Angriffsphasen verstehen: Cyber-Kill-Chain in Unternehmens-IT und Industrieanlagen

Cyberangriffe folgen einem erkennbaren Muster, das sich systematisch in Phasen unterteilen lässt. Das etablierte Kill-Chain-Modell bietet Sicherheitsverantwortlichen einen Rahmen zur Analyse und Verteidigung.

https://www.all-about-security.de/angriffsphasen-verstehen-cyber-kill-chain-in-unternehmens-it-und-industrieanlagen/

#CyberKillChain #Cyberangriffe #cybersecurity #OTsecurity

Autonome APTs: Die Claude-basierte Operation wird nicht die letzte sein

Die Aufdeckung einer neuen KI-gestützten APT wird oft als Beleg gesehen, dass Sicherheitssysteme funktionieren. Tatsächlich zeigt der Fall jedoch das Gegenteil: Er macht sichtbar, was bislang unentdeckt im Untergrund reifte.

https://www.all-about-security.de/autonome-apts-die-claude-basierte-operation-wird-nicht-die-letzte-sein/

#claude #apt #ki #autonomeAPTs #CredentialHarvesting #backdoor #CyberKillChain #cybersecurity

KillChainGraph → new ML framework mapping attacker behavior w/ Cyber Kill Chain + MITRE ATT&CK.
🔹 Ensemble ML: BERT, Transformers, GNN, LightGBM
🔹 Outputs graphs of attack paths
🔹 Helps analysts anticipate adversary moves
💬 Should SOCs embrace predictive ML, or does analyst intuition still matter most?
Follow @technadu for more cyber insights.

#CyberSecurity #MITREATTACK #CyberKillChain #MachineLearning #SOC #ThreatIntel

Успешная атака по кусочкам: тестируем фреймворки кибербезопастности MITRE ATT&CK и Cyber Kill Chain

Статья напраленна на анализ кибератаки, основанный на использовании всемиизвестными фрэймворками: MITRE ATT&CK и Cyber Kill Chain . Публикация напасана с целью, рассматреть, как эти модели дополняют друг друга, помогая выявлять уязвимости в защите, улучшить процессы обнаружения и реагирования на угрозы. Статья будет полезна специалистам по информационной безопасности, аналитикам угроз и всем, кто интересуется современными подходами к анализу кибератак.

https://habr.com/ru/articles/886972/

#MITRE_ATTACK #CyberKillChain #ИнформационнаяБезопасность #кибербезопасность #ThreatAnalysis #ThreatIntelligence #SOC #redteam #blueteam #IncidentResponse

Think like your adversaries. While they may have a singular goal in mind, it’s likely that their path to get there is non-linear. In a new blog, Richard Bejtlich (@taosecurity) talks about why #cyber defenders should be cautious of linear thinking and applies “the kill web”—an evolved take on the “kill chain” from the United States Department of Defense—to #cybersecurity. https://corelight.com/blog/kill-webs

#CyberKillChain #Cybersecurity #DFIR #NetworkMonitoring #NetworkSecurity

In a new blog, Richard Bejtlich (@taosecurity) proposes ways that modern network-derived evidence applies to the #cyber kill chain—a concept created by Eric Hutchins, Michael Cloppert, and Rohan Amin that changed how security teams approach defending their digital assets. https://corelight.com/blog/kill-chain-and-network-derived-evidence

@corelight’s network-derived evidence is based on ZeekⓇ (@zeek), the world's most widely used network security monitoring platform. Learn more: https://corelight.com/products/zeek/

#CyberKillChain #Cybersecurity #DFIR #Zeek #NetworkMonitoring #NetworkSecurity

In 2010, three researchers with Lockheed Martin—Eric Hutchins, Michael Cloppert, and Rohan Amin—published a paper that adapted the military targeting framework called “the cyber kill chain” to #cybersecurity. Although adaptations and extensions have been suggested over the years, the fundamental construct of the cyber kill chain is still applicable to modern #CyberDefense. In our new primer, we take a look at:

1. What the cyber kill chain is and how #security teams are still using it to make adjustments to their defensive posture
2. The kill chain sequence and how it helps teams anticipate, detect, and deter Advanced Persistent Threats (APTs)
3. How #NDR aids with #cyber forensics during several stages of the kill chain sequence and can be used to build evidence of a #cyberattack

Check it out ➡️ https://corelight.com/resources/glossary/cyber-kill-chain

#CyberKillChain #DFIR #NetworkSecurity

Nearly done with prep-work for an internal talk on the installation phase of the #cyberkillchain. Using Sliver C2 to install a beacon as a systems service, then pivoting to an "internal" Windows server where a TCP session relay through is run in memory

All around fun stuff!

#Infosec