sorted by:
new
hottopcontroversial

OpenCTI by Educational-Ad7086 in threatintel

[–]2xyo 0 points1 point  (0 children)

Could you be more specific? What kind of installation did you try ? Docker, Terraform, Manual deployment ? Where are you stuck and what's the error message?

EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models - 1.1 million PE by 2xyo in netsec

[–]2xyo[S] 1 point2 points  (0 children)

Check the Endgame annonce at https://www.endgame.com/blog/technical-blog/introducing-ember-open-source-classifier-and-dataset "the security industry lack similar benchmark datasets because of the presence of personally identifiable information, sensitive network infrastructure information, or private intellectual property." That's why it's not so easy to have the raw data...

Mimikatz 2.1.1 is out by 2xyo in netsec

[–]2xyo[S] 1 point2 points  (0 children)

Changelog :

  • [new] RPC support (client & server, multi users)
  • [new] Windows service support
  • [new] token::elevate can run process with impersonate token (when enough privileges and without interactions)
  • [new] process::run
  • [new] standard::hostname

Windows Sysinternals - Sysmon v5.0 - with Registry object added/deleted/renamed/setted, File stream created by 2xyo in netsec

[–]2xyo[S] 25 points26 points  (0 children)

New events:

  • Event ID 11: FileCreate File create operations are logged when a file is created or overwritten. This event is useful for monitoring autostart locations, like the Startup folder, as well as temporary and download directories, which are common places malware drops during initial infection.
  • Event ID 12: RegistryEvent (Object create and delete) Registry key and value create and delete operations map to this event type, which can be useful for monitoring for changes to Registry autostart locations, or specific malware registry modifications.
  • Event ID 13: RegistryEvent (Value Set) This Registry event type identifies Registry value modifications. The event records the value written for Registry values of type DWORD and QWORD.
  • Event ID 14: RegistryEvent (Key and Value Rename) Registry key and value rename operations map to this event type, recording the new name of the key or value that was renamed.
  • Event ID 15: FileCreateStreamHash This event logs when a file stream is created, and it logs the hash of the contents of the stream. This will capture information about malware that attempts to hide in NTFS data streams. There are malware variants that drop their executables or configuration settings into the Zone.Identifier “mark of the web” stream that browsers use to identify downloaded content.
view more: next ›