OSSEM

31 posts

OSSEM banner
OSSEM

OSSEM

@OSSEM_Project

Open Source Security Event Metadata ! Data engineers! #ThreatHunting @OTR_Community

https://ossemproject.com/intro Katılım Eylül 2019
7 Takip Edilen1.5K Takipçiler
OSSEM
OSSEM@OSSEM_Project·
🚀 Any NEW fields on the schemas for #SysmonForLinux events compared to Windows🤔? @Cyb3rPandaH used our #Sysmon for Windows & Linux data dictionaries in a python 🐍 script to answer that😎 ✅ ParentUser (ProcessCreate) ✅ User (EID 5,9,11) 🖇️ Script: github.com/OTRF/OSSEM-DD/…
OSSEM tweet mediaOSSEM tweet media
Roberto Rodriguez 🇵🇪@Cyb3rWard0g

🚨 Learning how to install #Sysmon for Linux 🐧 & send security events to #AzureSentinel in a research lab environment!! 🧪 #MSTIC #Microsoft 📡 Sysmon (SysinternalsEBPF) -> Syslog -> SIEM 🚀 ✅ Scripts ✅ ARM templates ✅ Sysmon configs and more.. techcommunity.microsoft.com/t5/azure-senti…

English
1
23
52
0
OSSEM
OSSEM@OSSEM_Project·
@Cyb3rWard0g 🚨 Thanks to @Cyb3rPandaH , we updated our #Linux data dictionaries to keep up with the event schemas from #SysmonForLinux and share them with the community 🚀 I see some new fields names 🙊👀 #sysmon-events" target="_blank" rel="nofollow noopener">ossemproject.com/dd/dictionarie… @OTR_Community
English
0
4
4
0
OSSEM retweetledi
Microsoft Threat Intelligence
Microsoft Threat Intelligence@MsftSecIntel·
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
Microsoft Threat Intelligence tweet media
English
6
145
319
0
OSSEM retweetledi
Open Threat Research
Open Threat Research@OTR_Community·
🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 🗒️Metadata: mordordatasets.com/notebooks/smal… 😈Dataset: raw.githubusercontent.com/OTRF/mordor/ma…
Open Threat Research tweet mediaOpen Threat Research tweet media
Florian Roth ⚡️@cyb3rops

APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with - NamedPipe Creation - Service installation & exec pattern - HTTP beaconing github.com/NextronSystems… If you want to help, add some steps in here: github.com/NextronSystems…

English
0
81
188
0
OSSEM
OSSEM@OSSEM_Project·
What started w/ talks at ATT&CKcon & analysis of event logs, We're happy to see @Cyb3rPandaH & @Cyb3rWard0g initial research helping ATT&CK users improve their data collection strategies. Join us to collab 🍻 @OTR_Community 🎙️ bit.ly/OTRDiscord 🛡️ github.com/OTRF/OSSEM-DM/…
ATT&CK@MITREattack

It has launched! ATT&CK v9 is now live with refactored data sources, ATT&CK for Containers, Google Workspace as a platform and more! Read about new data sources and the rest of the update at medium.com/mitre-attack/a… or attack.mitre.org/resources/upda… for new/changed groups/techniques/sw.

English
0
8
13
0
OSSEM retweetledi
SANS DFIR
SANS DFIR@sansforensics·
In their #THIRSummit talk, @Cyb3rPandaH & @jamieantisocial illustrates how we can avoid the typical cat and mouse games by modeling the data sources defined in ATT&CK to recognize, track, and even predict the malicious scent of adversaries. Watch it now: youtu.be/eKeydMrXsOE
YouTube video
YouTube
SANS DFIR tweet media
English
0
7
19
0
OSSEM
OSSEM@OSSEM_Project·
Formalizing the mapping of security events to the @MITREattack data source objects concepts 🍻 We would love to hear your feedback and see your contributions to this community-led effort!! 💜 Thank you @Cyb3rPandaH 💜 Blog: medium.com/threat-hunters…
OSSEM tweet media
English
0
40
141
0
OSSEM
OSSEM@OSSEM_Project·
🙏So happy to see our initial data modeling concepts applied to enhance @MITREattack . This is a more practical & less subjective approach to map event logs ➡️ att&ck data sources. We hope this helps the community to improve their data collection strategy. Thanks @Cyb3rPandaH 🍻
ATT&CK@MITREattack

Coinciding with @jamieantisocial's and his #ThreatHuntingSummit talk, we've just released part 1 of a blog series by ATT&CK team member @Cyb3rPandaH on a proposed method of enhancing an often overlooked part of ATT&CK, data sources. Check it out at medium.com/mitre-attack/d….

English
1
7
22
0

Keşfet

@olafhartong @MITREattack @FDezeure @redcanary @mvelazco @Cyb3rPandaH @Cyb3rWard0g @OTR_Community