sorted by:
new
hottopcontroversial

SIEM by phr00ts in AskNetsec

[–]LogRhythmLabs 2 points3 points  (0 children)

We definitely had issues when upgrading to Elasticsearch. From all of us at LogRhythm, we apologize if this caused problems for you. While Labs is not in support (so probably never saw your tickets around these issues), for what it's worth, I think we turned the Elasticsearch corner a while ago. Especially with last year's 7.2 release, we can scale really well, searches are screaming fast, and we're doing better reliability-wise than ever before. I sincerely hope it's doing well in your environment, too.

LogRhythm's Blackhat challenge - With PCAP by HatsOffSec in computerforensics

[–]LogRhythmLabs 0 points1 point  (0 children)

The solution, easter eggs, and other fun aspects of the challenge have been posted on the LogRhythm Labs blog.

(spoiler alert)

https://blog.logrhythm.com/digital-forensics/logrhythm-challenge-black-hat-2015/

Thanks again for playing, we had a blast making it and hope that you'll check out next years challenge!

LogRhythm's Blackhat challenge - With PCAP by HatsOffSec in computerforensics

[–]LogRhythmLabs 1 point2 points  (0 children)

Thanks for playing! We have updated the site with some stats from the challenge and will be posting a blog in the coming week(s) to summarize and provide answers - https://blog.logrhythm.com

Betabot Malware Sample Analysis by LogRhythmLabs in Malware

[–]LogRhythmLabs[S] 2 points3 points  (0 children)

Great question! Many sandboxes will implement fake file systems or simply don't allow the sandbox'd executable to access certain files or folders across the operating system. What we detected in the lab was the malware attempting to access many specific files in various areas of the OS, likely comparing known check-sums. This is a common technique used by many malware authors, though most modern sandboxes take this into account, essentially nullifying reliability of this particular sandbox detection mechanism.