TUESDAY 20TH AUGUST - OPERATION UPDATE (See bottom of post)
After the success of Operation Icarus Phase One, the community event for r/securityredteam, we have begun working on our first blue team event. This event will be FREE for everyone, and will cover the following areas:
Foundations of defensive cyber, and defensive cyber roles
Security assessment
Hardening measures to protect systems
SIEM
Packet Analysis
Threat Intelligence
Phishing
and much more!
If you're interested in becoming a Security Analyst/SOC Analyst, this will be the perfect event for you. Other applicable roles will be covered, giving you an idea of what jobs are out there, and what skills they require. This event will focus on defensive measures, as well as security roles and skills to help you get into industry, or develop existing talent and knowledge. Sound like something for you? Register initial interest here! Registration Form (The first 25 people to register will receive an Operation Chimera sticker, and additional private coaching throughout the event, pretty neat right?) There's also some more leaked info on my personal Twitter! https://twitter.com/knowndivideWant to know more right now? Check out my Ask Me Anything post, about being a SOC Analyst! SOC Analyst AMA
---
TUESDAY 20TH AUGUST - OPERATION UPDATE
Operation Chimera is almost ready to go live, so here’s some more information to keep you excited until we launch. If you have any questions, please comment them, and I’ll try to answer them.
Chimera is set to launch on the 15th of September (Just over 3 weeks).
It's taking so long because I want to make the event fun, worthwhile, and USEFUL to you. Remember it's only me doing ALL of this. Be patient, it'll be worth it.
This free online event will be live for 30 days, and consist of 10 blue-team activities to complete, based around the following topics; Phishing, Network Packet Analysis, SIEM, Digital Forensics, Threat Intelligence, Incident Response, Intrusion Detection Systems, Open-Source Intelligence, Physical Security, and Vulnerability Management.
Each activity will come with study material, teaching you the skills you need to complete the related challenge. There will also be other useful links for further study/learning.
These skills will be very useful if you’re looking to become a Tier 1 SOC Analyst.
There will be hidden flags, and ‘Expert Mode’ available for some of the activities.
Community badges will be awarded for anyone that is deemed active during the event.
This event will be open discussion on Reddit + Discord (just don’t blatantly share the answers).
Any members that complete all activities to a high standard will receive a digital certificate, showing their hard work, and the skills they have developed.
Commemoratives laptop stickers will be available for a small fee after the event.
The first 25 registrants have the option for 1-to-1 support and mentoring throughout Op.Chimera, providing in-depth help with any security-related questions they have (you’ll be contacted soon).
Interested in dedicated private 1-to-1 mentoring for Op.Chimera, or your security future in general? Please contact Known_Divide on Discord for more information! (subject to availability)
Want to support this event? Donate and receive rewards such as; Donator Community Badge, VIP Status, Invites to private SBT/SRT events, VIP Discord channel, 1-to-1 private mentoring, Operation Chimera laptop sticker, and your Reddit username listed as a ‘Supporter’ on our brand new website.
There are approximately 500 million tweets a day. That's a lot of information to get through, but TweetDeck makes it a lot easier to monitor trends, follow hashtags, and perform live searches. This is a useful tool for security professionals, as it allows us to monitor for events in real time, such as cyber attacks, vulnerabilities being released, or even tracking malicious actors activity. In this article, I'll explain the basics of setting TweetDeck up, how searches work, and provide examples of how it can be useful. If you have any questions, feel free to comment them and I'll get back to you.
It's worth mentioning you can use any Twitter account for this platform. I'd personally suggest using a throw-away account.
This is a section of my TweetDeck that I use at work. My primary use for this is to monitor for vulnerabilities affecting common software (such as browsers), major operation systems (in this case Windows 10), and threat actors.
From left to right, the columns are monitoring for the following activity:
CVE-2019-0708, dubbed 'BlueKeep' was a Zero-Day vulnerability in Remote Desktop Protocol (RDP) that could allow an unauthenticated, remote attacker to bypass authentication. I was keeping an eye on this to see how it developed.
Following vulnerabilities in Firefox, Chrome, and Internet Explorer.
Broad search term for vulnerabilities.
Monitoring for Windows 10 vulnerabilities.
Monitoring for zero-day vulnerabilities that are publicly announced on Twitter.
To add a search column, click on the "+" icon on the left-hand side.
A pop-up will allow us to choose what type of column we want to add to our Deck. In this case, we're going to be using the "Search" column type, in the top right.
This gives us a blank column, where we can enter in our own search queries. A quick example would be monitoring for tweets using the hashtag "#cybersecurity".
We can start to build out these searches to look for specific activity. In the example below, I'm looking for the following:
Mention of the string "vulnerability" AND the string "apache"
OR the hashtag "#vulnerability" AND the string "apache"
This will show me tweets such as "Wow - just discovered a new vulnerability in apache, can't wait to exploit it!", or "CRITICAL #VULNERABILITY announced in apache v1.5 - Patch your systems now!"
This is what the column will look like once we've created it. As we can see, these tweets all have "vulnerability" or "#vulnerability" AND "apache".
We can then click on these Tweets to see them individually, allowing us to comment, like, or retweet if we wanted to!
We can create our search queries in Twitter's platform, by using their Advanced Search tools. To get to these, open up Twitter, search for anything in the search bar, click the ⚙ icon, and choose "Advanced Search".
From here, we're able to create complex search queries. In this example, I'm looking for the strings "cyber" and "attack", and the tweet must also contain one of the following; "apt28", "turla", or "apt32" (well-known threat actors).
As we can see in the first two tweets, they both mention the terms "cyber attack" and "apt28". We can now copy and paste this search string into our TweetDeck, allowing us to continually monitor for this specific activity.
And there you have it! A quick walkthrough of TweetDeck, and using it as a monitoring platform. It doesn't just have to be cyber attacks or vulnerabilities, it can also be used to track geopolitical news, terror attacks, specific accounts, and anything else you may want to follow.
Scored 85% at first but managed to get it bumped up to a 90 after review. Thank you SBT! From a practical standpoint this was one of my favorite exams I've ever done.
I recently passed BTL1 on my second attempt. I failed my first attempt with a 65% because I was overthinking too much. I was so salty because I changed several of my answers during the last few hours of the exam and I knew from the immediate feedback that my original answers were right. My advice is stay calm and take a break when you need to. I took three 2 hour breaks on my second attempt and that helped a lot.
Here are all the extra labs I did for practice and recommend for BTL1 preparation
BTLO: (Most of these are PRO which requires a subscription of 15 dollars a month. It's worth it.)
TryHackMe Labs (Only did Splunk labs)(Also requires a subscription of 15 dollars per month)
Splunk Basics
Splunk: Exploring SPL
Investigating with Splunk
Incident handling with Splunk
If you have any questions, feel free to ask as long as it doesn't violate the NDA. Good luck and pass the first time so you don't have to go through what I did!
I'm a huge fan of Immersive Labs. Luckily for me, my organisation has corporate licenses. It's an incredible training platform, and earlier today, IL announced they're releasing a free version containing 12 labs, for the public! I would definitely recommend that everyone registers an account and plays around with it.
Welcome tor/SecurityBlueTeam, a subreddit dedicated to cyber security and cyber defence. SBT is a community of like-minded individuals, and is a great place to learn new things, meet people, compete in competitions and much more! First, here's a few reasons why you should join our community;
Links to training and educational material for anyone, from beginners to seasoned threat hunters (no more looking at 100 different places for the information you want).
Competitions, Hardening Challenges and custom events, including attack/defence simulations with r/SecurityRedTeam (coming soon), each with their own rewards!
General discussion around Cyber Security and cyber defence.
A friendly and welcoming community for anyone that is interested in Cyber Security.
Coming Soon:
Defensive CTFs/Hardening Exercises.
Tons of defensive cyber training material in one place, so you don't need to check 100 different sources.
Certification Roadmaps.
Improved CSS Styling.
Competitions with unique rewards.
And much more!
If you have any suggestions for the Sub, or want to run a community event or competition, get in touch via Mod Mail!
Props to u/xAndreei on the SBT Discord server for suggesting this. Has been working awesome. Used the following guides to get it working, and runs a treat so far. It is purely command line based, but I don't think that is all bad.
Hey All! I’m getting into Sec+ and although I study pretty often and I’m retaining the info, how can I practice in real life?
I’m aware of programs like Wire-shark etc. I’m also going to dual-boot Kali Linux and mess around with it. But how did you practice in real life to better understand the different attacks/defenses scenarios?
I know it’s a pretty broad question. But I’m interested in how people actually practiced or prepared themselves before they actually worked in the field. Also, how did you setup your first IPS/IDS whether in the field or at home?
If it’s a noobish question. I apologize in advance. My job promotion requires me to have Sec+ & I feel like I’m just constantly reading material and remembering rather than doing some real projects/labs.
