CTI-Summit 2022 Luxembourg Presentations

Posted on in conferences, open source
   Leave a reply

The first edition of the Cyber Threat Intelligence Summit took place in Luxembourg in October 2022. I did two presentations:

One presentation on MISP web scraper, a tool to create MISP events and reports from scraped websites; and one presentation on building CTI Operational Procedures with Jupyter Notebooks and PyMISP.

The slides and recording are available on GitHub and Youtube.

Slides: https://github.com/cudeso/misp-tip-of-the-week/tree/main/CTIS-2022; Recording of CTI Operational Procedures with Jupyter Notebooks and PyMISP; Recording of MISP … Read more.

Down the Chainsaw path to analyse Windows Event logs

Posted on in security
   Leave a reply

Chainsaw is a tool to rapidly search through large sets of Windows Event logs. In this post I briefly go through the steps that I take to collect, process and analyse logs from different Windows machines and then use them for analysing Windows Event logs. Obviously it’s always better to use centralised logging and apply your detection techniques centrally but unfortunately this isn’t always possible.

Although Chainsaw is available as a binary package … Read more.

MISP web scraper

Posted on in internet, open source
   Leave a reply

I published an article on the MISP project website on the MISP web scraper.

There are a lot of websites that regularly publish reports on new threats, campaigns or actors with useful indicators, references and context information. Unfortunately only a few publish information in an easily accessible and structured format, such as a MISP-feed. As a result, we often find ourself manually scraping these sites, and then copy-pasting this information in new MISP events. These … Read more.

Analysing Amazon AWS security groups and access control lists

Posted on in open source, security
   1 Reply

Analysing firewall rules in AWS can be complex. There are Security Groups (SG) as well as Access Control Lists (ACL). Security groups are applied on instances and are the first layer of defense, whereas access control lists are applied on network components (subnets) and are a second layer of defense. A major difference is that SGs are stateful, whereas ACLs are stateless. From a filtering perspective there is also a difference. In security groups all … Read more.

Cyberweapons Arms Race

Posted on in security
   Leave a reply

I recently finished the book “This Is How They Tell Me the World Ends: The Cyberweapons Arms Race” by Nicole Perlroth. The book covers the story of the cyberweapons market and how government agencies fuelled this economy, eventually making the Internet a less safer place for us all.

I added some notes of items of interest in a mindmap that are maybe of use for others. The map is not complete at all, feel free … Read more.

MISP sharing groups demonstration video

Posted on in open source, security
   1 Reply

Sharing groups in MISP are a more granular way to create re-usable distribution lists for events/attributes that allow users to include organisations from their own instance (local organisations) as well as organisations from directly, or indirectly connected instances (external organisations).

For a possible future project I had to document if sharing groups are an answer for a sort of multi-tenancy for sharing threat events within MISP.

Sharing groups certainly provide an answer, as long as … Read more.

MISP and Microsoft Sentinel

Posted on in security
   2 Replies

A short post with things to consider when integrating MISP threat intelligence with Microsoft Sentinel. There are two documentation resources that describe the integration in detail and should get you started in no-time:

External Connectors for MISP Integrating open source threat feeds with MISP and Sentinel

This error is caused by invalid client secret or missing client ID. One of the steps in the documentation involves creating a new secret. You then have to add … Read more.

A simple way to deploy MISP servers with Packer and Terraform

Posted on in uncategorized
   Leave a reply

For a future project I was looking into ways of deploying (and deleting) instances of MISP on a regular basis. Instead of manually installing MISP, I wanted the deployment and the configuration automated and based on simple configuration files. This is called “infrastructure as code”, typically addressed by CI/CD (Continuous Integration, Continuous Development). To throw in other popular terminology “DevOps” could support me in provisioning (and deploying) the infrastructure that is going to be used … Read more.

Using VMRay Analyzer for Initial Triage and Incident Response

Posted on in security
   Leave a reply

I published an article on the blog of VMRay: Using VMRay Analyzer for Initial Triage and Incident Response.

In this article I cover a practical case study how VMRay Analyzer helped with getting an accurate and noise-free analysis for initial triage and obtaining the relevant indicators of compromise for faster incident response.

Key recommendations and findings from the HSE Conti ransomware attack

Posted on in security
   Leave a reply

The healthcare sector has been in the crosshairs of ransomware gangs.

One of the victims of last year was Ireland’s Health Services Executive. A report analysing the Conti ransomware attack was published as a follow-up to the incident. This Independent Post Incident Review provides a long list of recommendations that are not only valuable for the HSE but read as a “must-do” list for other organisations to be better prepared for such ransomware incidents.

I … Read more.