman (@JonKBateman) profile picture
Jon Bateman
@JonKBateman19 Dec 2022
Russian cyber operations in Ukraine: I’ve spent months collating and analyzing data on… » Their military effectiveness » Reasons why they weren’t more impactful » Lessons for other states The result is a very long paper and this 🧵... carnegieendowment.org/2022/1…
Russia’s Wartime Cyber Operations in Ukraine: Military Impacts, Influences, and Implications

Russia’s Wartime Cyber Operations in Ukraine: Military Impacts, Influences, and Implications

Russia’s cyber operations in Ukraine have apparently not had much military impact. This was probably for a multitude of reasons: Russia’s offensive limitations, as well as the defensive efforts of...

carnegieendowment.org
7
228
33
691
226,958
Sources & Methods Newsletter retweeted
Chris Sanders 🔎 🧠 (@chrissanders88) profile picture
Chris Sanders 🔎 🧠
@chrissanders8820 Dec 2022
Investigation Scenario 🔎 A user reported their mouse moving around on the screen by itself for a few minutes. The cursor appeared to open and close a few documents on the desktop. What do you look for to investigate whether an incident has occurred? #InvestigationPath #DFIR
38
30
6
161
62,200
Sources & Methods Newsletter retweeted
MISP (@misp@misp-community.org) (@MISPProject) profile picture
MISP (@[email protected])@MISPProject15 Dec 2022
MISP Training Video December Edition - Best Practices for Encoding Threat Intelligence and Leveraging the information in MISP to Make Threat Landscape Report. #threatintel #threatintelligence #misp #opensource misp-project.org/2022/12/15/…

Training Video - MISP Best Practices for Encoding Threat Intelligence

MISP Threat Intelligence & Sharing

misp-project.org
21
41
Sources & Methods Newsletter retweeted
Julian-Ferdinand (@JulianVoeg) profile picture
Julian-Ferdinand@JulianVoeg15 Dec 2022
We just published our yearly study of malicious #C2 infrastructure identified using proactive scanning and other collection methods throughout 2022. Key findings include:
1
5
26
5,342
Sources & Methods Newsletter retweeted
Josh Smith (@joshjonsmith) profile picture
Josh Smith@joshjonsmith12 Dec 2022
North Korean cyber spies deploy new tactic: tricking foreign experts into writing research for them. With experiences from @DanDePetris & @j3nnyt0wn, and insight from @MsftSecIntel & @BAES_Digital reuters.com/world/asia-pacif…
Insight: North Korean cyber spies deploy new tactic: tricking foreign experts into writing research...

Insight: North Korean cyber spies deploy new tactic: tricking foreign experts into writing research...

When Daniel DePetris, a U.S.-based foreign affairs analyst, received an email in October from the director of the 38 North think-tank commissioning an article, it seemed to be business as usual.

reuters.com
4
63
16
123
Sources & Methods Newsletter retweeted
Team Cymru Research (@teamcymru_S2) profile picture
Team Cymru Research
@teamcymru_S29 Dec 2022
BLOG POST: An update on some of our Iranian #APT tracking, showing continued victim connections to 107.173.231.114 (🇺🇸), a longstanding C2 server. H/T @ChicagoCyber for the course correct on attribution. 🤜🤛 team-cymru.com/post/iranian-…

Iranian Exploitation Activities Continue as of November 2022

Stay informed on the latest cybersecurity threats with Team Cymru's ongoing tracking of Iranian exploitation activities. Discover the latest insights and telemetry data on this ongoing threat and how...

team-cymru.com
6
22
Sources & Methods Newsletter retweeted
Filigran (@FiligranHQ) profile picture
Filigran@FiligranHQ18 Nov 2022
🔔DING! DING!🔔#OpenCTI 5.4.0 is out! Huge joint effort from the #Filigran team and all community contributors 🙏! Bulk search, custom workflow, analyst workbench, performances improvement, #STIX grouping... #CTI #CyberSecurity #ThreatIntelligence ➡️github.com/OpenCTI-Platform/…
Image from Filigran (@FiligranHQ)
Image from Filigran (@FiligranHQ)
Image from Filigran (@FiligranHQ)
Image from Filigran (@FiligranHQ)
1
33
1
71
Sources & Methods Newsletter retweeted
SentinelOne (@SentinelOne) profile picture
SentinelOne
@SentinelOne10 Dec 2022
👇Our favorite tools for hunting and tracking malicious infrastructure. A Thread 🧵👇 1/9
13
175
1
654
Sources & Methods Newsletter retweeted
The DFIR Report (@TheDFIRReport) profile picture
The DFIR Report
@TheDFIRReport14 Nov 2022
BumbleBee Zeros in on Meterpreter ➡️Initial Access: Contact Forms/Stolen Images/ISO ➡️PrivEsc: WSReset & Slui UAC Bypass, Zerologon CVE2020-1472 ➡️Cred Access: Procdump LSASS, reg dump SAM/SEC/SYS hives ➡️C2: BumbleBee, Meterpreter, CobaltStrike thedfirreport.com/2022/11/14… 1/X
BumbleBee Zeros in on Meterpreter

BumbleBee Zeros in on Meterpreter

In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector from a Contact Forms campaign. We have previously reported on two BumbleBee intrusions (1, 2), and this...

thedfirreport.com
1
103
7
208
Sources & Methods Newsletter retweeted
Matthew Conway (@svcghost) profile picture
Matthew Conway@svcghost11 Nov 2022
That's a wrap for #BRUNCHCON! Sure I missed the start (sleeping—no reason) but this was a great set of talks in a short time. See you next year 😄👋
Image from Matthew Conway (@svcghost)
1
5
Sources & Methods Newsletter retweeted
Matthew Conway (@svcghost) profile picture
Matthew Conway@svcghost11 Nov 2022
This was my favorite talk in @CYBERWARCON or #BRUNCHCON—as a dev and former red teamer that loves the infra and tooling side, and because of the ample and clear evidence given to relate the two loaders. I learned a lot from it 👏
1
3
Sources & Methods Newsletter retweeted
Matthew Conway (@svcghost) profile picture
Matthew Conway@svcghost11 Nov 2022
Now @tiskimber and Genevieve Stark on the SHELLSTING loader, which could be a replacement for BazarLoader
Image from Matthew Conway (@svcghost)
Image from Matthew Conway (@svcghost)
1
3
12
Sources & Methods Newsletter retweeted
Matthew Conway (@svcghost) profile picture
Matthew Conway@svcghost11 Nov 2022
Up next at #BRUNCHCON, Ransomware Sommelier @uuallan on the De-RaaS'ing of Ransomware
Image from Matthew Conway (@svcghost)
Image from Matthew Conway (@svcghost)
1
6
Sources & Methods Newsletter retweeted
💻 Sherrod (@sherrod_im) profile picture
💻 Sherrod
@sherrod_im10 Nov 2022
My new number one consumer security tip: never, ever move a conversation to WhatsApp. #CYBERWARCON
8
15
121
Load more