309 lines
44 KiB
HTML
309 lines
44 KiB
HTML
|
<!doctype html>
|
||
|
<html lang="en">
|
||
|
<center>
|
||
|
<head>
|
||
|
|
||
|
|
||
|
<script src="https://cdn.jsdelivr.net/npm/fuse.js/dist/fuse.js"></script>
|
||
|
<!-- mathjax -->
|
||
|
<script src="https://code.jquery.com/jquery-3.5.1.min.js"></script>
|
||
|
<script type="text/javascript" src="/static/js/auto-complete.js"></script>
|
||
|
<script type="text/javascript" src="/static/js/lunr.min.js"></script>
|
||
|
<script type="text/javascript" src="/static/js/search.js"></script>
|
||
|
<link rel="stylesheet" href="/static/stylesheet.css">
|
||
|
<link rel="stylesheet" href="/static/auto-complete.css">
|
||
|
<br>
|
||
|
<title>In the Open</title>
|
||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
|
|
||
|
|
||
|
</head>
|
||
|
<body>
|
||
|
<!-- topmenu -->
|
||
|
<div class="menu">
|
||
|
<a href="/" style="text-decoration:none">In the Open</a>
|
||
|
</div>
|
||
|
<div class="search-container">
|
||
|
<label for="search-by"><i class="fas fa-search"></i></label>
|
||
|
<input data-search-input="" id="search-by" type="search" placeholder="Search..." autocomplete="off">
|
||
|
<!--button type="submit"><i class="search"></i>🔍</button>-->
|
||
|
<span data-search-clear=""><i class="fas fa-times"></i></span>
|
||
|
</div>
|
||
|
|
||
|
</div>
|
||
|
<div class="menu">
|
||
|
</div>
|
||
|
<!--br><br-->
|
||
|
</center>
|
||
|
<p></p>
|
||
|
<div class="columns">
|
||
|
<!-- Sidebar -->
|
||
|
<div class="column column-1">
|
||
|
<ul><details id=crypto ontoggle="linkClick(this); return false;" ><summary>Crypto</summary><ul><details id=openssl ontoggle="linkClick(this); return false;" ><summary>Openssl</summary><ul><li><a href="/crypto/openssl/openssl.html">openssl</a></li><li><a href="/crypto/openssl/openssl_engine.html">openssl_engine</a></li></ul></details><li><a href="/crypto/rsa.html">rsa</a></li></ul></details><details id=enumeration ontoggle="linkClick(this); return false;" ><summary>Enumeration</summary><ul><details id=containers ontoggle="linkClick(this); return false;" ><summary>Containers</summary><ul></ul></details><details id=docs ontoggle="linkClick(this); return false;" ><summary>Docs</summary><ul><li><a href="/enumeration/docs/aws.html">aws</a></li><li><a href="/enumeration/docs/cewl.html">cewl</a></li><li><a href="/enumeration/docs/dns.html">dns</a></li><li><a href="/enumeration/docs/docker_enumeration.html">docker_enumeration</a></li><li><a href="/enumeration/docs/ffuf.html">ffuf</a></li><li><a href="/enumeration/docs/gobuster.html">gobuster</a></li><li><a href="/enumeration/docs/kerberoast.html">kerberoast</a></li><li><a href="/enumeration/docs/kubectl.html">kubectl</a></li><li><a href="/enumeration/docs/ldap.html">ldap</a></li><li><a href="/enumeration/docs/linux_basics.html">linux_basics</a></li><li><a href="/enumeration/docs/microk8s.html">microk8s</a></li><li><a href="/enumeration/docs/nfs.html">nfs</a></li><li><a href="/enumeration/docs/nikto.html">nikto</a></li><li><a href="/enumeration/docs/nmap.html">nmap</a></li><li><a href="/enumeration/docs/port_knocking.html">port_knocking</a></li><li><a href="/enumeration/docs/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/docs/rsync.html">rsync</a></li><li><a href="/enumeration/docs/rustscan.html">rustscan</a></li><li><a href="/enumeration/docs/shodan.html">shodan</a></li><details id=snmp ontoggle="linkClick(this); return false;" ><summary>Snmp</summary><ul><li><a href="/enumeration/docs/snmp/onesixtyone.html">onesixtyone</a></li><li><a href="/enumeration/docs/snmp/snmpcheck.html">snmpcheck</a></li></ul></details><li><a href="/enumeration/docs/websites.html">websites</a></li><li><a href="/enumeration/docs/wfuzz.html">wfuzz</a></li><li><a href="/enumeration/docs/wpscan.html">wpscan</a></li></ul></details><details id=network_scanners ontoggle="linkClick(this); return false;" ><summary>Network_scanners</summary><ul></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/enumeration/windows/bloodhound.html">bloodhound</a></li><li><a href="/enumeration/windows/event_log.html">event_log</a></li><li><a href="/enumeration/windows/manual_enum.html">manual_enum</a></li><li><a href="/enumeration/windows/powershell.html">powershell</a></li><li><a href="/enumeration/windows/rpcclient.html">rpcclient</a></li><li><a href="/enumeration/windows/sysinternals.html">sysinternals</a></li><li><a href="/enumeration/windows/sysmon.html">sysmon</a></li><li><a href="/enumeration/windows/vss.html">vss</a></li></ul></details></ul></details><details id=exfiltration ontoggle="linkClick(this); return false;" ><summary>Exfiltration</summary><ul><details id=dns ontoggle="linkClick(this); return false;" ><summary>Dns</summary><ul><li><a href="/exfiltration/dns/dns.html">dns</a></li></ul></details><details id=linux ontoggle="linkClick(this); return false;" ><summary>Linux</summary><ul><li><a href="/exfiltration/linux/nc.html">nc</a></li><li><a href="/exfiltration/linux/wget.html">wget</a></li></ul></details><details id=windows ontoggle="linkClick(this); return false;" ><summary>Windows</summary><ul><li><a href="/exfiltration/windows/evil-winrm.html">evil-winrm</a></li><li><a href="/exfiltration/windows/loot.html">loot</a></li><li><a href="/exfiltration/windows/smb_connection.html">smb_connection</a></li></ul></details></ul></details><details id=exploit ontoggle="linkClick(this); return false;" ><summary>Exploit</summary><ul><details id=CPUs ontoggle="linkClick(this); return false;" ><summary>CPUs</summary><ul><li><a href="/exploit/CPUs
|
||
|
</ul>
|
||
|
</div>
|
||
|
<div class="column column-2">
|
||
|
<span class="body">
|
||
|
<style>pre { line-height: 125%; }
|
||
|
td.linenos .normal { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
span.linenos { color: #37474F; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
td.linenos .special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
span.linenos.special { color: #607A86; background-color: #263238; padding-left: 5px; padding-right: 5px; }
|
||
|
.codehilite .hll { background-color: #2C3B41 }
|
||
|
.codehilite .c { color: #546E7A; font-style: italic } /* Comment */
|
||
|
.codehilite .err { color: #FF5370 } /* Error */
|
||
|
.codehilite .esc { color: #89DDFF } /* Escape */
|
||
|
.codehilite .g { color: #EEFFFF } /* Generic */
|
||
|
.codehilite .k { color: #BB80B3 } /* Keyword */
|
||
|
.codehilite .l { color: #C3E88D } /* Literal */
|
||
|
.codehilite .n { color: #EEFFFF } /* Name */
|
||
|
.codehilite .o { color: #89DDFF } /* Operator */
|
||
|
.codehilite .p { color: #89DDFF } /* Punctuation */
|
||
|
.codehilite .ch { color: #546E7A; font-style: italic } /* Comment.Hashbang */
|
||
|
.codehilite .cm { color: #546E7A; font-style: italic } /* Comment.Multiline */
|
||
|
.codehilite .cp { color: #546E7A; font-style: italic } /* Comment.Preproc */
|
||
|
.codehilite .cpf { color: #546E7A; font-style: italic } /* Comment.PreprocFile */
|
||
|
.codehilite .c1 { color: #546E7A; font-style: italic } /* Comment.Single */
|
||
|
.codehilite .cs { color: #546E7A; font-style: italic } /* Comment.Special */
|
||
|
.codehilite .gd { color: #FF5370 } /* Generic.Deleted */
|
||
|
.codehilite .ge { color: #89DDFF } /* Generic.Emph */
|
||
|
.codehilite .gr { color: #FF5370 } /* Generic.Error */
|
||
|
.codehilite .gh { color: #C3E88D } /* Generic.Heading */
|
||
|
.codehilite .gi { color: #C3E88D } /* Generic.Inserted */
|
||
|
.codehilite .go { color: #546E7A } /* Generic.Output */
|
||
|
.codehilite .gp { color: #FFCB6B } /* Generic.Prompt */
|
||
|
.codehilite .gs { color: #FF5370 } /* Generic.Strong */
|
||
|
.codehilite .gu { color: #89DDFF } /* Generic.Subheading */
|
||
|
.codehilite .gt { color: #FF5370 } /* Generic.Traceback */
|
||
|
.codehilite .kc { color: #89DDFF } /* Keyword.Constant */
|
||
|
.codehilite .kd { color: #BB80B3 } /* Keyword.Declaration */
|
||
|
.codehilite .kn { color: #89DDFF; font-style: italic } /* Keyword.Namespace */
|
||
|
.codehilite .kp { color: #89DDFF } /* Keyword.Pseudo */
|
||
|
.codehilite .kr { color: #BB80B3 } /* Keyword.Reserved */
|
||
|
.codehilite .kt { color: #BB80B3 } /* Keyword.Type */
|
||
|
.codehilite .ld { color: #C3E88D } /* Literal.Date */
|
||
|
.codehilite .m { color: #F78C6C } /* Literal.Number */
|
||
|
.codehilite .s { color: #C3E88D } /* Literal.String */
|
||
|
.codehilite .na { color: #BB80B3 } /* Name.Attribute */
|
||
|
.codehilite .nb { color: #82AAFF } /* Name.Builtin */
|
||
|
.codehilite .nc { color: #FFCB6B } /* Name.Class */
|
||
|
.codehilite .no { color: #EEFFFF } /* Name.Constant */
|
||
|
.codehilite .nd { color: #82AAFF } /* Name.Decorator */
|
||
|
.codehilite .ni { color: #89DDFF } /* Name.Entity */
|
||
|
.codehilite .ne { color: #FFCB6B } /* Name.Exception */
|
||
|
.codehilite .nf { color: #82AAFF } /* Name.Function */
|
||
|
.codehilite .nl { color: #82AAFF } /* Name.Label */
|
||
|
.codehilite .nn { color: #FFCB6B } /* Name.Namespace */
|
||
|
.codehilite .nx { color: #EEFFFF } /* Name.Other */
|
||
|
.codehilite .py { color: #FFCB6B } /* Name.Property */
|
||
|
.codehilite .nt { color: #FF5370 } /* Name.Tag */
|
||
|
.codehilite .nv { color: #89DDFF } /* Name.Variable */
|
||
|
.codehilite .ow { color: #89DDFF; font-style: italic } /* Operator.Word */
|
||
|
.codehilite .w { color: #EEFFFF } /* Text.Whitespace */
|
||
|
.codehilite .mb { color: #F78C6C } /* Literal.Number.Bin */
|
||
|
.codehilite .mf { color: #F78C6C } /* Literal.Number.Float */
|
||
|
.codehilite .mh { color: #F78C6C } /* Literal.Number.Hex */
|
||
|
.codehilite .mi { color: #F78C6C } /* Literal.Number.Integer */
|
||
|
.codehilite .mo { color: #F78C6C } /* Literal.Number.Oct */
|
||
|
.codehilite .sa { color: #BB80B3 } /* Literal.String.Affix */
|
||
|
.codehilite .sb { color: #C3E88D } /* Literal.String.Backtick */
|
||
|
.codehilite .sc { color: #C3E88D } /* Literal.String.Char */
|
||
|
.codehilite .dl { color: #EEFFFF } /* Literal.String.Delimiter */
|
||
|
.codehilite .sd { color: #546E7A; font-style: italic } /* Literal.String.Doc */
|
||
|
.codehilite .s2 { color: #C3E88D } /* Literal.String.Double */
|
||
|
.codehilite .se { color: #EEFFFF } /* Literal.String.Escape */
|
||
|
.codehilite .sh { color: #C3E88D } /* Literal.String.Heredoc */
|
||
|
.codehilite .si { color: #89DDFF } /* Literal.String.Interpol */
|
||
|
.codehilite .sx { color: #C3E88D } /* Literal.String.Other */
|
||
|
.codehilite .sr { color: #89DDFF } /* Literal.String.Regex */
|
||
|
.codehilite .s1 { color: #C3E88D } /* Literal.String.Single */
|
||
|
.codehilite .ss { color: #89DDFF } /* Literal.String.Symbol */
|
||
|
.codehilite .bp { color: #89DDFF } /* Name.Builtin.Pseudo */
|
||
|
.codehilite .fm { color: #82AAFF } /* Name.Function.Magic */
|
||
|
.codehilite .vc { color: #89DDFF } /* Name.Variable.Class */
|
||
|
.codehilite .vg { color: #89DDFF } /* Name.Variable.Global */
|
||
|
.codehilite .vi { color: #89DDFF } /* Name.Variable.Instance */
|
||
|
.codehilite .vm { color: #82AAFF } /* Name.Variable.Magic */
|
||
|
.codehilite .il { color: #F78C6C } /* Literal.Number.Integer.Long */</style>
|
||
|
<div class="column column-3">
|
||
|
<ul>
|
||
|
<li><a href="#threat-intelligence">Threat Intelligence</a><ul>
|
||
|
<li><a href="#advance-persistent-threats-apts">Advance Persistent Threats (APTs)</a></li>
|
||
|
<li><a href="#ttp">TTP</a></li>
|
||
|
<li><a href="#indicator-of-compromise">Indicator of Compromise</a></li>
|
||
|
<li><a href="#information-sharing-and-analysis-centers-isacs">Information Sharing and Analysis Centers (ISACs)</a></li>
|
||
|
</ul>
|
||
|
</li>
|
||
|
</ul>
|
||
|
</div>
|
||
|
<h1 id="threat-intelligence">Threat Intelligence</h1>
|
||
|
<p>Data must be analyzed to be considered threat intelligence. Once analyzed and actionable, then it becomes threat intelligence. The data needs context around to become intel.</p>
|
||
|
<p><strong>Cyber Thread Intelligence (CTI)</strong> is a precautionary measure that companies use or contribute to so that other corporations do not get hit with the same attacks. Of course, adversaries change their TTPs all the time so the TI landscape is constantly changing.</p>
|
||
|
<p>Vendors and corporations will sometimes share their collected CTI in what are called <strong>ISACs</strong> or <strong>Information Sharing and Analysis Centers</strong>. <strong>ISACs</strong> collect various indicators of an adversary that other corporations can use as a precaution against adversaries.</p>
|
||
|
<p>Threat Intelligence is also broken up into three different types.</p>
|
||
|
<ul>
|
||
|
<li>
|
||
|
<p>Strategic</p>
|
||
|
<ul>
|
||
|
<li>Assist senior management make informed decisions specifically about the security budget and strategies.</li>
|
||
|
</ul>
|
||
|
</li>
|
||
|
<li>
|
||
|
<p>Tactical</p>
|
||
|
<ul>
|
||
|
<li>Interacts with the TTPs and attack models to identify adversary attack patterns.</li>
|
||
|
</ul>
|
||
|
</li>
|
||
|
<li>
|
||
|
<p>Operational</p>
|
||
|
<ul>
|
||
|
<li>Interact with IOCs and how the adversaries operationalize.</li>
|
||
|
</ul>
|
||
|
</li>
|
||
|
</ul>
|
||
|
<h2 id="advance-persistent-threats-apts">Advance Persistent Threats (APTs)</h2>
|
||
|
<ul>
|
||
|
<li>https://www.fireeye.com/current-threats/apt-groups.html</li>
|
||
|
</ul>
|
||
|
<h2 id="ttp">TTP</h2>
|
||
|
<p>TTP is an acronym for Tactics, Techniques, and Procedures, but what does each of these terms mean?</p>
|
||
|
<ul>
|
||
|
<li>The <strong>Tactic</strong> is the adversary's goal or objective.</li>
|
||
|
<li>The <strong>Technique</strong> is how the adversary achieves the goal or objective.</li>
|
||
|
<li>The <strong>Procedure</strong> is how the technique is executed.</li>
|
||
|
</ul>
|
||
|
<p>TI is an acronym for Threat Intelligence. Threat Intelligence is an overarching term for all collected information on adversaries and TTPs. You will also commonly hear CTI or Cyber Threat Intelligence which is just another way of saying Threat Intelligence.</p>
|
||
|
<h2 id="indicator-of-compromise">Indicator of Compromise</h2>
|
||
|
<ul>
|
||
|
<li><strong>IOCs</strong> is an acronym for <strong>Indicators of Compromise</strong>, the indicators for malware and adversary groups. Indicators can include file hashes, IPs, names, etc.</li>
|
||
|
</ul>
|
||
|
<h2 id="information-sharing-and-analysis-centers-isacs">Information Sharing and Analysis Centers (ISACs)</h2>
|
||
|
<p>According to the National Council of <strong>ISACs</strong>, "Information Sharing and Analysis Centers (ISACs) are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators". ISACs can be community-centered or vendor-specific. ISACs include CTI from threat actors as well as mitigation information in the form of IOCs, YARA rules, etc. ISACs maintain situational awareness by sharing and collaborating to maintain CTI, through a National Council of ISACs.</p>
|
||
|
<ul>
|
||
|
<li>ISACs<ul>
|
||
|
<li><a href="https://us-cert.cisa.gov/">US-CERT</a></li>
|
||
|
<li><a href="https://otx.alienvault.com/">AlienVault OTX</a></li>
|
||
|
<li><a href="https://threatconnect.com/">ThreatConnect</a></li>
|
||
|
<li><a href="https://www.misp-project.org/">MISP</a></li>
|
||
|
</ul>
|
||
|
</li>
|
||
|
</ul>
|
||
|
</span>
|
||
|
</div>
|
||
|
</div>
|
||
|
<div id="footer">
|
||
|
|
||
|
<p></p>
|
||
|
<center>
|
||
|
© Stefan Friese
|
||
|
</center>
|
||
|
|
||
|
</div>
|
||
|
|
||
|
<script>
|
||
|
function linkClick(obj) {
|
||
|
if (obj.open) {
|
||
|
console.log('open');
|
||
|
if (sessionStorage.getItem(obj.id) && !(sessionStorage.getItem(obj.id) === "open")) {
|
||
|
sessionStorage.removeItem(obj.id);
|
||
|
}
|
||
|
sessionStorage.setItem(obj.id,"open");
|
||
|
console.log(obj.id);
|
||
|
|
||
|
} else {
|
||
|
console.log('closed');
|
||
|
sessionStorage.removeItem(obj.id);
|
||
|
|
||
|
}
|
||
|
// if (obj.open) {
|
||
|
// console.log('open');
|
||
|
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === obj.id)) {
|
||
|
// sessionStorage.removeItem("opened");
|
||
|
// }
|
||
|
// sessionStorage.setItem("opened", obj.id);
|
||
|
// console.log(obj);
|
||
|
|
||
|
// } else {
|
||
|
// console.log('closed');
|
||
|
// sessionStorage.removeItem("opened");
|
||
|
//
|
||
|
// }
|
||
|
}
|
||
|
|
||
|
//if ( sessionStorage.getItem("opened")) {
|
||
|
// var item = sessionStorage.getItem("opened")
|
||
|
// document.getElementById(item)['open'] = 'open';
|
||
|
//}
|
||
|
let _keys = Object.keys(sessionStorage);
|
||
|
if (_keys) {
|
||
|
for ( let i = 0; i < _keys.length; i++ ) {
|
||
|
document.getElementById(_keys[i])['open'] = 'open';
|
||
|
}
|
||
|
}
|
||
|
|
||
|
|
||
|
|
||
|
// const detailsElement = document.querySelector('.details-sidebar');
|
||
|
// detailsElement.addEventListener('toggle', event => {
|
||
|
// if (event.target.open) {
|
||
|
// console.log('open');
|
||
|
// if (sessionStorage.getItem("opened") && !(sessionStorage.getItem("opened") === detailsElement.id)) {
|
||
|
// sessionStorage.removeItem("opened");
|
||
|
// }
|
||
|
// sessionStorage.setItem("opened", detailsElement.id);
|
||
|
// console.log(detailsElement);
|
||
|
//
|
||
|
// } else {
|
||
|
// console.log('closed');
|
||
|
// sessionStorage.removeItem("opened");
|
||
|
//
|
||
|
// }
|
||
|
// });
|
||
|
//
|
||
|
// async function fetchIndexJSON() {
|
||
|
// const response = await fetch('/index.json');
|
||
|
// const index = await response.json();
|
||
|
// return index;
|
||
|
// }
|
||
|
// // Extract the `q` query parameter
|
||
|
//var queryStringRegex = /[\?&]q=([^&]+)/g;
|
||
|
//var matches = queryStringRegex.exec(window.location.search);
|
||
|
//if(matches && matches[1]) {
|
||
|
// var value = decodeURIComponent(matches[1].replace(/\+/g, '%20'));
|
||
|
//
|
||
|
//
|
||
|
// // fetchIndexJSON()
|
||
|
// // .then(index => { console.log(index['index']);});
|
||
|
// // Load the posts to search
|
||
|
// fetch('/index').then(function(posts) {
|
||
|
// // Remember to include Fuse.js before this script.
|
||
|
//
|
||
|
// var fuse = new Fuse(posts, {
|
||
|
// keys: ['title', 'tags', 'content'] // What we're searching
|
||
|
// });
|
||
|
//
|
||
|
// // Run the search
|
||
|
// var results = fuse.search(value);
|
||
|
// //console.log(results);
|
||
|
//
|
||
|
// // Generate markup for the posts, implement SearchResults however you want.
|
||
|
// // var $results = SearchResults(results);
|
||
|
//
|
||
|
// // Add the element to the empty <div> from before.
|
||
|
//// $('#searchResults').append($results);
|
||
|
// });
|
||
|
//}
|
||
|
</script>
|
||
|
|
||
|
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@2/MathJax.js"></script>
|
||
|
<script src="https://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML" type="text/javascript"></script>
|
||
|
</script>
|
||
|
<script type="text/x-mathjax-config">
|
||
|
MathJax.Hub.Config({
|
||
|
config: ["MMLorHTML.js"],
|
||
|
jax: ["input/TeX", "output/HTML-CSS", "output/NativeMML"],
|
||
|
extensions: ["MathMenu.js", "MathZoom.js"]
|
||
|
});
|
||
|
</script>
|
||
|
</body>
|
||
|
</html>
|