Back to qualys.com
3 posts

Countdown to Black Hat: Top 10 Sessions to Attend — #5

Black Hat USA 2019, which is only one month away, offers scores of training courses and research briefings, so every week we’re picking a session we believe Qualys customers will find valuable. This week’s selection is the training course Adversary Tactics — Detection.

This course focuses on abnormal behaviors and attackers’ “tactics, techniques, and procedures” (TTPs). It teaches participants how to create hypotheses based on TTPs to perform threat hunting operations and detect attacker activity. Students will also learn how to use free and open source data collection and analysis tools to gather and analyze large amounts of host information to detect malicious activity. 

Key takeaways from the course will include learning how to conduct effective, continuous hunt operations; run an end-to-end hunt operation; and develop metrics that measure the effectiveness of detection capabilities. Designed for defenders wanting to learn how to hunt in enterprise networks, this four-day course will be taught by experts from SpecterOps, a security firm that provides adversary-focused services.

Continue reading …

Countdown to Black Hat: Top 10 Sessions to Attend — #3

We’re getting closer to Black Hat USA 2019, whose program is loaded with scores of research briefings and training courses. For attendees, it’s always a challenge to decide which ones to put on their schedule — and which ones to leave out.

To help with this task, we’re recommending a Black Hat USA 2019 session every week. Adding to our top recommended sessions, here’s our third choice: Windows Enterprise Incident Response.

This course teaches how to do triage on a potentially compromised system, uncover attack evidence, recognize persistence mechanisms, and more. Key takeaways include learning incident response principles, and scaling analysis to an enterprise environment.

The instructors are Mandiant consultants Austin Baker and Julian Pileggi, who have expertise in digital forensics, incident response, proactive security and threat hunting. The course is intended for people with backgrounds in forensic analysis, pen testing, security architecture, sysadmin, incident response and related areas.

Continue reading …

New ‘Silence’ Banking Trojan copies Carbanak to Steal from Banks (Analysis with IOCs)

Dark Reading is reporting on a new banking trojan called ‘Silence’ that mimics techniques similar to the Carbanak hacker group targeting banks and financial institutions.  The attack vector is similar – target individuals using spear-phish emails to trick them into running a malicious attachment which will connect to download a dropper to further infect the user’s machine.  This attack does not use an exploit against a vulnerability, but rather takes advantage of social engineering to fool the user into executing the malicious payload and infecting their machine.

Silence is interesting in that the trojan’s capabilities include a screen grabber that will take multiple screenshots of the user’s active monitor and upload the real-time stream to a command and control server for monitoring by the adversary.  This technique allows the threat actor to identify which users have access to specific banking applications, systems, and accounts that they can use for financial gain.

Continue reading …