SIEM rules for unusual egress and self-migrating command and control
Contribute to elastic/detection-rules development by creating an account on GitHub.
30 juil.
Menaces, vulnérabilités, incidents et bonnes pratiques en sécurité informatique.
1353 articles
S’abonner (RSS)Contribute to elastic/detection-rules development by creating an account on GitHub.
Learn how to shorten PR cycle times, improve code quality, and reduce risk with Rovo Dev’s AI-powered code review.
Security, compliance, and operational resilience resources applicable to VMware Cloud Foundation and VMware vSphere. This repository is an official VMware repository managed by Broadcom staff. - vm...
Threat intelligence, or cyber threat intelligence, is security data and information an organization gathers and analyzes to understand the threat landscape.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage. Fix by ending the iterating with class_dev_iter_exit(). View CVE Details Affected Products Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP Vendor:Siemens Product Ver
Effective reasoning requires more than raw signals. Agents need context. Microsoft transforms its breadth of visibility, threat intelligence and security expertise into a security context that connects security data, knowledge and semantics across the digital estate. The result is a continuously updated representation of an organization’s assets, identities, relationships, risks and activities that gives agents a shared, near real-time, understanding of the environment they are helping to defend
Gain insights on today’s hot cyber defense topics observed on the frontlines by Mandiant and the Google Threat Intelligence Group.
Elastic Security combines threat detection analytics, cloud native security, and endpoint protection capabilities in a single solution.
Is the Entry Certificate in Business Analysis a worthwhile cert for advancing your BA career? Here we offer training and exam info, salary data, and more.
Manage, update, and secure all your devices like it's 2026
When your AirTags' batteries are low (or, let's face it, dead), you can replace them yourself—assuming you bought the proper batteries. But they're not the easiest to open up: You have to press down on the silver back of your AirTag and rotate it counterclockwise until the cover comes loose. If you're having trouble getting it to work, you're not alone. But there's a simple hack to make it a bit easier. I stumbled upon this via MacGeekGab on YouTube. The idea is, take a small amount of tape on t
A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field. View CVE Details Affected Products MZ Automation libIEC61850 Vendor:MZ Automation Product Version:MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1 Product Status:known_affected Remediations Vendor fixMZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be f
Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network. View CVE Details Affected Products Johnson Controls C-CURE 9000 and Victor application server Vendor:Johnson Controls
Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks.
Date/Time: Wednesday, August 5 | 1:30 p.m. – 3:00 p.m. (Oceanside E, Level 2) If you're looking for something hands-on and interactive, don't miss our workshop with Talos’ Nick Biasini and Cisco’s Omar Santos. In two parts, they’ll demonstrate practical ways security teams can incorporate AI into SOC workflows to identify sophisticated adversary behavior. In Part 1, Omar will discuss the Foundry Security Spec. He’ll walk through how to deploy, build testing harnesses around its core agent roles,
Date/Time: Wednesday, August 5 | 10:15 a.m. – 11:00 a.m. (Mandalay Bay I) The Splunk workshop considers the fact that the next insider threat may not be a person; it may be an autonomous agent using valid credentials and delegated authority. Attendees will see real-world attack paths in which agents move sensitive data across tools, distribute brute-force attempts under a single delegation, and manipulate internal systems without triggering traditional SIEM or UEBA alerts.
Modified package published to npm, containing malware that exfiltrates private key material
Threat actors seek to abuse Microsoft Teams features and capabilities across the attack chain, underscoring the importance for defenders to proactively monitor, detect, and respond effectively. In this blog, we recommend countermeasures and optimal controls across identity, endpoints, data apps, and network layers to help strengthen protection for enterprise Teams users.
Oracle a corrigé deux vulnérabilités critiques dans son serveur de base de données : CVE-2026-61211 (score CVSS 9.9) dans le package DBMS_CLOUD permettant à un attaquant peu privilégié de compromettre le système, et CVE-2026-47040 affectant Connection Manager, exploitable à distance sans authentification. Ces failles impactent les versions 19.3 à 19.31 et 23.4.0 à 23.26.2, avec une fenêtre critique de 72 heures pour les environnements exposés.
Since ChatGPT arrived in late 2022, we have been bullish on what large language models could do for reverse engineering and malware analysis. The early models were useful for teaching but too rudimentary for production work; that changed with the advent of reasoning models. OpenAI’s o1-preview, in September 2024, was the first to show the kind of sustained problem-solving the work demands, and within months Sean Heelan had used o3 to find a net-new vulnerability in the Linux kernel. In cybersecu
Le lancement de Mythos Preview, l’IA dédiée à la cybersécurité d’Anthropic, a défrayé la chronique en surfant sur la peur, l’incertitude et le doute…
New proactive services from Microsoft Incident Response turn security uncertainty into readiness with expert‑led preparation and advanced intelligence.
Stärken Sie Ihre Abwehr mit Microsoft Incident Response, das reaktive und proaktive Dienste bietet. Untersuchen und reagieren Sie auf Cyberbedrohungen, stellen Sie Systeme wieder her und erhöhen Sie die Resilienz.
Today we are making domain-based threat intelligence available to all Cloudflare Client-Side Security customers, regardless of whether you use the Advanced offering. In 2025, we saw many non-enterprise customers affected by client-side attacks, particularly those customers running webshops on the Magento platform. These attacks persisted for days or even weeks after they were publicized. Small and medium-sized companies often lack the enterprise-level resources and expertise needed to maintain a