encryption
XOR is often used in information security to encrypt data. A good example of this is in the creation of a one-time pad. A one-time pad is a type of encryption in which a message in encrypted by combining a randomly generated key. Because the key is completely random, an
blueteam
What is Yara The pattern matching swiss knife for malware researchers (and everyone else) To me Yara is regex with logic and metadata. It allows you to create rules to match patterns in data and adding matadata to give it more context. You can run yara as a executable or
detection
In this post I will cover Miters Process Injection (T1055) and some ways that you can detect it and prove it's working. Process Injection I will not go into to much detail on Process Injection here. If you want a deep dive, I recommend Endgames blog post. I
detection
Cobalt Strike is threat emulation software. It is a proprietary product used by... well who ever can afford it. However, it has been reverse engineered and some code leaked. Also, security researchers have extensively scrutinized it. For example, some people have noticed a pattern in Cobalt Strike use of Named
cve
Having been asked to look into CVE-2020-0601 for work, I thought I'd share what I learned. What is it? It is a flaw in the way Microsoft was validating Elliptic Curve Cryptography (ECC) certificates. This flaw affected all ECC certificates, including Microsofts own ECC MicrosoftECCProductRootCertificateAuthority.cer. Why this
ssh
In this tutorial we will secure SSH by disabling root logon and logon with a password. Prerequisites I will be using two Ubuntu vagrant machines however this should work on most systems with SSH. Keep in mind the paths and files may differ across different systems. Step 1: Create RSA
sudo
In this tutorial we will secure Sudo by enabling logging. Giving us the ability to replay a users session. Prerequisites I will be using Ubuntu however this should work on most systems with sudo. Keep in mind the paths and files may differ across different systems. Enable SUDO Logging There
sudo
For Debian based systems Basic Logging methods Log what sudo did (/var/log/auth.log) Debugging (/var/log/sudo_debug) Full session capture (/var/log/sudo-io) With these three you can customize the level of logging needed for your environment. VISUDO You should always use visudo to edit the /etc/