Joris L.

📧 𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗗𝗠𝗔𝗥𝗖 𝘄𝗼𝗿𝗸? Email remains one of the most exploited attack vectors — from phishing to spoofing. That’s where DMARC (Domain-based Message Authentication, Reporting & Conformance) comes in. It builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to add a strong layer of trust and visibility. Here’s how it works: 1️⃣ Email is sent from the sender. 2️⃣ Mail server receives and evaluates the message. 3️⃣ SPF confirms if the sender is authorized. 4️⃣ DKIM validates the authenticity of the email signature. 5️⃣ If both checks pass → ✅ email goes to the inbox. ❌ If either fails → DMARC policy applies (quarantine, reject, or drop). 📊 Reports are sent to the domain owner for visibility & tuning. 💡 With DMARC, organizations gain not just protection against fraud, but also actionable insights into who’s using their domain. 👉 Question for you: Do you think companies are doing enough to enforce DMARC — or is email security still being underestimated? 🔔 Follow e-Learn Cyber Security for more cybersecurity tips! #CyberSecurity #EmailSecurity #Phishing #DMARC #InfoSec

328

14 Comments

🛡️ Hackers Exploit WerFaultSecure Tool to Steal Cached Passwords From LSASS on Windows 11 24H2 | Read more: https://lnkd.in/dnU9dmvX Threat actors are leveraging the legacy Windows error‐reporting utility WerFaultSecure.exe to extract the memory region of the Local Security Authority Subsystem Service (LSASS.EXE) and harvest cached credentials from fully patched Windows 11 24H2 systems. After gaining initial access to a host, adversaries frequently seek to dump LSASS memory to escalate privileges and move laterally across the network. #cybersecuritynews #windows11

601

13 Comments

🚨 New CTI Labs: CVE-2025-53770 (ToolShell SharePoint RCE) 🚨 This critical zero-day vulnerability allows for a full, unauthenticated takeover of on-premise SharePoint servers and has already been added to the CISA KEV Catalog. With a public exploit now available, the threat is immediate. We've just launched two new CTI Labs giving teams hands-on experience with this exact threat from both sides of the attack. 🛡️ Defensive Lab: For System Admins, SOC Analysts, Incident Responders, and Threat Hunters to practice detection and response: https://hubs.ly/Q03yNqNm0 ⚔️ Offensive Lab: For Red Teamers, Penetration Testers, and Threat Hunters to understand and execute the exploit chain: https://hubs.ly/Q03yNq5w0 Prepare your teams for the real world. Get hands-on with CVE-2025-53770 today. #CTI #SharePointRCE #CVE

91

5 Comments

🔎 New Resource: Windows Registry Forensics — Practical Guide for DFIR & SOC Analysts 🧰🖥️ Just reviewed a concise, hands‑on Windows forensics cheat sheet that every incident responder and SOC analyst should keep in their toolkit. If you work with endpoint investigations, timeline reconstruction, or digital evidence collection, this guide is pure gold — it focuses on the registry hives and artifacts that reveal user activity, system configuration, and device history. What you’ll find at a glance: Where the hives live (offline & live): SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, USRCLASS.DAT and their .log/.sav/.alt variants — what each file contains and why it matters for triage. Key artifacts & what they reveal: SYSTEM → ControlSet, ComputerName, TimeZone, network interfaces (useful for boot/OS context and network history). SAM → Local account RIDs, last login, failed logons (account activity indicators). NTUSER.DAT / USRCLASS.DAT → RecentDocs, TypedPaths, Open/Save MRUs, ShellBags (user file and folder activity). ShimCache & AmCache → Execution artifacts (file paths, timestamps, file hashes) for process execution timelines. UserAssist & BAM/DAM → GUI-launched apps, background activity and last-run info. USB Forensics → USBSTOR/Enum keys (vendor/product IDs, serials, first/last plug times). Practical parsing & triage tools: KAPE for targeted acquisitions, Eric Zimmerman’s Registry Explorer & ShellBag Explorer for analysis, RegRipper for automated extraction and reporting. Common registry locations for investigations: autoruns, services, RDP/NetworkList, Office MRUs — quick map to probable evidence locations when time is limited. Why this matters for responders Registry artifacts are often the fastest path to establish: Who used the machine and when (user sessions, MRUs); What ran and when (ShimCache/AmCache/UserAssist); How a device connected to the network or external media (interfaces, USBSTOR); Which configuration was active at boot (ControlSet selection, timezone) — critical for accurate timeline correlation. Pro tips included in the guide Prefer offline hive parsing to avoid altering timestamps; locate hives under C:\Windows\System32\config and user profiles. Use tools that merge transaction logs for the most up‑to‑date view of a hive (Registry Explorer vs. simple regedit views). Start with RegRipper plugins for quick triage, then deep-dive with Zimmerman tools and manual inspection for context and validation. Always document the hive source, acquisition method, and any tool versions used — auditability matters. If you’re building runbooks for triage, training junior analysts, or tightening up your SOC playbooks, this registry-focused cheat sheet will speed investigations and improve evidence quality. #DFIR #WindowsForensics #IncidentResponse #SOC #RegistryForensics #DigitalForensics #ThreatHunting #CyberSecurity #KAPE #RegRipper #WindowsSecurity

186

1 Comment

Microsoft has released its September security updates. This included: • 81 vulnerabilities patched. • 0 vulnerabilities with evidence of exploitation. • 9 'Critical' rated. The ASD’s ACSC encourages all users to apply the available patch updates ASAP👉 https://lnkd.in/dHpTjmk8

91

1 Comment

⚠️ 𝗥𝗶𝘀𝗸 𝗔𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁: 𝗧𝗵𝗲 𝗙𝗼𝘂𝗻𝗱𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 ⚠️ Every strong cybersecurity strategy starts with one critical process: Risk Assessment. Without it, organizations are blind to where their true vulnerabilities lie. Here’s the step-by-step process: 1️⃣ Identify Assets & Data – List hardware, software, networks, and applications that need protection. 2️⃣ Identify Threats – Brainstorm possible cyber threats targeting those assets. 3️⃣ Identify Vulnerabilities – Map out weaknesses that could be exploited. 4️⃣ Determine Likelihood – Assess the chances of an attack based on motives & attacker capabilities. 5️⃣ Determine Impact – Estimate the potential business damage if a threat is successful. 6️⃣ Determine Risk Score – Multiply likelihood × impact to calculate risk levels. 7️⃣ Compare With Risk Appetite – Decide if the risk is acceptable or requires treatment. 8️⃣ Risk Treatment – Apply security controls to mitigate unacceptable risks. 9️⃣ Document & Monitor – Continuously track, update, and refine risk assessments. 🔐 A well-executed risk assessment doesn’t just check compliance boxes—it enables smarter decision-making, prioritization, and proactive defense. 👉 How often does your organization perform risk assessments—quarterly, annually, or continuously? 🔔 Follow Tech Talks for expert tips and updates on top tech courses like Cybersecurity, BigData, DevOps, AI, ML, Development, Testing, Marketing & more! #CyberSecurity #RiskManagement #RiskAssessment #InfoSec #Governance

137

8 Comments

Microsoft is sharing details from ongoing investigations of threat actors exploiting vulnerabilities targeting internet-facing on-premises SharePoint servers. As of this writing, Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting these vulnerabilities. In addition, we have observed another China-based threat actor, tracked as Storm-2603, using the exploits. https://msft.it/6044sE1ua Microsoft has released new comprehensive security updates for all supported versions of SharePoint Server (Subscription Edition, 2019, and 2016) that protect customers against these new vulnerabilities. Microsoft assesses that threat actors will continue to integrate the exploits into their attacks against unpatched on-premises SharePoint systems. Customers should apply these updates immediately to ensure they are protected: https://msft.it/6045sE1ux Read our blog to get TTPs, IOCs, and protection, detection, and hunting guidance:

283

4 Comments

Every great product starts with a question. For us, it was this: 𝗵𝗼𝘄 𝗱𝗼 𝘆𝗼𝘂 𝘀𝗲𝗰𝘂𝗿𝗲 𝘄𝗵𝗮𝘁 𝘆𝗼𝘂 𝗰𝗮𝗻’𝘁 𝗲𝘃𝗲𝗻 𝘀𝗲𝗲? Years of pentesting showed us the biggest risks weren’t always sophisticated attacks; they were the unknown APIs. Shadow endpoints from quick sprints, old routes left alive, test APIs forgotten after launch. Invisibility itself had become the vulnerability. This post is a glimpse into the incredible team that turned that challenge into reality. Months of design, engineering, and countless user conversations led to the 𝗔𝘀𝘁𝗿𝗮 𝗔𝗣𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺, built to uncover the unseen, test like an attacker, and help teams secure their APIs before risks spiral. 👉 Check out the platform and see it in action: https://lnkd.in/grc7Ftfc

37

🔴 CISA Issues Alert: Citrix Vulnerabilities Under Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three newly observed CVEs to its Known Exploited Vulnerabilities (KEV) Catalog, based on confirmed evidence of active exploitation. 📌 While Binding Operational Directive (BOD) 22-01 mandates federal agencies to remediate these vulnerabilities, CISA strongly urges all organizations to: ✔️ Continuously monitor the KEV Catalog ✔️ Assess exposure to listed CVEs ✔️ Prioritize patching or apply compensating controls immediately 💡 Especially for enterprises leveraging Citrix Session Recording and CI/CD pipelines, timely remediation is critical to reduce risk and strengthen resilience. 🔗 Read more via CISA KEV Catalog: https://lnkd.in/gRGpREQS #CISA #Citrix #Vulnerability #CyberSecurity #ThreatIntelligence #KEVCatalog #DataBreach #ThreatMon

22

1 Comment