Daniele Vitali

LogonTracer: Visualizes Suspicious Activities - Free! Who logged into the network and how? A single logon event can provide critical insights into the timeline of an attack, but without the right tools, connecting the dots is a challenge. LogonTracer makes this process easier by analyzing Windows Active Directory event logs and visualizing them as graphs. This allows security teams to identify patterns quickly. Whether it's a series of failed logins or unusual authentication requests: • Visualize logon data with Neo4j & Cytoscape • Install with Docker for easy setup • Detailed event log analysis in chronological order • Use advanced algorithms to pinpoint suspicious activity Learn more: https://lnkd.in/gd535s84 Threat hunting isn’t just about identifying a potential attack; it’s about understanding the context around it. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

358

12 commenti

⚠️ Cognitive Threat Modeling (CTM) - AI Is Now Thinking About Threats So You Don’t Have To In today’s development velocity, traditional STRIDE/PASTA threat models have become 91% “dead documents” (Gartner, 2024). Each commit, each API update, each IaC change moves forward without any real-time threat analysis. 📉 The result? Vulnerabilities slip through sprints and reach production Security is seen as a checkpoint, not an enabler 💡 Enter Cognitive Threat Modeling (CTM): Every commit triggers an AI-powered threat model The system analyzes code, architecture, and IaC to produce live risk scores OPA enforces policy gates → high risk = build blocked Developers receive precise remediation guidance directly via Teams or Slack 📊 The Numbers Speak: 85% faster threat modeling (Forrester 2025) 42% fewer missed vulnerabilities 50% reduction in breach cost ($1.2M → $600K) Capital One pilot: 17 critical issues caught before production 🔧 Real Implementation Example (from the guide): Node.js + 3 microservices + JWT auth + Terraform → commit triggers CTM. ⚠️ Detected JWT Replay Attack (risk score 0.73) → build blocked. ✅ Fix: token expiration + audience claim + nonce. Re-analyzed → risk score 0.32 → build passed. 🎯 Bottom line: Threat modeling is no longer a static document — it’s a living, thinking intelligence. Security must evolve from reactive control to continuously learning systems. Every commit = a threat analysis opportunity. “Cybersecurity is not just technology — it’s discipline and strategy.” 📥 I’ve published the full guide: Master Cognitive Threat Modeling – The Complete 2025 Implementation Guide #CognitiveSecurity #ThreatModeling #AIinCyber #DevSecOps #ZeroTrust #SecurityEngineering #Leadership

202

20 commenti

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

🚨  𝗡𝗲𝘄 𝗘𝘅𝗽𝗹𝗼𝗶𝘁 𝗳𝗼𝗿 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗦𝗔𝗣 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗥𝗲𝗹𝗲𝗮𝘀𝗲𝗱 𝗯𝘆 𝗦𝗵𝗶𝗻𝘆𝗛𝘂𝗻𝘁𝗲𝗿𝘀 A few hours ago a threat actor group claiming to be “Scattered LAPSUS$ Hunters – ShinyHunters” released a new exploit for a critical SAP critical vulnerability. This is what you need to know and do today. ⚠️ The impact: Our Onapsis Research Labs confirmed this is a fully-working exploit for SAP vulnerability CVE-2025-31324. Usage enables remote threat actors to take full control of vulnerable SAP systems over the internet (full RCE with SAP admin privileges over HTTP(s)). ☣️ The context: We assess with high confidence that this is the exploit used in the SAP zero-day mass exploitation campaign that started earlier this year (high activity in March-May). Priorly published PoCs were not functional - this is the first public release of a working exploit to our knowledge. ✅ The good news: This is not a new SAP vulnerability. SAP promptly provided patches for this issue and the related CVE-2025-42999 on April 22nd and May 13th. If you applied these SAP security patches - and validated no compromise prior to patch implementation - you are not impacted by this. 🔴 The bad news: The exploit clearly demonstrates advanced threat actor knowledge of SAP application internals, including leveraging specific custom SAP classes in the deserialization attack. It would be trivial for this or other actors to reuse and weaponize this capability against different, more-recent SAP deserialization vulnerabilities discovered by Onapsis and patched by SAP in July. 🔴 The bad news, part II: We expect further exploitation activity from this disclosure. However, given the widespread exploitation during March-May, any still-vulnerable organization was likely previously impacted, and should assume compromise performing an immediate investigation. We also continue to see patched SAP systems where backdoors are still present. We strongly recommend using the opensource Mandiant+Onapsis IoC scanner tool in the link.  ☣️ The source: VX Underground reported this exploit drop on a Telegram group, and uploaded the posted exploit on VXU on Friday Aug 15th. 🛡️ We strongly recommend defenders at SAP customers to further assess exposure and prioritize remediation if necessary. 👇You can find more information in the links in the comments section. This is under development as we learn more, so check often for updates. 👊 Kudos to our Onapsis Research Labs team for the impressive response, providing actionable remediation guidance and a deep technical threat intelligence analysis in just a few hours to protect all SAP customers.

100

4 commenti

12 𝐏𝐢𝐥𝐥𝐚𝐫𝐬 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 1. Disaster Recovery Purpose: Ensure continuity and recovery from unexpected incidents like hardware failure, cyberattacks, or outages. Scenarios to Protect: Random attacks, DC outages. Design Points: DR Plan: Documented recovery process. Data Backup: Regular, secure backups. System Redundancy: Failover systems to avoid downtime. 2. Authentication Purpose: Verify the identity of users and systems accessing resources. Scenarios to Protect: User logins, employee system access. Design Points: Strong password policies. Multi-factor authentication (MFA). 3. Authorization Purpose: Control what authenticated users can access. Scenarios to Protect: Data access, user role restrictions. Design Points: Regular role reviews. Least privilege principle. Role-based access control (RBAC). 4. Encryption Purpose: Protect sensitive data from interception or theft. Scenarios to Protect: Sensitive data during storage or communication. Design Points: TLS for data in transit. Sensitive data encryption at rest. Key management. 5. Vulnerability Management Purpose: Identify and fix system flaws before exploitation. Scenarios to Protect: Patch management, vulnerability scans. Design Points: Continuous monitoring. Prompt patching. 6. Audit & Compliance Purpose: Ensure legal/regulatory requirements are met. Scenarios to Protect: Patient or personal data, financial systems. Design Points: Regular audits. GDPR, HIPAA compliance. Comprehensive logging. 7. Network Security Purpose: Protect internal and external network infrastructure. Scenarios to Protect: Cloud environments, corporate networks. Design Points: Firewalls. Network segmentation. Intrusion detection systems. Secure DNS. 8. Terminal (Endpoint) Security Purpose: Secure end-user devices like laptops and point-of-sale (POS) systems. Scenarios to Protect: Employee computers, retail POS machines. Design Points: Antivirus software. Device management. Hard drive encryption. 9. Emergency Responses Purpose: Respond quickly and effectively to cyber incidents. Scenarios to Protect: DDoS attacks, data breaches. Design Points: Incident response plans. SOC. Regular drills. 10. Container Security Purpose: Protect applications deployed in containers (e.g., Docker/Kubernetes). Scenarios to Protect: Secure deployment in containerized environments. Design Points: Image scanning. Trusted base images. Runtime security controls. 11. API Security Purpose: Secure data exchange through APIs. Scenarios to Protect: Public/internal APIs. Design Points: OAuth 2 authentication. Rate limiting. Input validation. API key management. 12. 3rd-Party Management Purpose: Manage security risks from vendors and partners. Scenarios to Protect: Supply chain risks. Design Points: Vendor risk assessments. Secure data sharing. Ongoing monitoring. Disclaimer - This post has only been shared for educational purposes related to Technologies. #technology #learning #cybersecurity #ciso

1.384

68 commenti

Vulnerability Assessments CIP-010-r3 Requires paper or active vulnerability assessment 95% doing paper assessments because of fragility of control system networks Introducing a network based Digital Twin as a way to do vulnerability scanning Including an AI reasoning agent as an adversary simulation Purely offline. -Brian Proctor Frenos Brian Proctor EnergySec

55