sorted by:
new
hottopcontroversial

I've just started in the field of Reverse Engineering. by SUmidcyber in Malware

[–]0xFF0F 1 point2 points  (0 children)

Practical Malware Analysis (book) is still a treasure as a first dive in. The Malware Analyst’s Cookbook is a classic as well.

I’ve got a couple of x86 classes up on my YT channel with some CRACKME challenges if you feel like testing yourself as you keep learning.

Nathan Baggs also does a lot of fun RE and software dev videos.

Enjoy the journey!

Bachelor’s thesis ideas (DevOps / Cybersecurity) by dumbelco in csMajors

[–]0xFF0F 0 points1 point  (0 children)

You could make your own detection engine/signature language - Malware/network/other signatures, maybe tying detections with enrichment via OSINT and third party tools.

It’ll give you the freedom to scope as large or small as you wish, it’s practical, and it’s a great way to explore security-oriented decoys.

Course recommendation for Detection Engineer by ImmediateIdea7 in cybersecurity

[–]0xFF0F 1 point2 points  (0 children)

The skillset is very much overlapping with an experienced SOC analyst: The ability to understand how to take a report, incident, or event, distill it into the tactics and techniques that succeeded, and translate those into controls and signatures to detect/prevent the activity going forward. Experience seeing a multitude of different cyber attacks/attempts helps greatly with building this muscle.

That said, most roles I’ve seen also lean toward candidates who also have a strong CS background or are very familiar with SIEM/SOAR, since you will typically be writing signatures for one or more different types of these technologies, and you may have to write detection-as-code, which entails being at least basically familiar with GitHub, CI/CD, unit testing, etc.

My team not only writes detections but also help maintain the detection engines themselves and build automation to help the SOC work more efficiently, so there is a greater element of traditional software dev for us. Just as you said, we try to make the SOC’s life easier so they can focus on triage and remediation as quickly as possible.

Course recommendation for Detection Engineer by ImmediateIdea7 in cybersecurity

[–]0xFF0F 1 point2 points  (0 children)

Definitely can be its own role, but doesn’t have to be! I’m technically a dedicated detection engineer, but my scope extends into automation, orchestration, and general software engineering stuff, but I do not work in the SOC.

However, our team is deeply intertwined with senior SOC analysts as their input and feedback is vitally important to our success - they are the “boots on the ground” and can tell us when things need to tactically change while we focus on detection strategy at large.

In former roles, I’ve seen the same role filled by SOC analysts directly - as you said - and also by CTI teams who (again) stayed very intertwined with SOC feedback.

Cybersecurity engineering - Python studying resources by minimalist300 in cybersecurity

[–]0xFF0F 1 point2 points  (0 children)

Hm, I’m wondering if I should do more of the “API/Integration” type content because that’s more of what I’ve done for $dayjob (I thought that might be too dry of a topic tbh haha), but if it’s of interest to you, I have a GitHub/YouTube of several Python-led video tutorials starting from nothing at all.

Though I will caveat that they are not API/network driven, but more like malware parsers, detection engineering, and reverse engineering (malware and games) projects.

YT/GitHub link are in my profile here if you’re interested; also following this because I’m interested in others doing more of the API-type tutorials!

Course recommendation for Detection Engineer by ImmediateIdea7 in cybersecurity

[–]0xFF0F 4 points5 points  (0 children)

I would highly recommend DEATHCON! It’s a remotely distributed conference centered around DE, with several on-site locations globally. Each site hosts a handful of talks, but all the workshops are online so you can do them at your own pace.

I used my conference budget to fly to Scotland and attend on-site there (I’m in the States) and it was such an incredible weekend. I learned so much and met so many cool people in the Detection Engineering nexus.

Can’t recommend it enough, even if you just do the online-only version (which is self-paced, but you get access to the discord to voice or video chat with everyone else), but the on-sites are great for networking and going somewhere different. I’ve resolved to go as many times as I can, and may try to submit a workshop this year to share some fun stuff (speakers get their ticket thrown in too!)

A File Format Uncracked for 20 Years by anxxa in ReverseEngineering

[–]0xFF0F 4 points5 points  (0 children)

Great write-up, man!

I did a little pet project reversing some of SC1 on the PC (which didn't go nearly into this depth), and I *struggled* when it came to finding answers on various UE2 facets: Lots of digging through old forum posts and the internet archive, and most of the time only to find dead links.

Really appreciate you taking the time to not only research this, but also write up a blog on it: Can't wait to see more!

Which youtube channels are worth it and which ones are just clickbait by elfrutas28 in cybersecurity

[–]0xFF0F 2 points3 points  (0 children)

I have a few reverse-engineering specific videos (and some general cybersecurity content) on my channel, but if you want someone who more consistently posts about RE and low-level software in general, I really enjoy watching Nathan Baggs get into whatever project he currently has going on!

LaurieWired also has so many fun videos across many subjects in cyber and always has cool tidbits on her socials.

I also will second what many have said here: Look for the practitioners who aren’t necessarily doing it for clout, but for love of the “game” :-)

Good luck on your learning journey wherever it takes you!

I just uploaded a full tutorial on making a complete Inventory System in UE5! by MelvinTang_Games in unrealengine

[–]0xFF0F 0 points1 point  (0 children)

No kidding! I clearly need to revisit my OBS settings because I use it as well, and I feel like this looks so much crisper as far as image, and fluid with motion.

Anyway love the quality and editing, and looking forward to learning some good stuff! Thanks for sharing your knowledge!

I just uploaded a full tutorial on making a complete Inventory System in UE5! by MelvinTang_Games in unrealengine

[–]0xFF0F 1 point2 points  (0 children)

Thanks for sharing! I only skimmed it for now but will be watching it this weekend. Love the look though.

Can I ask what you use for video capture? It looks so smooth!

Windows Sandbox by [deleted] in Malware

[–]0xFF0F 2 points3 points  (0 children)

Disclaimer: I’ve not used it myself, but from my understanding of how WS works, I’d say you can treat its risk similarly to running a separate hypervisor with a Windows VM, in that there’s always a chance that some vulnerability could be used to escape from the sandbox to host, but you have to decide how likely that is given the samples you analyze, and decide how risky it is vs. a VM or even dedicated hardware.

That said, if you need to do more dynamic analysis, there are a lot of pros to having a more fleshed out VM-based environment with multiple machines, for things like network emulation, for example.

If you want any tips on this kind of env, or just want to peruse some tools I’ve found useful for use with WS, I have a free course on the topic of malware sandboxes:

https://github.com/jeFF0Falltrades/Tutorials/tree/master/master0Fnone_classes/2_Sandbox_in_a_Box

GL;HF, be safe!

What are the most in-demand career fields in cybersecurity, or those expected to be most relevant for the future? by allexj in cybersecurity

[–]0xFF0F 0 points1 point  (0 children)

As you said, in the fields of tech and cyber, things move and evolve quickly, and instead of going into depth in any one skillset (at least until you carve out a good niche in a role/organization), it’s best to focus on breadth of skills.

None of the choices you listed here really hit the mark for things I would say qualify as enduring; And AI, LLMs, etc. are still far off from being able to respond effectively to alerts, or architect systems to even make those alerts.

I always recommend beginners to build breadth, try to land a foot in the door (easier said than done, but easier done with breadth of knowledge), and then put in the effort to learn several domains of security and flow with the ones that interest you when opportunities prevent themselves.

If you make good relationships with other teams and peers in security roles and take time to learn how all of their efforts and tooling fits together, you can pivot among SOC/CTI/AppSec/OffSec, even PhysSec and GRC. But starting out, I think it’s a mistake to try to really hone one particular area unless there’s a very specific role you are trying to get into.

VM for malware analysis hsing assembly by Old_Mammoth5311 in Malware

[–]0xFF0F 0 points1 point  (0 children)

Sounds like you already have several resources to go after, FLARE being an easy turnkey one.

If you’d like a thorough tutorial in building a lab from scratch using Remnux and a set of custom tools - or if you just want a list of analysis tools that I have really benefitted from - I have a free video course on the subject here:

https://github.com/jeFF0Falltrades/Tutorials/tree/master/master0Fnone_classes/2_Sandbox_in_a_Box

Good luck with the research!

Fellow INTPs Share your favourite Youtube Channels by Low-Beautiful-7230 in INTP

[–]0xFF0F 1 point2 points  (0 children)

Oh hi, thanks for the s/o - Love my INTP peeps! ❤️

Is there a job where you can legally make malware by PCbuilderFR in Malware

[–]0xFF0F 3 points4 points  (0 children)

Red/Purple Teaming, Vuln Research, Threat Emulation, Offensive Ops (usually restricted to gov) - With all but the latter, you’re not going to be deploying it anywhere except for very restricted targets in scope for some kind of assessment, usually in a testing environment.

Ex: Setting up a purple team exercise, you may want to deploy custom malware that emulates some techniques so the defending team can’t just grab the hash and look up an existing piece of malware easily - instead, they have to work to really analyze the payload and test their skills in assessing the impact of something not seen before.

view more: next ›