Sybrand Doevendans

📧 𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗗𝗠𝗔𝗥𝗖 𝘄𝗼𝗿𝗸? Email remains one of the most exploited attack vectors — from phishing to spoofing. That’s where DMARC (Domain-based Message Authentication, Reporting & Conformance) comes in. It builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to add a strong layer of trust and visibility. Here’s how it works: 1️⃣ Email is sent from the sender. 2️⃣ Mail server receives and evaluates the message. 3️⃣ SPF confirms if the sender is authorized. 4️⃣ DKIM validates the authenticity of the email signature. 5️⃣ If both checks pass → ✅ email goes to the inbox. ❌ If either fails → DMARC policy applies (quarantine, reject, or drop). 📊 Reports are sent to the domain owner for visibility & tuning. 💡 With DMARC, organizations gain not just protection against fraud, but also actionable insights into who’s using their domain. 👉 Question for you: Do you think companies are doing enough to enforce DMARC — or is email security still being underestimated? 🔔 Follow e-Learn Cyber Security for more cybersecurity tips! #CyberSecurity #EmailSecurity #Phishing #DMARC #InfoSec

328

14 commentaren

🔎 New Resource: Windows Registry Forensics — Practical Guide for DFIR & SOC Analysts 🧰🖥️ Just reviewed a concise, hands‑on Windows forensics cheat sheet that every incident responder and SOC analyst should keep in their toolkit. If you work with endpoint investigations, timeline reconstruction, or digital evidence collection, this guide is pure gold — it focuses on the registry hives and artifacts that reveal user activity, system configuration, and device history. What you’ll find at a glance: Where the hives live (offline & live): SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, USRCLASS.DAT and their .log/.sav/.alt variants — what each file contains and why it matters for triage. Key artifacts & what they reveal: SYSTEM → ControlSet, ComputerName, TimeZone, network interfaces (useful for boot/OS context and network history). SAM → Local account RIDs, last login, failed logons (account activity indicators). NTUSER.DAT / USRCLASS.DAT → RecentDocs, TypedPaths, Open/Save MRUs, ShellBags (user file and folder activity). ShimCache & AmCache → Execution artifacts (file paths, timestamps, file hashes) for process execution timelines. UserAssist & BAM/DAM → GUI-launched apps, background activity and last-run info. USB Forensics → USBSTOR/Enum keys (vendor/product IDs, serials, first/last plug times). Practical parsing & triage tools: KAPE for targeted acquisitions, Eric Zimmerman’s Registry Explorer & ShellBag Explorer for analysis, RegRipper for automated extraction and reporting. Common registry locations for investigations: autoruns, services, RDP/NetworkList, Office MRUs — quick map to probable evidence locations when time is limited. Why this matters for responders Registry artifacts are often the fastest path to establish: Who used the machine and when (user sessions, MRUs); What ran and when (ShimCache/AmCache/UserAssist); How a device connected to the network or external media (interfaces, USBSTOR); Which configuration was active at boot (ControlSet selection, timezone) — critical for accurate timeline correlation. Pro tips included in the guide Prefer offline hive parsing to avoid altering timestamps; locate hives under C:\Windows\System32\config and user profiles. Use tools that merge transaction logs for the most up‑to‑date view of a hive (Registry Explorer vs. simple regedit views). Start with RegRipper plugins for quick triage, then deep-dive with Zimmerman tools and manual inspection for context and validation. Always document the hive source, acquisition method, and any tool versions used — auditability matters. If you’re building runbooks for triage, training junior analysts, or tightening up your SOC playbooks, this registry-focused cheat sheet will speed investigations and improve evidence quality. #DFIR #WindowsForensics #IncidentResponse #SOC #RegistryForensics #DigitalForensics #ThreatHunting #CyberSecurity #KAPE #RegRipper #WindowsSecurity

184

1 commentaar

𝗧𝗵𝗶𝗻𝗸𝗶𝗻𝗴 𝗼𝗳 𝗯𝗲𝗰𝗼𝗺𝗶𝗻𝗴 𝗮 𝗦𝗢𝗖 𝗔𝗻𝗮𝗹𝘆𝘀𝘁? Here’s your 15-step roadmap: 🔹 Networking & Security Basics 🔹 Cyber Threats & SOC Tools 🔹 Log Analysis & Incident Response 🔹 Threat Intel & Vulnerability Mgmt 🔹 Malware Analysis & Forensics 🔹 Policies, Threat Hunting & Soft Skills Master these, and you’re on your way to defending against modern cyber threats. Which skill do you think is most critical for SOC success? 🔔 Follow Tech Talks for expert tips and updates on top tech courses like Cybersecurity, BigData, DevOps, AI, ML, Development, Testing, Marketing & more! #CyberSecurity #SOCAnalyst #BlueTeam #InfoSec #CareerGrowth

757

17 commentaren

🚨 New CTI Labs: CVE-2025-53770 (ToolShell SharePoint RCE) 🚨 This critical zero-day vulnerability allows for a full, unauthenticated takeover of on-premise SharePoint servers and has already been added to the CISA KEV Catalog. With a public exploit now available, the threat is immediate. We've just launched two new CTI Labs giving teams hands-on experience with this exact threat from both sides of the attack. 🛡️ Defensive Lab: For System Admins, SOC Analysts, Incident Responders, and Threat Hunters to practice detection and response: https://hubs.ly/Q03yNqNm0 ⚔️ Offensive Lab: For Red Teamers, Penetration Testers, and Threat Hunters to understand and execute the exploit chain: https://hubs.ly/Q03yNq5w0 Prepare your teams for the real world. Get hands-on with CVE-2025-53770 today. #CTI #SharePointRCE #CVE

91

5 commentaren

Credential Dumping: Phishing Windows Credentials 🔥 Telegram: https://lnkd.in/gUg4D87P ✴ Twitter: https://lnkd.in/gsU9REvg In this article, we will trigger various scenarios where Windows will ask for the user to perform authentication and retrieve the credentials. 💣 Metasploit Framework 🎯 phish_windows_credentials 🖥️ FakeLogonScreen 🔒 SharpLocker ⚡ PowerShell Empire 📩 Collection/prompt 🍞 Collection/toasted 🕵️ Koadic 🗝️ Password_box 💻 PowerShell 📜 Invoke-CredentialsPhish.ps1 📜 Invoke-LoginPrompt.ps1 🔐 Lockphish ✅ Conclusion #infosec #cybersecurity #cybersecuritytips #microsoft #redteam #informationsecurity #CyberSec #ai #offensivesecurity #infosecurity #cyberattacks #security #oscp #cybersecurityawareness #bugbounty #bugbountytips

105

4 commentaren

Microsoft has released its September security updates. This included: • 81 vulnerabilities patched. • 0 vulnerabilities with evidence of exploitation. • 9 'Critical' rated. The ASD’s ACSC encourages all users to apply the available patch updates ASAP👉 https://lnkd.in/dHpTjmk8

91

1 commentaar