SecDatasets's profile picture. Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research! http://github.com/OTRF/Security-Datasets

Security Datasets

@SecDatasets

Contributing datasets, from different platforms, to the InfoSec community to expedite data analysis and threat research! http://github.com/OTRF/Security-Datasets

Pinned

🚨 Collecting and sharing logs from the ☁️ 🙏 Thanks to project SimuLand 🏝️ (an @OTR_Community Initiative), we are starting to collect data from known community templates & emulation plans 😎 🌩️AWS Dateset: mordordatasets.com/notebooks/smal… 🏗️ SimuLand: github.com/OTRF/SimuLand/…


Security Datasets reposted

Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT

MsftSecIntel's tweet image. Today, Microsoft is open sourcing Cloud Katana, a cloud-native serverless application built on the top of Azure Functions to assess security controls in the cloud and hybrid cloud environments. Read about the design principles and learn how to deploy: msft.it/6011n46MT

Security Datasets reposted

🚨 We decided to re-brand Mordor to @SecDatasets 😈 We’ll cover new types of datasets to extend its application 💜 more coming soon.. 🍻 Help us build the largest library of datasets for the InfoSec community! 🚀 Site: securitydatasets.com/introduction.h… Repo: github.com/OTRF/Security-…


We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community 😈 Data: mordordatasets.com/notebooks/smal… 🛡️@sigma_hq rules: 1⃣ github.com/SigmaHQ/sigma/… 2⃣ github.com/SigmaHQ/sigma/… How Do I use the data? ⏬

SecDatasets's tweet image. We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community 

😈 Data: mordordatasets.com/notebooks/smal…

🛡️@sigma_hq rules: 
1⃣ github.com/SigmaHQ/sigma/…
2⃣ github.com/SigmaHQ/sigma/…

How Do I use the data? ⏬
SecDatasets's tweet image. We shared a dataset that contains the core behavior 🍻 You can add more context around it! (i.e. Service creation & execution) @OTR_Community 

😈 Data: mordordatasets.com/notebooks/smal…

🛡️@sigma_hq rules: 
1⃣ github.com/SigmaHQ/sigma/…
2⃣ github.com/SigmaHQ/sigma/…

How Do I use the data? ⏬

#HuntingTipOfTheDay Search for command lines 🔎with 'comsvcs.dll' and 'MiniDump' to find credential dumping. 👀 ✏️Test your detections: gist.github.com/JohnLaTwC/3e7d… 📎References: ▪️risksense.com/blog/hidden-ge… by Jenna Magius and Nate Caroe (@RiskSense) ▪️modexp.wordpress.com/2019/08/30/min…

JohnLaTwC's tweet image. #HuntingTipOfTheDay 
Search for command lines 🔎with 'comsvcs.dll' and 'MiniDump' to find credential dumping. 👀

✏️Test your detections: gist.github.com/JohnLaTwC/3e7d…

📎References:
▪️risksense.com/blog/hidden-ge… by Jenna Magius and Nate Caroe (@RiskSense)
▪️modexp.wordpress.com/2019/08/30/min…


Security Datasets reposted

Importance of data sets for SecOps research and rule testing with projects by @SBousseaden, @Mordor_Project, @Cyb3rWard0g's SimuLand


Security Datasets reposted

🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 🗒️Metadata: mordordatasets.com/notebooks/smal… 😈Dataset: raw.githubusercontent.com/OTRF/mordor/ma…

OTR_Community's tweet image. 🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 

🗒️Metadata: mordordatasets.com/notebooks/smal…

😈Dataset: raw.githubusercontent.com/OTRF/mordor/ma…
OTR_Community's tweet image. 🚨 In less than 24h 😉, we are sharing telemetry ( #Sysmon, Security & System) through the @Mordor_Project to help everyone 🌎 expedite the validation process of detection rules! @Cyb3rPandaH #CobaltStrike 

🗒️Metadata: mordordatasets.com/notebooks/smal…

😈Dataset: raw.githubusercontent.com/OTRF/mordor/ma…

APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with - NamedPipe Creation - Service installation & exec pattern - HTTP beaconing github.com/NextronSystems… If you want to help, add some steps in here: github.com/NextronSystems…

cyb3rops's tweet image. APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with

- NamedPipe Creation 
- Service installation & exec pattern
- HTTP beaconing

github.com/NextronSystems…

If you want to help, add some steps in here:
github.com/NextronSystems…
cyb3rops's tweet image. APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with

- NamedPipe Creation 
- Service installation & exec pattern
- HTTP beaconing

github.com/NextronSystems…

If you want to help, add some steps in here:
github.com/NextronSystems…
cyb3rops's tweet image. APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with

- NamedPipe Creation 
- Service installation & exec pattern
- HTTP beaconing

github.com/NextronSystems…

If you want to help, add some steps in here:
github.com/NextronSystems…
cyb3rops's tweet image. APTSimulator 0.9.0 featuring #CobaltStrike beacon activity simulation with

- NamedPipe Creation 
- Service installation & exec pattern
- HTTP beaconing

github.com/NextronSystems…

If you want to help, add some steps in here:
github.com/NextronSystems…


Security Datasets reposted

It's time to go to SimuLand! 🎠🎡🎢 But it isn't a new vacation theme park hot spot, it's a new open-source initiative that will help you deploy a lab environment to reproduce real attack scenarios to test your security defenses. Get the details: msft.it/6017VxcHv


Security Datasets reposted

Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏 mordordatasets.com/notebooks/smal… 1⃣ A few tool-based comments at the host level 2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)

OTR_Community's tweet image. Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏

 mordordatasets.com/notebooks/smal…

1⃣ A few tool-based comments at the host level
2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
OTR_Community's tweet image. Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏

 mordordatasets.com/notebooks/smal…

1⃣ A few tool-based comments at the host level
2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)
OTR_Community's tweet image. Sharing @Mordor_Project datasets for "Getting AD FS Database Config Remotely" (Security, Sysmon & PCAP) @Cyb3rWard0g 🍻🙏

 mordordatasets.com/notebooks/smal…

1⃣ A few tool-based comments at the host level
2⃣ Group hosts & processes connecting to AD FS server over port 80 (Usually 443)

New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥 Read the blog at: o365blog.com/post/adfs/ Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!

DrAzureAD's tweet image. New version of #AADInternals out now, including remote dumping of #ADFS configuration database🔥

Read the blog at: o365blog.com/post/adfs/

Credits to @vesat, @doughsec, @BakedSec, @_dirkjan, @gentilkiwi, @MGrafnetter, and @Cyb3rWard0g for your help and previous work!


Sharing some data samples (PCAP & WinEvents) to validate detection of lateral movement via remote scheduled task creation & update 🍻 @OTR_Community 1⃣ Creation: mordordatasets.com/notebooks/smal… 2⃣ Update: mordordatasets.com/notebooks/smal… @HunterPlaybook Library Doc: github.com/OTRF/ThreatHun…


Looking forward to it! 🍻 Let's talk about some of the steps taken before sharing a dataset with the community 💜

THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! bit.ly/33AKlil

redcanary's tweet image. THIS FRIDAY: Catch @Cyb3rWard0g in conversation with @mattifestation for the last #AtomicFriday of 2020! bit.ly/33AKlil


Security Datasets reposted

Big news ya'll: @Cyb3rWard0g will be hosting our next Atomic Friday on December 11! Join us for a deep dive into @Mordor_Project and learn strategies for expediting data analysis. bit.ly/33AKlil


Security Datasets reposted

Don`t Forget to checkout Project SimuLand for ☁️Cloud Datasets mordordatasets.com/notebooks/smal…

ashwinpatil's tweet image. Don`t Forget to checkout Project SimuLand for 
☁️Cloud Datasets

mordordatasets.com/notebooks/smal…

Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules! Thank you @rbmaslen @domchell @tifkin_ @OTR_Community 😈 Dataset: mordordatasets.com/notebooks/smal… 🏹 @sigma_hq: 1) github.com/OTRF/sigma/blo… 2) github.com/OTRF/sigma/blo…

SecDatasets's tweet image. Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules!
 
Thank you  @rbmaslen @domchell  @tifkin_  @OTR_Community 

😈 Dataset: mordordatasets.com/notebooks/smal…

🏹 @sigma_hq:
1) github.com/OTRF/sigma/blo…

2) github.com/OTRF/sigma/blo…
SecDatasets's tweet image. Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules!
 
Thank you  @rbmaslen @domchell  @tifkin_  @OTR_Community 

😈 Dataset: mordordatasets.com/notebooks/smal…

🏹 @sigma_hq:
1) github.com/OTRF/sigma/blo…

2) github.com/OTRF/sigma/blo…
SecDatasets's tweet image. Looking for ways to validate detection rules for that specific behavior? A small sample of data and a few rules!
 
Thank you  @rbmaslen @domchell  @tifkin_  @OTR_Community 

😈 Dataset: mordordatasets.com/notebooks/smal…

🏹 @sigma_hq:
1) github.com/OTRF/sigma/blo…

2) github.com/OTRF/sigma/blo…

SharpView, if you've run it on a machine have a look in %TEMP%\ba9ea7344a4a5f591d6e5dc32a13494b you might find a nasty surprise.....



Security Datasets reposted

So cool to see this! 👍

If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks/smal…

SecDatasets's tweet image. If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !

😈 mordordatasets.com/notebooks/smal…
SecDatasets's tweet image. If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !

😈 mordordatasets.com/notebooks/smal…


If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s ! 😈 mordordatasets.com/notebooks/smal…

SecDatasets's tweet image. If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !

😈 mordordatasets.com/notebooks/smal…
SecDatasets's tweet image. If you are wondering what this might look like in Sysmon, we got you covered with a new small dataset. You can simply download it from the link below and explore it with PSH as shown in the second image below 😊 Thank you @jxy__s !

😈 mordordatasets.com/notebooks/smal…

I’m pleased to present this Windows exploit. Process Herpaderping is a method for evading detection - similar to process migration, hollowing, or doppelganging. herpaderping.com



Very happy to join forces, leverage PurpleSharp and share the data with the community! Keep up the great work @mvelazco ! More coming soon.. 😈

Thanks to @Cyb3rWard0g & the @Mordor_Project we are also releasing samples of data (host & network) that you can explore to get familiarized with the data these techniques generate! @OTR_Community mordordatasets.com/notebooks/smal…



😈 Adding more Windows datasets after using @redcanary Atomic Red Team and @mvelazco PurpleSharp 💜 Thank you all for everything you share with the Infosec Community 🌎 Courtesy of the @OTR_Community ! Commit: github.com/OTRF/mordor/co…

SecDatasets's tweet image. 😈 Adding more Windows datasets after using @redcanary Atomic Red Team and @mvelazco PurpleSharp 💜 Thank you all for everything you share with the Infosec Community 🌎 Courtesy of the @OTR_Community !

Commit: github.com/OTRF/mordor/co…

Security Datasets reposted

HOW to contribute a @Mordor_Project dataset in 2 mins ⏳w/ the help of @redcanary ART & then contribute to @sigma_hq after exploring the data! @OTR_Community ♻️ Clear, Exec & Collect: youtu.be/6iteEfbuwU8 😈 Data: mordordatasets.com/notebooks/smal… 🏹 Rule: github.com/OTRF/sigma/blo…


Security Datasets reposted

Check out mordordatasets.com/notebooks/smal… and threathunterplaybook.com/notebooks/wind… - Mordor Dataset and Playbook entry for wuauclt.exe abuse with many thanks to @Cyb3rWard0g 🤜 for his epic work as ever! Will be updating blog with these links too for reference 💪

I found an interesting #LOLBIN using Windows Update Client (wuauclt.exe) as a loader - blog, pull request to LOLBAS and in the wild sample here dtm.uk/wuauclt/ - I am hoping to finalise some of my work on the methodology I used soon @MDSecLabs so keep your eyes posted.



Security Datasets reposted

Since I last discussed @brimsecurity use with @Cyb3rWard0g & @Cyb3rPandaH's Mordor APT29 datasets in #toolsmith 144, @OliverRochford has been hard at work for Brim, exploring further & documenting his practice well. Check out medium.com/brim-securitys… & the prior post. Great work!


Security Datasets reposted

#Day3 #100DaysOfBlueTeam Today I learned a few things about some open source projects. I must admit I was not expecting the music theme for the example of @Mordor_Project 🤣 youtu.be/kBe6-D1_ais

JulioUrena's tweet card. Mordor - Covenant - Kafkacat Consumer Mode - Rubeus asktgt ptt

youtube.com

YouTube

Mordor - Covenant - Kafkacat Consumer Mode - Rubeus asktgt ptt


Loading...

Something went wrong.


Something went wrong.