Scott Arenson

Understanding how to utilize Kroll Artifact Parser and Extractor (KAPE) can significantly enhance your forensic analysis capabilities. KAPE is a tool designed to parse and extract Windows forensics artifacts swiftly, expediting incident response processes. KAPE operates through the concepts of targets and modules. Targets are the forensic artifacts to be collected, while modules are programs that process these artifacts to extract information. With KAPE, you can collect files from live systems or storage devices and process them efficiently. Using KAPE involves configuring targets and modules. Targets specify what artifacts to collect, and modules dictate how to process them. Compound targets allow for the collection of multiple artifacts with a single command, streamlining the triage process. Understanding the structure of KAPE files (.tkape for targets, .mkape for modules) is essential. These files define the paths, categories, and file masks for collection. Similarly, modules (.mkape) specify the commands to run on collected data and their output formats. KAPE's functionality extends to the command line, offering flexibility and automation. Commands can be crafted to specify target sources, destinations, and module processing, granting fine-grained control over forensic procedures. Additionally, batch mode enables the execution of multiple commands in sequence, ideal for repetitive tasks. In a cybersecurity analyst position, mastering KAPE empowers you to conduct efficient forensic analysis, aiding in incident response, evidence collection, and data processing. Through KAPE, you can streamline workflows, optimize resource utilization, and bolster your investigative capabilities. TryHackMe Merit America

2

Watch Your Word Templates "AhnLab SEcurity intelligence Center (ASEC) recently confirmed that RemcosRAT is being distributed using steganography techniques. Starting with a Word document using the Template Injection technique, download and run RTF that uses the equation editor (EQNEDT32.EXE) vulnerability. RTF downloads a VBScript with the “.jpg” extension from C2 and additional VBScript from “paste.ee”, a service similar to “Pastebin” that lets you upload text for free. The downloaded VBScript is obfuscated with several special characters and ultimately executes the PowerShell Script through Replace." Like this? Subscribe to Cyberwarfare, Espionage & Extortion for more: https://bit.ly/3HnJbKx

1

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment

One of the challenges in addressing compromised credentials is the elapsed time between the credential compromise and the malicious credential use. Often, the attacker won't turn around and use the compromised credentials immediately, but will sell them to someone for later use. That means that when an attack occurs using those credentials, the victim (both individual and organization) have a very difficult time connecting the attack to the event in which the credentials were compromised. There are two consequences out of this reality. First, organizations need artificial motivation to prevent credential compromises, such as regulatory requirements. If the probability is that credentials stolen from me won't be used against me at all, then my risk is low unless something else, like a fine, changes that equation. Second, ever organization needs to implement controls to protect against attacks using credentials stolen elsewhere. These can be implemented at the point of credential creation, i.e. don't create accounts with known-compromised passwords. They can also be implemented at the point of password use, i.e. multi-factor authentication and validating passwords against known-compromised lists.

6

Southern California study finds high levels of airborne plasticizers

1

Two key pieces of Cybersecurity advice (among a ton) for MSPs at #ChannelCon session from Matt Lee, CISSP, CCSP, CFR, PNPT and Jason Slagle: learn offense and lean into frameworks

40

5 Comments

The much anticipated SoCal CISO Summit is less than one month away! Join Co-Chairs Matt Crouse, CISO, Solar Turbines and Delaram "Lara" Divi, VP, CISO, Dine Brands Global for this session, recapping their journey into IAM implementation. The path to a stronger IAM starts with the customer, whether you’re in the public sector, or selling coffee. CISOs are often challenged with trying to create the best user experience and keeping the company secure. But It’s not just about security it is also about the business. Gaining buy in and building better relationships is key. Join this session to learn: -Why passwordless implementation is a game-changer -How to strengthen relationships with business and tech teams -Where to find solutions for credential stuffing Current community members, register at My.Evanta.com. New members apply to join below! #evantaciso #socalciso #iam

24

How does a TLS handshake work? In this Root Causes Podcast episode Jason Soroko and I give a high-level explanation of what happens in a TLS 1.3 handshake and then discuss what will happen when PQC is included. https://lnkd.in/gkKqFyWV #pki #security #ssl

23

1 Comment

What tools do you know of that allow building SSVC decision trees at scale? Do any exist? I believe some vendors in the risk based vuln mgmt sector can utilize rules to build some level of decision tree.. But I'm not sure how deep that goes. - Does anyone know tools that help with this? - If you are currently doing SSVC, what technology are you using to accomplish it across hundreds of thousands of vulnerabilities with and without CVE's? #VulnerabilityManagement #SSVC #Security #CVSS #CVE

17

17 Comments

EVERYTHING is overlapping. Identity of humans is overlapping with identity of non-humans. (I'll have more to say about that later.) And, as David Lee notes, identity and cybersecurity are overlapping. "But here’s the issue: cybersecurity professionals are often unfamiliar with the complexities of identity governance. On the flip side, identity teams don’t always have the expertise needed to manage the broader security landscape—threat intelligence, vulnerability management, and incident response. "If we’re going to keep up with evolving threats, cross-training in both fields isn’t just a nice-to-have—it’s essential." #identity #cybersecurity #biometricproductmarketingexpert #id30and9 https://lnkd.in/g2tqd5_R

4

It is easy to protect PL/SQL from leaking your algorithms and code. - https://lnkd.in/eppqxvjw #plsql #protect #securecode

7

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

Read this important advisory from CISA regarding Operational Technology and Industrial Control Systems vulnerabilities. #ICSsecurity #OTsecurity

13

1 Comment

history4feed: creates a complete full text historical archive for an #RSS or #ATOM feed. ...and this one is not solely for those working #threatintelligence. https://lnkd.in/eK4Kgiug

8

1 Comment

⚡️Some domains likely used by #transparentTribe #APT36 counciling[.]com nbssedelhi[.]org ashifdigitalseva[.]xyz birthdeath[.]in gov-certificate[.]com viewss[.]click admin-mcas-df[.]ms admin-mcas[.]ms mcas-df[.]ms mcas[.]ms verifycertificate[.]info nimsme[.]org

1

1 Comment