Data Science, Threat Hunting & Open Source Projects 🍻 Founders: @Cyb3rward0g @Cyb3rPandaH
Joined September 2019
- Tweets21
- Following2
- Followers1.8K
- Likes29
ThreatHuntersForge retweeted
It's time to go to SimuLand! 🎠🎡🎢
But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses.
Get the details: msft.it/6017VxcHv
ThreatHuntersForge retweeted
HOW to contribute a @Mordor_Project dataset in 2 mins ⏳w/ the help of @redcanary ART & then contribute to @sigma_hq after exploring the data! @OTR_Community
♻️ Clear, Exec & Collect: youtu.be/6iteEfbuwU8
😈 Data: mordordatasets.com/notebooks…
🏹 Rule: github.com/OTRF/sigma/blob/m…
ThreatHuntersForge retweeted
WE HAVE PCAPs 😈
a) @Suricata_IDS ➕ ET Rules!
b) git clone github.com/hunters-forge/mor… && cd mordor/datasets/large
c) find apt29/day*/pcaps -name '*.zip' -execdir unzip -P infected {} \;
c) find apt29/day*/pcaps -name '*cap' -execdir suricata -r {} -k none \;
TY @jason_trost 🙏
ThreatHuntersForge retweeted
I started to document Win RPC interfaces & their respective methods 📋& ended up using @GHIDRA_RE for the 1st time, integrating code from @_xpn_ & @Sektor7Net research 😅 and using @ProjectJupyter notebooks & #GraphFrames 🔗 to analyze the results 🍻 medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
🏡 Saturday project (WIP..)! 😅
a) Doc #Bloodhound cypher queries from the community in YAML
b) Auto parse queries & create #jupyter notebook to query a @neo4j DB via py2neo
c) Docker #jupyter server & #neo4j w/ #Bloodhound ExampleDB
d) Jupyter Book bloodhoundnotebook.com
ThreatHuntersForge retweeted
🔥 How to Community Evaluate FREE Telemetry 🌎 following the @MITREattack evals methodology 📋 Sharing detections, @sigma_hq rules, data & a @ProjectJupyter notebook created during an ongoing hackathon to empower others & create research opportunities 🙏
medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
Thank you for sharing @_xpn_ 💜 I took some time in the 🌞 to read a little bit about it. I'm sure there are + resources out there, but I put together these initial notes from a detection perspective. Maybe a SACL & @sigma_hq rules for the reg approach? 😈gist.github.com/Cyb3rWard0g/…
ThreatHuntersForge retweeted
Trying to revamp a project 🔥 & document interesting SACLs (Audit Rules) 😉
🍻 First attempt:
1) git clone github.com/GhostPack/Seatbel…
2) egrep -rhio '(SOFTWARE\\|SYSTEM\\).*\"' Seatbelt/Seatbelt/Commands/*
3) gist.github.com/Cyb3rWard0g/…
4) github.com/OTRF/Set-AuditRul… (work in progress)
Over the last year @tifkin_ and I rewrote GhostPack's Seatbelt from the ground up. Highlights- completely modularized, nearly 2x increase in checks, remote enumeration options, and structured output. Complete changelog at github.com/GhostPack/Seatbel… , code at github.com/GhostPack/Seatbel…
ThreatHuntersForge retweeted
🚨💥 Registration for the first community Infosec Jupyterthon is open! Also, check the current talks & speakers that would love share their knowledge with you 💜 🍻
🗓️ Current Agenda: infosecjupyterthon.com/agend…
📒 Registration Form: bit.ly/InfosecJupyterthonReg…
See you on Friday 5/8
🚨 Organizing an Infosec Jupyterthon on 5/8 🚀 An open virtual community event for security researchers to share their favorite @ProjectJupyter #notebooks w/ the Infosec 🌎 Share & meet other Infosec Jovyans!
Site: infosecjupyterthon.com
Call for 📔: bit.ly/InfosecJupyterthonCFN
ThreatHuntersForge retweeted
Looking for anything to do while you wait for 2020 🎉? I just created a Jupyter Book for the @Mordor_Project ! You can now explore mordor datasets w/ @ProjectJupyter #notebooks via BinderHub 🌎 Pre #ThreatHunting activities for 2020 🍻🤣!
New Site: mordordatasets.com
ThreatHuntersForge retweeted
I decided to write a book 😅! An online Interactive Book 💥! A book on the top of @HunterPlaybook , @ProjectJupyter #notebooks and w/ @mybinderteam BinderHub links all put together w/ the amazing Jupyter Book project! #ThreatHunting
Merry Christmas 🎄🎁 🍻 medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
Interested in learning about what you can do with STIX/TAXII 2.0 APIs and some Python 🐍 code? I created a new function for the attackcti Python library to automate the creation of @MITREattack Navigator group layer files 😊🍻🌎💜 and shared the process medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
I always wondered how I could share #ThreatHunting detections via @ProjectJupyter notebooks in a more practical and interactive way so that anyone in 🌎 can reproduce the research! Thx to @mybinderteam 💜 @HunterPlaybook @Mordor_Project it is now possible medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
@Cyb3rPandaH & I had so much fun @MITREattack #ATTACKcon sharing our research w/ @ProjectJupyter notebooks , @mybinderteam , @HunterPlaybook ⚔️ & @Mordor_Project #ThreatHunting
Talk: youtube.com/watch?v=L3KxKAGS…
Slides: speakerdeck.com/cyb3rward0g/…
BinderHub Demo: youtu.be/mQZFHbnDH4A
ThreatHuntersForge retweeted
Every time I think of something new I need I discover @HuntersForge has it! #ATTACKcon
Join us tomorrow 10/28 at the 1st @HuntersForge networking event 🍻! Thank you to @corelight_inc @SOC_Prime & @VAEinc for making it possible 🙏. Get to know the community behind @THE_HELK @OSSEM_Project @HunterPlaybook @Mordor_Project & more! Event Info meetup.com/NOVA-Threat-Hunte…
Thank you so much to everyone that came out today! We are so happy to see the @HuntersForge community growing 🙏! A lot of great conversations and amazing people sharing and having a good time! This is just the beginning! 😊🍻💜 #ThreatHunting #sharingiscaring
ThreatHuntersForge retweeted
Happy to release Part II: Shipping ETW events to @THE_HELK from the Threat Hunting with ETW events and HELK series! Also, releasing the Mordor Erebor 🐲environment to collect ETW events for new datasets! 👿📜 #ThreatHunting @HuntersForge @Mordor_Project medium.com/threat-hunters-fo…
ThreatHuntersForge retweeted
Feel free to join the @HuntersForge public slack 🤗💜 and let's continue building and empowering our community TOGETHER!! #ThreatHunting @Cyb3rWard0g launchpass.com/threathunting 🏹⚔️🍻💜
