Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research! https://teapawt.net/t.co/j62Xx21lEc
Datastore
Joined September 2019
- Tweets66
- Following5
- Followers2.1K
- Likes98
🚨 Collecting and sharing logs from the ☁️
🙏 Thanks to project SimuLand 🏝️ (an @OTR_Community Initiative), we are starting to collect data from known community templates & emulation plans 😎
🌩️AWS Dateset: mordordatasets.com/notebooks…
🏗️ SimuLand: github.com/OTRF/SimuLand/tre…
Security Datasets retweeted
Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT
Security Datasets retweeted
🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻
Help us build the largest library of datasets for the InfoSec community! 🚀
Site: securitydatasets.com/introdu……
Repo: github.com/OTRF/Security-Dat…
We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community
😈 Data: mordordatasets.com/notebooks…
🛡️@sigma_hq rules:
1⃣ github.com/SigmaHQ/sigma/blo…
2⃣ github.com/SigmaHQ/sigma/blo…
How Do I use the data? ⏬
#HuntingTipOfTheDay
Search for command lines 🔎with 'comsvcs.dll' and 'MiniDump' to find credential dumping. 👀
✏️Test your detections: gist.github.com/JohnLaTwC/3e…
📎References:
▪️risksense.com/blog/hidden-ge… by Jenna Magius and Nate Caroe (@RiskSense)
▪️modexp.wordpress.com/2019/08…
Security Datasets retweeted
Importance of data sets for SecOps research and rule testing with projects by @SBousseaden, @Mordor_Project, @Cyb3rWard0g's SimuLand
Security Datasets retweeted
🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike
🗒️Metadata: mordordatasets.com/notebooks…
😈Dataset: raw.githubusercontent.com/OT…
APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with
- NamedPipe Creation
- Service installation & exec pattern
- HTTP beaconing
github.com/NextronSystems/AP…
If you want to help, add some steps in here:
github.com/NextronSystems/AP…
Security Datasets retweeted
It's time to go to SimuLand! 🎠🎡🎢
But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses.
Get the details: msft.it/6017VxcHv
Hello @DebugPrivilege ! Thank you for reaching out. Yes, that's in the process. We are coordinating in the @OTR_Community to make it happen. It is nice to get requests from the community 😊 we are expanding to cloud datasets so this is nice! 🙏
Security Datasets retweeted
Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏
mordordatasets.com/notebooks…
1⃣ A few tool-based comments at the host level
2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥
Read the blog at: o365blog.com/post/adfs/
Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!
Happy to see you are using the @Mordor_Project ! The project comes with small (atomic) and large (campaigns) datasets.
One great example of how to use our large datasets is this post by @filar (APT3) elastic.co/blog/discovering-…
😈 Endpoint dataset: built-in & Sysmon telemetry 🛡️
Doc: mordordatasets.com/notebooks…
✅ Web shell created
✅ Unexpected compiled ASPX files created by w3wp in Temporary ASP[.]NET Files directory
✅ OabVirtualDirectory ExternalUrl set to <script>
✅ w3wp child process & more
Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community
1⃣ Creation: mordordatasets.com/notebooks…
2⃣ Update: mordordatasets.com/notebooks…
@HunterPlaybook Library Doc: github.com/OTRF/ThreatHunter…
Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜
THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! bit.ly/33AKlil
Security Datasets retweeted
Big news ya'll: @Cyb3rWard0g will be hosting our next Atomic Friday on December 11! Join us for a deep dive into @Mordor_Project and learn strategies for expediting data analysis. bit.ly/33AKlil
Security Datasets retweeted
Don`t Forget to checkout Project SimuLand for
☁️Cloud Datasets
mordordatasets.com/notebooks…
Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules!
Thank you @rbmaslen @domchell @tifkin_ @OTR_Community
😈 Dataset: mordordatasets.com/notebooks…
🏹 @sigma_hq:
1) github.com/OTRF/sigma/blob/m…
2) github.com/OTRF/sigma/blob/m…
Security Datasets retweeted
So cool to see this! 👍
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !
😈 mordordatasets.com/notebooks…
If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !
😈 mordordatasets.com/notebooks…
I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging.
herpaderping.com/