Yuri Rassega

NEW BLUE MODULE DROP 🔵 Threat Analysis Tools 🔎💻 Level up your SOC game! Learn how to harness threat intelligence to detect, investigate, and defend against adversaries. From enrichment techniques to hands-on analysis workflows—you’ll gain the skills to stay one step ahead. ⚡ Ready to sharpen your defences? 👉 Start the Threat Analysis Tools module now https://lnkd.in/dS9UWQeP

313

5 commenti

Microsoft has released its September security updates. This included: • 81 vulnerabilities patched. • 0 vulnerabilities with evidence of exploitation. • 9 'Critical' rated. The ASD’s ACSC encourages all users to apply the available patch updates ASAP👉 https://lnkd.in/dHpTjmk8

91

1 commento

✔️ Secure by design, secure by default. From procurement to patching, #NIS2 requires security across the full system lifecycle. 📘 #ENISA’s guide supports implementation of secure development practices, change control and vulnerability management. 🔗 https://lnkd.in/dBbj-Dfu

86

2 commenti

AI-Transformed SOC: Executive-to-Technical View Modern Security Operations Centers (SOCs) are under pressure from an expanding threat landscape, alert fatigue, skill shortages, and the need for real-time decision-making. AI fundamentally changes how a SOC operates by automating detection, accelerating analysis, and enhancing response. 1. Executive Framing AI in the SOC is not just an upgrade — it’s a fundamental re-architecture of security operations. By leveraging Machine Learning, Predictive Analytics, Behavioral Analytics, and Large Language Models (LLMs), SOCs achieve unprecedented speed, accuracy, and efficiency across the incident lifecycle. 2. Core AI Capabilities (How AI Transforms the SOC) ·        Machine Learning (ML) o  Detects anomalies (supervised + unsupervised) o  Identifies known threats and zero-day activity in real time ·        Behavioral Analytics o  Establishes baselines for users, devices, apps o  Flags deviations → insider threats, lateral movement, APTs ·        Predictive Analytics o  Analyzes historical data for early indicators o  Forecasts threats, enabling proactive mitigation ·        NLP and Large Language Models (LLMs) o  Natural language investigation, summarization o  Accelerates incident reports, maps to MITRE ATTandCK o  Makes SOC tools usable by analysts with varying skill levels 3. AI-Driven SOC Workflow (Executive View – 5 Steps) 1.     Data Ingestion – Logs, alerts, threat intel streams 2.     AI Processing – ML anomaly detection, NLP log/context parsing 3.     Intelligent Triage – Prioritization, false positive reduction 4.     Response – Automated actions or analyst-guided escalation 5.     Resolution and Learning – AI adapts continuously from outcomes (Technical Deep-Dive – Expanded) ·        Threat Hunting and Analyst Augmentation o  AI copilots guide human analysts with hypotheses and “what-if” queries o  Supports proactive hunting, not just reactive alerts ·        Enrichment and Contextualization o  External threat feeds, IoCs, TTP correlation automatically added ·        Orchestration o  Integrates with SOAR for containment (e.g., isolate host, block IP, disable account) ·        Feedback Loop o  Analyst feedback retrains models → SOC detection grows sharper over time 4. Outcomes For Leaders: Clear visibility, faster risk reduction, lower SOC costs and measurable ROI. For Analysts: Less noise, better context, AI copilots for hunting and triage. For the Enterprise: Reduced dwell time, proactive defense posture, and scalable SOC operations. Transform Partner – Your Strategic Champion for Digital Transformation Image Source: IACIS Research Paper

48

6 commenti

🚨 A new malware campaign is showing just how far attacker evasion has come. SoupDealer—a sophisticated Java-based loader has been used in targeted attacks in Turkey that bypassed major detection tools. Its stealth isn’t magic—it’s the result of selective targeting, in-memory execution, and abuse of legitimate system tools. These tactics are becoming more common, and they won’t stay confined to one region. In our latest blog, we break down: 🔍 Why stealthy, fileless threats like this are so hard to catch 🔍 How layered defenses like intrusion detection and prevention, DNS security, and cloud network security can help 🔍 Why behavior-based analytics and correlation are critical to spotting threats that hide in plain sight Read the full post on the Seceon Inc. website to see what SoupDealer means for the future of detection here: https://lnkd.in/e3HWPtj9 #Cybersecurity #ThreatIntelligence #SoupDealer #IntrusionDetection #DNSsecurity #CloudNetworkSecurity #ThreatDetection #CyberDefense #APT #MalwareEvasion #Seceon #Türkiye Chandra Shekhar Pandey Tom Ertel Bill F. Peter Christou Ed Mohr Maggie MacAlpine Shikha Pandey Kriti Tripathi Aashish Kumar Goela Argha Bose Vinay Ojha Manish Karanji Bhabani Prasad Mahapatra Khaled Al-Najjar-MBA-CISM Yashesh Vaishnav Sana Anjali Devi

41

🚨 New CTI Lab: CVE-2025-9074 (Docker Container Escape) 🚨 Pvotal Technologies reported a critical Docker Desktop vulnerability (CVE-2025-9074, CVSS 9.3) that exposes the Docker Engine API without authentication. Organizations that depend on containerization in their development teams face serious risks, including compromised developer workstations and an increased possibility of supply chain attacks. 🛡️ We've just launched a new defensive lab covering this vulnerability, giving your teams hands-on experience to detect, defend against, and mitigate this critical vulnerability. 👉 Designed for System Administrators, Developers, SOC Analysts, Incident Responders, and Threat Hunters to practice real-world detection and response. Read more about this vulnerability and, if you’re an Immersive customer, give this lab a go now here: https://hubs.ly/Q03G0-K50 ⚡ Strengthen your teams defenses. Get hands-on with CVE-2025-9074 today. #CTI #CyberSecurity #CyberDefense

49

⚠️ FREE Challenge: AI-powered ransomware PromptLock, the first AI-powered ransomware. It uses a local AI model to create cross-platform malicious scripts in real time, autonomously targeting and encrypting data. 🛠️ Type: Malware Analysis 👤 Role: Security Analyst 💪 Difficulty: Medium

76

📧 𝗛𝗼𝘄 𝗱𝗼𝗲𝘀 𝗗𝗠𝗔𝗥𝗖 𝘄𝗼𝗿𝗸? Email remains one of the most exploited attack vectors — from phishing to spoofing. That’s where DMARC (Domain-based Message Authentication, Reporting & Conformance) comes in. It builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to add a strong layer of trust and visibility. Here’s how it works: 1️⃣ Email is sent from the sender. 2️⃣ Mail server receives and evaluates the message. 3️⃣ SPF confirms if the sender is authorized. 4️⃣ DKIM validates the authenticity of the email signature. 5️⃣ If both checks pass → ✅ email goes to the inbox. ❌ If either fails → DMARC policy applies (quarantine, reject, or drop). 📊 Reports are sent to the domain owner for visibility & tuning. 💡 With DMARC, organizations gain not just protection against fraud, but also actionable insights into who’s using their domain. 👉 Question for you: Do you think companies are doing enough to enforce DMARC — or is email security still being underestimated? 🔔 Follow e-Learn Cyber Security for more cybersecurity tips! #CyberSecurity #EmailSecurity #Phishing #DMARC #InfoSec

329

14 commenti