I've been working on some php2shell detection testing all day. Take a look if it can help you.. github.com/chrisdfir/php2she…
#php2shell
Chris retweeted
⏳ Time is crucial in Incident Response ⏳
In one incident, the victim engaged Talos IR immediately after discovering malicious activity alerts. Talos IR worked swiftly to combat additional malicious activity and prevented the execution of any encryption in the environment.
Conversely, in a second incident, the victim ignored alerts of malicious activity and did not contact Talos IR until after the ransomware binary began to execute. Talos IR was then not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption.
Full article here: blog.talosintelligence.com/t…
Chris retweeted
Join Cisco Talos Incident Response for an off-the-record briefing on how we tackle threats on the frontlines. Real stories, real lessons. Register now: cs.co/IRTales
Chris retweeted
Cisco Talos Incident Response (Talos IR) recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Read the blog here: cs.co/6019SsMIh
Chris retweeted
Just tested Velociraptor Linux.Forensics.ProcFD - very cool outputs include regular files, sockets, device files, and deleted files used by each process. This artifact collects metadata about open file descriptors from active processes on a Linux system.
docs.velociraptor.app/exchan…
The data is in! Take a look at some of the trends we have seen over the last quarter.
#dfir #blueteam #cybersecurity
The latest quarterly trends report is out now from Talos Incident Response. Credential theft was the main goal in 25% of incidents last quarter, and new ransomware variants made their appearance - read more about the top trends here: cs.co/6017q29Mv
I've recently built a @velocidex #velociraptor VQL artifact to support Linux forensics. This artifact collects metadata about open file descriptors (other files, sockets, etc) from active processes on a Linux system. #dfir
docs.velociraptor.app/exchan…
Chris retweeted
Talos IR just updated our advice for defending large events. Check out the newest whitepaper, which contains 13 things every organization must consider, whether you're hosting a conference, sporting event, and everything in between! cs.co/6010qrE02
Chris retweeted
In recent investigations, Talos Incident Response has observed the BlackByte ransomware group using techniques that depart from their established tradecraft. Read the full analysis in our latest blog: cs.co/6018mbOmg
Chris retweeted
It's been more than 4 years since we brought Cisco Talos Incident Response under the Talos umbrella. Learn more about Giannis and his team from his Researcher Spotlight here: cs.co/6013Y6p2T #Talos10
Chris retweeted
In our new report on Incident Response trends, stolen credentials was the initial access method for 60% of incidents - a 25% rise from the previous quarter. Hear our team talk about some recent stolen credential use cases cs.co/6013YX1C9
Chris retweeted
Cisco Talos Incident Response is now available to all @splunk customers! Learn how Talos IR can help you assess, strengthen and evolve your cybersecurity program and make sure your systems are resilient against the worst-case scenarios cs.co/6017YdCpd
Chris retweeted
Want to know how Talos came to be? We sat down with several of our leaders to learn firsthand about the origins of Talos and the company's keys to success in our 10 years cs.co/6017cFkel
Chris retweeted
“I don’t think most American citizens really viscerally understand how much of the content they see on social platforms is actually a foreign intelligence operation." — @StateDept official, via @HC_Richardson
Chris retweeted
Sadly we're still brought into M365 BEC cases where audit logs are NOT turned on.
Tell every organization to log in to their M365 compliance portal. If they see this, they need to turn on auditing immediately!
Chris retweeted
Adversaries are increasingly relying on exploiting otherwise legitimate remote access management tools to spy on and access networks. Here's some advice for how to implement this software to maximize security cs.co/6014ZLx8w
Check out the latest Talos IR On Air! I had the opportunity to discuss a new open-source web shell we are seeing in the wild, complain about logging and shed light on a new service line we are offering, the Log Architecture Assessment
#threatintel #cti #dfir #incidentresponse
The Talos Incident Response team recaps some of the most notable threat trends observed over the past quarter in our latest installment of Talos IR On Air cs.co/6016uc0i2
Chris retweeted
On the latest Security Stories podcast, we cover how Cisco Talos Incident Response helped one healthcare customer avoid the worst with retainer services.
🎙️On today's #SecurityStories episode, @hazeburton is back to chat w/ guest Jeremy Maxwell, CISO of @Veradigm, a healthcare #IT company!
Hear how Veradigm proactively prepares for #cybersecurity incidents within the highly regulated #healthcare industry: cs.co/6016Pouba
Chris retweeted
🔍 Ok I did it - #ShellSweepML: webshell detection powered by machine learning! 🚀 Under the hood, it utilizes a Logistic Regression model trained on a vast dataset of both benign and malicious web scripts. The magic starts with the TF-IDF Vectorizer 📖, transforming raw file content into numerical data the model can interpret. It has a lot of the same features as #ShellSweep - filtering, extensions and managed scan paths.
Every scan is not just about predicting but understanding the data. 🧠 Alongside each detection, ShellSweepML computes a SHA256 hash for file integrity and captures the last-modified timestamp for contextual insights. 🕘
Deployment made easy: Whether you're into the flexibility of CLI arguments or the plug-and-play nature of an all-in-one binary, ShellSweepML got you covered. 💼 And output is in JSON, ensuring seamless integration into your analytics pipeline.
Stay tuned for the release! 🎉 Honestly, I'm still wrapping my head around what I've crafted, but one thing's for sure: its precision is unmatched! 🎯🤖
