Abhijith Rao – Medium

Sep 1, 2021

Lateral Movement Detections: PsExec/Like-PsExec tools activity

Lateral movement (TA0008) continues to strongly remain a core tactic used by attackers where the successful activity leads to huge impact to the effected organization. In fact, this stage magnifies the attacker’s goals or objectives. In this blog post, let us go through some of the tools used by attackers…

Threat Hunting

7 min read

Lateral Movement Detections: PsExec/Like-PsExec tools activity

Threat Hunting

7 min read

Aug 18, 2020

Linux Threat Hunting — Know your Penguins

The attacks on the Linux system are common since decades, but how common are Linux logs collected and processed for better detections? This blog highlights how open source platform can be leveraged in detecting simple to sophisticated attacks with bunch of rules and configurations on the endpoint. How interesting it…

Threat Hunting

4 min read

Threat Hunting

4 min read

Mar 28, 2020

BRO/ZEEK — The Modern Watchtower

Network traffic is always noisy. But sometimes it whispers too. So, why not pay a very close attention when it whispers “BRO” 🦊 This blog talks solely about well-known Network Security Monitoring (NSM) Tool — ZEEK (formerly known as BRO). Being an open-source platform, Zeek is the perfect choice as…

Blue Team

5 min read

Blue Team

5 min read

Mar 14, 2020

Insights on Kerberos Attacks

Dogs are playful so are the Kerberos. This attribution to 3 headed-dog is from Greek Mythology which was known for guarding the gates of Hades. Similarly, Kerberos protocol in other hand was built in 1980s keeping in mind to secure the resources in the networked environment. While Kerberos is…

Red Team

5 min read

Red Team

5 min read

Feb 24, 2020

Threat Hunting with ELK + Wazuh

With Sysmon configured on endpoints, ELK + Wazuh stack will facilitate greatly in performing Threat Hunting operations. We know that threat landscape is increasing exponentially day by day and perpetrators are employing sophisticated techniques to fly always under radar. So, it is highly important for SOC teams to accelerate the…

Sysmon

4 min read

Sysmon

4 min read