Recent searches

No recent searches

Search options

Only available when logged in.
digitalcourage.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Diese Instanz wird betrieben von Digitalcourage e.V. für die Allgemeinheit. Damit wir das nachhaltig tun können, erheben wir einen jährlichen Vorausbeitrag von 1€/Monat per SEPA-Lastschrifteinzug.

Administered by:

Server stats:

808
active users

digitalcourage.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.2

#intrusiondetection

0 posts0 participants0 posts today
Cyberkid

🐽 Snort Command Cheat Sheet: Understand Network Threats Like a Pro

Snort is a powerful open-source tool used for Network Intrusion Detection and Prevention (NIDS/NIPS). It's widely adopted by blue teams and security professionals to monitor, alert, and defend against malicious network activity.

🧠 Key Usage Modes (No Code Needed):

• Test Mode: Check configuration files before deployment
• Packet Sniffing Mode: Monitor live traffic and display it in real time
• Packet Logging Mode: Capture packets and store them for analysis
• IDS Mode: Analyze traffic against rule sets and raise alerts
• Silent Mode: Run in the background while logging events

🛡️ Snort is great for:
• Detecting port scans and suspicious payloads
• Monitoring traffic for policy violations
• Integrating with SIEM solutions
• Practicing blue team defensive strategies

Disclaimer: This content is intended strictly for educational and awareness purposes. Use intrusion detection systems responsibly and ethically.

#Snort#NetworkSecurity#CyberSecurity
*
Andrew 🌻 Brandt 🐇

For those who don't know (which is most of you), this project has been the intense focus of my work, taking up a huge amount of my time, energy, and investigative effort for the past 14 months - while still helping others at Sophos publish their research; running an election campaign where I was a candidate for school board; speaking at Blue Hat, @defcon #Saintcon, #VirusBulletin and other conferences; guest lecturing to classes at CU Boulder; volunteering my time canvassing for political candidates; serving as a docent at the @mediaarchaeologylab; working as a poll worker during the current US election cycle; and starting up the Elect More Hackers (electmorehackers.com) organization.

Whew. It's actually kind of daunting just to read that. I also sometimes sleep and eat.

@SophosXOps has been, at its core, an institution that values radical transparency, and this story (and the earlier research investigations into the Operation Pacific Rim threat actors and incidents) demonstrates Sophos' commitment to truth and journalistic integrity, following a story wherever it leads.

I hope our publication today starts a larger conversation and collaboration within the cybersecurity industry - inside and outside the Cyber Threat Alliance, which Sophos actively supports and where I am proud to represent my employer - to work together to thwart the ambitions of nation-state threat actors such as the perpetrators of Operation Pacific Rim, in order to protect the privacy and safety of everyone, everywhere.

#PacificRim #OperationPacificRim #malware #china #hacking #hacks #infosec #firewalls #intrusiondetection

sophos.com/en-us/content/pacif

SOPHOSSophos' Pacific Rim: Defense Against Nation-state HackersDiscover Sophos' Pacific Rim defense against nation-state / Chinese hackers Volt Typhoon, APT31, and APT41 targeting critical infrastructure.
Continued thread
*
Tinker ☀️

There is something so satisfying in kicking off an entire RFC1918 scan.

Doing a single port at a brisk but safe (for my environment) pace.

~/# nmap -Pn -n -p <single port number> -T4 --open 10.0.0.0/8

~/# nmap -Pn -n -p <single port number> -T4 --open 172.16.0.0/12

~/# nmap -Pn -n -p <single port number> -T4 --open 192.168.0.0/16

(command broken out for dramatic effect - also note that I break out each of those CIDRs into /24's so that if anything breaks, I can pick up easier where the last known good ended. It's scripted and I prefer it this way.)

I am not doing a ping sweep or a DNS resolution. I'm assuming all hosts are up. And I'm looking for every host with a single port open. So even if they dont respond to pings (or something is preventing pings), I should get an answer back.

Note, I could certainly do faster (T5 or masscan, gawd) - but this is about as fast as I'm going to do in my environment and still be safe.

Also, only looking for open ports right now - no fingerprinting yet.

A cool thing about this approach is many intrusion detection still will only look for multiple ports on a single host to trigger an alert. Some still ignore many hosts / single port scans (to their detriment).

We've long sense purple teamed this, so I sent a notification to SOC letting them know my actions and asking them nicely (I bribed them last week) to not stop me, lol.

Should take a couple weeks to a month at this pace and in my environment to hit every single one of the just shy of 18,000,000 hosts 😂

#pentesting#hacking#infosec
Chris Sistrunk

📰 Hot off the press 📰
This article is to help folks with tuning their ICS network security monitoring alerts. 🛠️📉 You don't have to reinvent the wheel, because you can leverage your control system alarm tuning methodology.

When fine-tuning your cybersecurity alerts, it’s best to focus on the basics power-grid.com/td/when-fine-tu from PowerGrid International.

#icssecurity#otsecurity#networksecuritymonitoring
TrendingLive feeds
About