Ozgur Alp

🔍 𝐄𝐱𝐩𝐥𝐨𝐫𝐢𝐧𝐠 𝐒𝐈𝐄𝐌 𝐚𝐧𝐝 𝐂𝐨𝐫𝐫𝐞𝐥𝐚𝐭𝐢𝐨𝐧 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬 𝐎𝐯𝐞𝐫 𝐭𝐡𝐞 𝐘𝐞𝐚𝐫𝐬 🔍 Back in 2016, I addressed a critical issue in the realm of SIEM: the challenge of correlating events based on periodic queries. My insights were published in Turkish as "Log Yönetimi, Korelasyon ve SIEM" (Log Management, Correlation, and SIEM). You can read the full article here: https://lnkd.in/ghd7naG Interestingly, just a day later, a related article titled "SIEM tricks: dealing with delayed events in Splunk" was published, highlighting similar concerns. Check it out here: https://lnkd.in/gz4KyPkV Fast forward to 2021, I revisited this topic on PeerSpot, delving deeper into the persistent issues surrounding event correlation in SIEM systems. For those interested, you can read more about it here: https://lnkd.in/gcEVjKCS Happy reading and feel free to share your thoughts! #CyberSecurity #SIEM #Correlation #LogManagement #ThreatDetection #Splunk #PeerSpot #InfoSec

4

🔍 Exploring the Depths of Directory Traversal Vulnerabilities: A Unique Insight 🔍Together with Talha Eroğlu and Ilgaz Senyuz, we've delved into the intricate world of Directory Traversal in our latest article. This isn't just any article—it's a comprehensive guide that unveils the vulnerable codes that could lead to Directory Traversal, viewed through the lens of a hacker to understand how these vulnerabilities can be exploited, and critically, from the perspective of an application security engineer and software developer on how to effectively mitigate these risks. 📖 What You'll Learn: Introduction to Directory Traversal: Understanding the basics and how these vulnerabilities can appear in your systems. Potential Risks: From unauthorized access to sensitive data to complete server compromise. Exploiting Directory Traversal: A hacker’s blueprint to leveraging these vulnerabilities. Preventative Measures: Practical strategies including input validation, canonicalization, limiting file system access, and more to protect your applications. This article is essential for anyone committed to strengthening their cybersecurity defenses against one of the most nuanced threats in today's digital landscape. 🔗 Interested in a deeper dive? Reach out for more detailed discussions or direct access to the article! Let's elevate our security practices and safeguard our systems with proven strategies and insights. #CyberSecurity #InfoSec #ApplicationSecurity #SoftwareDevelopment #DirectoryTraversal #DataProtection #TechCommunity #DigitalDefense #NetworkSecurity #WebSecurity #SecureCoding #DevSecOps

87

1 Yorum

Just completed an impressive introductory #KQL course for security analysis. 🔗 https://lnkd.in/d7wQAYRJ Mehmet, thank you for sharing your expertise in a digestible and engaging manner. If you're keen on improving your security investigations, threat hunting, and detection engineering skills, get this course from Blu Raven and dive into KQL to kickstart your journey! #Kusto #SIEM #ThreatHunting #MicrosoftSentinel #MicrosoftDefender #MicrosoftDefenderXDR

26

[FREE ACCESS ARTICLE]How to Detect Suspicious IP Addresses by Oğuzhan Öztürk https://lnkd.in/ePPDWWB #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

10

 X-Labs team’s research seems to have discovered and identified basic ransomware targeting Turkish businesses. The attack vector initiates through a PDF attachment disseminated via suspicious emails originating from the "internet[.]ru" domain. The embedded links within the PDF facilitate the download of a subsequent stage exe payload upon user interaction. It encrypts files with “.shadowroot” extension. Currently, ransomware is actively targeting numerous businesses worldwide, including those in the healthcare and online shopping sectors. https://lnkd.in/dUNtKRkj #healthcare #cybersecurity #ransomware

1

[FREE ACCESS ARTICLE] How to Detect Suspicious IP Addresses by Oğuzhan Öztürk https://lnkd.in/ePPDWWB #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding #opensource

19

The Role of Security Validation to Reduce and Quantify Cyber Risk – Volkan Ertürk – RSA24 #4 - SC Media: The Role of Security Validation to Reduce and Quantify Cyber Risk – Volkan Ertürk – RSA24 #4  SC Media #CyberSecurity #InfoSec #SecurityInsights

1

Our Microsoft Windows-installed computers are crashing because of a software problem caused by a product they outsourced from CrowdStrike. The issue, a Crowdstrike driver problem in Windows systems, is causing a bugcheck\blue screen error. This issue concerns the Falcon Sensor, a key component of CrowdStrike Falcon. The company noticed the problem in the early hours and published an announcement. "Symptoms include experiencing a bugcheck\blue screen error related to the Falcon Sensor," CrowdStrike's alert continued. "Our Engineering teams are actively working to resolve this issue, and there is no need to open a support ticket." CrowdStrike is a web/cloud-based anti-virus that uses very little storage space on your machine. The company calls this technology CrowdStrike Falcon. CrowdStrike installs a lightweight sensor on your machine that is less than 5MB and is entirely invisible to the end user, ensuring your security without intruding on your experience. The driver problem of CrowdStrike Falcon has created BSoD for Windows computers. This issue, while specifically causing Windows to crash, also has further-reaching implications. Given the prevalence of Windows as an operating system and CrowdStrike as a top-rated cybersecurity company, multiple companies and services are experiencing outages due to their computers being down. This underscores the #urgency of the situation and the need for a swift resolution. Arda Büyükkaya, a Turkish #cybersecurity expert, has provided a simple and effective ad hoc solution to the problem: Please check the codes and implement them in your responsibility. Since each system has different components, first test the codes in your systems and then use them until Crowdstrike comes up with a final solution. https://lnkd.in/d6JHRHvH https://lnkd.in/dCUymHAY

36

3 Yorum

Yet another great news from the Mitiga Research group! 🌟 Mitiga research and I&R groups will participate also in SANS Institute DFIR conference 1. "The SaaS-y Side of Incident Response" by Cody Craig & Mehmet Mert Surmeli 2. "Who Touched My GCP Project?" by Gavriel Fried Check out where you can also catch us: 🚀 cloudsec 🔐 BSidesTLV 🐾 CLOUDNATIVE SecurityCon #MitigaResearch #CyberSecurity #CloudSecurity #GCP #Okta #Kubernetes #CloudNative #CyberEvents

23

3 Yorum

Vira V. Liubchenko, Denys V. Volkov Cyber-aware threats and management strategies in cloud environments The paper provides an overview of cyber threats within cloud computing and proposes effective management strategies. The transition to cloud services has introduced significant security concerns, particularly regarding data protection and privacy. https://hait.od.ua #Cloudcomputing #securitythreats #vulnerabilities #cybersecurity #cloudserviceprovider #software #hait

1

According to Federal Bureau of Investigation (FBI) how to approach investigation sight... #dfir😎. #chfi #CyberDefenders #CyberSecurity #BlueYard #DefendSmarterNotHarder #blueteam #InfoSec #SOC #DFIR

2

Check Point Software Point Research is monitoring an ongoing #Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS).  The attacks rely on #LIONTAIL, an advanced passive #malware framework installed on #Windows #servers. For #stealth purposes, LIONTIAL implants utilize direct calls to Windows #HTTP stack driver #HTTP.sys to load memory-residents payloads. As part of mutual efforts with Sygnia‘s Incident Response team, multiple forensics tools and techniques were leveraged to uncover additional stages of the intrusions and the LIONTAIL framework. The current campaign peaked in mid-2023, going under the radar for at least a year. The campaign targets high-profile organizations in the Middle East with a focus on government, military, and telecommunications sectors, in addition to IT service providers, financial organizations, and NGOs.  Scarred Manticore has been pursuing high-value targets for years, utilizing a variety of IIS-based #backdoors to attack Windows servers. These include a variety of custom web shells, custom #DLL backdoors, and #driver-based implants. While the main motivation behind Scarred Manticore’s operation is #espionage, some of the tools described in this report have been associated with the MOIS-sponsored destructive attack against Albanian government infrastructure (referred to as DEV-0861). #cyberespionage #cybersecurity #APT #Intelligence #threatintelligence https://lnkd.in/dxfErw6g

1

📌 .NET Hooking – Harmonizing Managed Territory 🌐 https://lnkd.in/erU6PtGr #Pentesting #Hacking #Hacker #OffensiveSecurity #Pentest #RedTeam #BugBounty #Vulnerability #Testing #devsecops #OffensiveOperations #window_internals #PenetrationTesting #exploit #blueteam #infosec #cybersecurity #informationsecurity #security

1

Zeek: Open-source network traffic analysis, security monitoring Zeek is an open-source network analysis framework. Unlike an active security device such as a firewall, Zeek operates on a versatile ‘sensor’ that can be a hardware, software, virtual, or cloud platform. This flexibility allows Zeek to quietly monitor network traffic, interpret it, and generate transaction logs, file content, and customized output. These outputs are suitable for manual review on disk or in an analyst-friendly tool such as SIEM, providing a comprehensive view of network activity. github : 👇 https://lnkd.in/dC3UjMhs

47

3 Yorum

One of the most crucial aspects of our work as Cybersecurity Defenders is understanding and analyzing malware traffic. 🌐 Why Focus on Malware Traffic Analysis?: - Reveal Hidden Threats: By examining HTTP requests and network streams, we can uncover communication with command-and-control servers, identify data exfiltration, and spot other malicious activities. - Real-Time Threat Detection: Using tools that integrate real-time analysis capabilities helps us detect and respond to threats as they emerge, reducing potential damage. - Counter Evasion Tactics: Sophisticated malware often tries to evade detection. Understanding its behavior in a controlled environment allows us to adapt and counter these tactics effectively. 🔎 Key Concepts in Malware Traffic Analysis: - HTTP Request Examination: Analyzing the details of connection requests can reveal malware's behavior and intent. This includes identifying specific URLs, monitoring response content, and filtering connections. - Rule Detection: Leveraging rulesets to detect suspicious traffic and malware-related activities helps in early identification and mitigation of threats. - Network Stream Analysis: Delving into packet content and network streams provides deep insights into malware configuration, data theft, and other malicious activities. Mastering malware traffic analysis equips us with the knowledge to defend against cyber threats proactively. It’s not just about having the right tools but also about developing the expertise to interpret and act on the data they provide. #CyberSecurity #MalwareAnalysis #NetworkSecurity #ThreatDetection https://lnkd.in/dCWret3Y

2

Expressed in a different way …. when there is a new vulnerable added to The Shadowserver Foundation’s infrastructure, a “trigger” is added to the global honeypot platform. * Constituents get the report on the risk to their network. * Constituents get an alert of “Active Exploit” when the threat actors start looking for the vulnerability. The threat actors trigger the honeypot alarm. Most commercial Enterprise Attack Surface Monitoring tools do not have this dual capability. Remember, The Shadowserver Foundation is a non-profit. These reports are free - part of the public benefit - supported by organizations seeking a threat-free Internet. Q. Why are you now signing up for the best Attack Surface reporting?

3

We conclude the special lecture in the second group for training Windows Server, where LAB Remote Access VPN Client to Server was applied and implemented, and LAB Routing was implemented using Windows Server and connected to routers in GNS3 using the RIPv2 protocol.

16

1 Yorum

For security researchers interested in starting with reverse engineering Windows drivers IOCTLs, I highly recommend checking out my PDF presentation from my H2HC 2023 talk. It's a comprehensive resource to help you get started! https://lnkd.in/dchEYnNg #exploit #afd #reversing #vulnerability #ioctl #ioring #windows

167

9 Yorum

Do you know the difference between Vulnerability Scanning, Penetration testing, Red-Teaming, and Continuous Security Validation approaches and building blocks of Breach and Attack Simulation (BAS)? Testing and validation are crucial to maintaining good cyber security hygiene, however, there are clients I meet who don't know what the differences in testing are and what's best for them. Picus Security have a Beginners Guide To. See the link below. #picus #cyber #cyberassurance #vulnerabilityscan #penetrationtest #redteam #bas

13