Cyences App for Splunk 1.1.0 with Sysmon 13.0
We’ve recently added Sysmon 13 support to our Cyences App in order to detect some of the latest malware/ransomware techniques [Mailto/defray777 ransomware, TrickBot, and BazarBackdoor]. Sysmon 13 lets us monitor the activity of Windows 10 processes and can now detect process hollowing or process herpaderping techniques which would normally not be visible in Task Manager. […]
Security Incident handling with Splunk – Our new Cyences App published on Splunkbase
Security Incident handling with Splunk – Our new Cyences App published on Splunkbase For the past year, customers have asked us to simplify Splunk so that they are able to identify nefarious activities quickly. In addition, they wanted to be able to forensically investigate any event without having to be experts in Splunk Processing Language […]
Security Incident handling with Splunk – Preview to our new Cyences App to be published on Splunkbase
Security Incident handling with Splunk – Preview to our new Cyences App to be published on Splunkbase For the past year, customers have asked us to simplify Splunk so that they are able to identify nefarious activities quickly. In addition, they wanted to be able to forensically investigate any event without having to be experts […]
7 steps to improve your cyber resiliency
Improve infrastructure cybersecurity through cyber resiliency According to MITRE, “cyber resiliency” is “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on cyber resources.” Because no cybersecurity solution is infallible, cyber resiliency as an addition to a security approach is valuable in that it helps mitigate damage from […]
ABC’s of Splunk Part Twelve: Protect yourself against Ransomware and Kernel-mode Malware
Protecting your Windows Environment from Kernel-mode Malware As we were looking to better protect the Windows environments from Ransomware, we quickly realized that very few security technologies have visibility into kernel-mode malware behavior. This type of malware has equal or even higher privileges than most security tools. Thus, attackers can essentially take safe refuge in […]
ABC’s of Splunk Part Eleven:Ransomware and the Pyramid of Pain
Since the beginning of the COVID-19 lockdown, we have witnessed an astonishing amount of attacks launched against remote workers. More and more companies have begun to pay perpetrators through a financial windfall that have allowed them to add more programmers to launch even more sophisticated attacks. Ransomware has become a full-on war than a skirmish. […]
ABC’s of Splunk Part Ten: Reduction of Attack Surface AreaWindows and Microsoft Active Directory
For this blog, we are going to go over how to ingest our windows environment and Active Directory logs and how to set up advanced search commands to continue with our efforts to reduce our attack surface area. This issue has gained importance since last week after the discovery of a new set of exploits […]
ABC’s of Splunk Part Nine: Reduction of Attack Surface Area
For this post, we take a little side trip to explore Splunk as a tool for early identification of areas vulnerable to attacks so we can reap the benefits of all our learnings and extract valuable information as to what makes Splunk powerful from a SIEM perspective. Please revisit our previous posts if you would like […]
ABCs of Splunk, Part 8: Advanced Search
In this post, we will continue our journey into search with Splunk and add a few more commands to include in your arsenal of knowledge. Please revisit our previous posts to ensure you have a healthy environment upon which to run commands. Prerequisite How to Install Splunk on Linux Upload data required for the examples […]
ABC’s of Splunk Part Seven: Basics of Search
Now that you have some knowledge from our previous blogs, you are now ready to start your journey to become a Splunk Ninja! For the next six blogs, we are going to focus on Search starting from the basics and moving into advanced correlation and detection. Let’s begin… Splunk uses Search Processing Language, commonly known […]