Cobalt Strike, a Defender’s Guide – Part 2
The DFIR Report Real Intrusions by Real Attackers, The Truth Behind the Intrusion Our previous report on Cobalt Strike focused on the most frequently used capabilities that we had observed. In this report, we will focus on the network traffic it produced, and provide some easy wins defenders can be on the look out for to detect beaconing activity. We cover topics such as domain fronting, SOCKS pro
Easily Identify Malicious Servers on the Internet with JARM - Salesforce Engineering Blog
TL;DR JARM is an active Transport Layer Security (TLS) server fingerprinting tool. Scanning with JARM provides the ability to identify and group malicious servers on the Internet. JARM is available here: https://github.com/salesforce/jarm JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration.Group disparate servers on the internet by configura
JARMを使ã£ãŸTLS Fingerprinting 〜ãŠæ‰‹è»½ã‚°ãƒ©ãƒ•åˆ†æžç’°å¢ƒæ§‹ç¯‰ã‚’æ·»ãˆã¦ã€œ - Qiita
ã“ã®è¨˜äº‹ã¯ NTTコミュニケーションズ Advent Calendar 2020 ã®11日目ã®è¨˜äº‹ã§ã™ã€‚（振り返ã£ã¦ã¿ã‚‹ã¨2019å¹´ã®ã‚¢ãƒ‰ãƒ™ãƒ³ãƒˆã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼ã‚‚11日目を担当ã—ã¦ã„ã¾ã—ãŸï¼‰ 昨日㯠@yuki_uchida ã•ã‚“ã®WebTransportã¨WebCodecsを組ã¿åˆã‚ã›ã¦ãƒ“デオãƒãƒ£ãƒƒãƒˆã‚’実装ã—ã¦ã¿ã‚‹ã§ã—ãŸã€‚ æ¦‚è¦ ã“ã®è¨˜äº‹ã¯SalesforceãŒå…ˆæœˆï¼ˆ2020å¹´11月）ã«å…¬é–‹ã—ãŸJARMã¨ã„ã†TLSフィンガープリンティングツールを検証ã—ã¦ã¿ãŸè©±ã§ã™ã€‚ ã¤ã„ã§ã«IDE環境ã§ã‚ã‚‹JupyterLabã¨ã‚°ãƒ©ãƒ•DBã§ã‚ã‚‹Neo4jを組ã¿åˆã‚ã›ãŸã‚°ãƒ©ãƒ•åˆ†æžãƒ»å¯è¦–化環境をdocker-composeを用ã„ã¦ãŠæ‰‹è»½ã«æ§‹ç¯‰ã™ã‚‹æ–¹æ³•ã‚‚ã”紹介ã—ã¾ã™ã€‚ ã“ã®è¨˜äº‹ã‚’ã”覧ã«ãªã£ãŸæ–¹ãŒã”自身ã§ã‚‚試ã›ã‚‹ã‚ˆã†ã«ãƒãƒ³ã‚ºã‚ªãƒ³ã£ã½ã書ã„ã¦ã‚ã‚Šã¾ã™ã€‚ 背景・用語解説 フィンガープリンティング（Fingerprinti
针对日本网络钓鱼活动溯æºåˆ†æž - SecPulse.COM | 安全脉æ
原文信æ¯æå–: 攻击方å¼: 攻击者冒充日本国家税务局针对日本用户分å‘é’“é±¼çŸä¿¡,包å«è¯±å¯¼æ¬ºéª—çš„æ–‡å—以åŠæŒ‡å‘æ¶æ„网站的çŸé“¾æŽ¥,åŽç»ä¼šæ ¹æ®ä¸åŒçš„设备类型去é‡å®šå‘到ä¸åŒçš„é’“é±¼é¡µé¢ iphone:é‡å®šå‘到克隆日本国家税务局的网站,é€šè¿‡ä¼ªé€ çš„å¼¹çª—æ示,诱导用户填写个人身份信æ¯å’ŒV-Precaå¡è¯¦ç»†ä¿¡æ¯ Android:é‡å®šå‘到虚å‡çš„"AU"(日本移动è¿è¥å•†)网站,诱导用户下载安装æ¶æ„apk从而达到进一æ¥çªƒå–ä¿¡æ¯çš„目的 差异在于Android比较容易从网页下载安装æ¶æ„程åº,而iphone上如果直接使用网页安装软件比较麻烦且需è¦èŽ·å¾—ç¾å,æˆæœ¬æ›´é«˜,æ‰€ä»¥ç›´æŽ¥ä¼ªé€ é’“é±¼ç½‘ç«™çªƒå–ä¸ªäººä¿¡æ¯ IOC: 手机å·:09061661959 çŸé“¾æŽ¥:https://cutt.ly/YXZfAMP apk:8b6c4fea9e4a6d8761c1c53525a91374 代ç†æœåŠ¡å™¨:220105.top C&C:192.186
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
recog/xml/tls_jarm.xml at main · rapid7/recog
GitHub - PaloAltoNetworks/pyjarm: pyJARM is a library for doing JARM fingerprinting using python
shimon - Swagger UI
Shimon
A Red Teamer Plays with JARM | Cobalt Strike
JARM exploration
SecurityTrails | JARM: A Solid Fingerprinting Tool for Detecting Malicious Servers
GitHub - salesforce/jarm
GitHub - ninoseki/shimon: URL fingerprinting made easy
GitHub - projectdiscovery/httpx: httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
{{#tags}}- {{label}}
{{/tags}}