Article: Tom Arms' World Review - Liberal Democrat Voice - published about 5 hours ago.
Content: Britain's National Cyber Security Centre says that the most likely culprit is Russia or Russian-speaking criminal networks, most of whom operate with ...
https://www.libdemvoice.org/tom-arms-world-review-179-80770.html
Article: Monzo issues Black Friday warning to 15.2 million customers - GB News - published about 5 hours ago.
Content: ... Cyber Security Centre. That's an average loss of £695 per person. ADVERTISEMENT. ADVERTISEMENT. a womans hand holding a monzo bank card. Monzo, known ...
https://www.gbnews.com/tech/monzo-black-friday-warning
Article: Guest opinion: AI and the economy | News, Sports, Jobs - Daily Herald - published about 4 hours ago.
Content: ... cyber security, surveillance, to whether it is an existential risk to kill off humans altogether. If you are like me trying to find out more about ...
https://www.heraldextra.com/news/opinion/local-guest-opinions/2026/nov/07/guest-opinion-ai-and-the-economy/
Article: A parent of a learner participating in the drone innovation project at the CEMASTEA STEM ... - published about 4 hours ago.
Content: The event brought together students from over 20 schools to showcase practical innovations in fields like cyber security, coding, and robotics.
https://www.facebook.com/kenyanewsagency/videos/a-parent-of-a-learner-participating-in-the-drone-innovation-project-at-the-cemas/1446180400978578/
Article: The buyer's guide to browser security | The Cyber Security Hub™ - LinkedIn - published about 3 hours ago.
Content: The Cyber Security Hub™'s Post. View organization page for The Cyber Security Hub™. The Cyber Security Hub™. 1,962,767 followers. 31m. Report this ...
https://www.linkedin.com/posts/the-cyber-security-hub_the-buyers-guide-to-browser-security-activity-7525165326666248192-k9jt
Article: 86% of companies suffer cyber breaches amid crisis to find talent - Business Standard - published about 3 hours ago.
Content: Topics : cyber security threats cyber security Cyber security law cyber security attack artifical intelligence. HOT STOCKS. Suzlon Energy Share ...
https://www.business-standard.com/technology/tech-news/86-of-companies-suffer-cyber-breaches-amid-crisis-to-find-talent-126110800377_1.html
Article: GCHQ warns UK organisations after freezer cyber attacks | Chester and District Standard - published about 3 hours ago.
Content: The chief executive of the National Cyber Security Centre (NCSC), which is part of GCHQ, said there are a couple of instances in the UK where “ ...
https://www.chesterstandard.co.uk/news/26709597.gchq-warns-uk-organisations-freezer-cyber-attacks/
Article: I'm tempted to give up my EV – but not for the reason you think - i Newspaper - published about 1 hour ago.
Content: Cyber Security · Electric Cars · Electric Vehicles. More from this Author. STEFANO HATFIELD · I'm a private school teacher - these are the true ...
https://inews.co.uk/opinion/tempted-give-up-ev-not-what-you-think-4877759
Article: DataOn HR Conference 2026: AI Perkuat Produktivitas dan Strategi Pengembangan SDM - published about 2 hours ago.
Content: Inovasi yang dipresentasikan Head of Product Development DataOn, Abdi Wirawan, bersama Head of DevSecOps DataOn, Ronald Mustika Putra, ini ...
https://www.topbusiness.id/139721/dataon-hr-conference-2026-ai-perkuat-produktivitas-dan-strategi-pengembangan-sdm.html
Article: 2026 US midterms likely to reshape cybersecurity, AI policy - The News International - published about 2 hours ago.
Content: The results could influence how federal agencies fund cybersecurity, how states regulate AI and whether major technology projects face tougher ...
https://www.thenews.com.pk/latest/1422914-2026-us-midterms-likely-to-reshape-cybersecurity-ai-policy
Article: Companies need to overhaul cybersecurity as AI accelerates vulnerability attacks: Report - published about 5 hours ago.
Content: A McKinsey report reveals the urgent need for companies to revise their cybersecurity strategies as AI accelerates the detection and exploitation ...
https://enterpriseai.economictimes.indiatimes.com/news/industry/companies-need-to-overhaul-cybersecurity-as-ai-accelerates-vulnerability-attacks-report/135652167
Article: University Hospitals' MyChart back online following cybersecurity incident | wkyc.com - published about 4 hours ago.
Content: University Hospitals announced Saturday afternoon that the online patient portal is now accessible to patients. A cyberattack knocked MyChart ...
https://www.wkyc.com/video/news/local/northeast-ohio/university-hospitals-mychart-back-online-following-cybersecurity-incident/95-0fe4a555-b665-406c-93b7-b09cc4cbe02b
Article: Why retailers are getting hacked & how it may be an INVESTMENT opportunity - The Sun - published about 3 hours ago.
Content: And the stock market has reflected this – share prices of major cybersecurity names such as CrowdStrike, Palo Alto Networks and Fortinet have all more ...
https://www.thesun.co.uk/money/40915895/retailers-hacked-investment-opportunity/
Article: Allianz Cyber Security BMf9 USD Inc | Fund - Morningstar - published about 15 hours ago.
Content: Get a detailed summary of Allianz Global Investors Fund - Allianz Cyber Security BMf9 USD Inc, including investment strategy, performance history, ...
https://global.morningstar.com/en-ea/investments/funds/0P0001V2UY/quote
Article: When Every Cybersecurity Company Sounds the Same, How Do You Build Trust? - published about 8 hours ago.
Content: Cybersecurity has no shortage of innovation. New AI capabilities, emerging threats, and rapidly evolving products are transforming the industry at an ...
https://www.cybersecurity-insiders.com/when-every-cybersecurity-company-sounds-the-same-how-do-you-build-trust/
Article: Malaysia facing increasingly complex cybersecurity risks - The Star - published about 4 hours ago.
Content: The situation escalated when the National Cyber Security Agency (Nacsa) raised the National Cybersecurity Threat Level from low to medium on ...
https://www.thestar.com.my/news/nation/2026/11/08/malaysia-facing-increasingly-complex-cybersecurity-risks
Article: Hacks expose the flaws of the connected world - Financial Times - published about 4 hours ago.
Content: Over the course of just a few weeks, a series of cyber security incidents have brought home just how fragile our connected world is. In one of the ...
https://www.ft.com/content/26687a2b-85ef-4ea8-94d3-07debe920f5f?syn-25a6b1a6=1
Article: Watch: news2day Friday, 6 November 2026 - RTE - published about 4 hours ago.
Content: It follows a lot of cyber security issues in Europe recently. Here's the background... It's a massive weekend in Irish soccer. Ahead of the Club ...
https://www.rte.ie/kids/news2day/2026/1108/1598416-rte-news-news2day-6-november-safefood-vr-cyber-attacks-security-fai-cup-final/
Article: Weekly Update 516: Live From Vietnam - published 3 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.A little wind noise, a little connectivity flakiness, and a little lip-sync issues from YouTube, but look at that view! 🤩 Back to business, it's the Brinks Home FAQ I found most interesting this wee...
https://www.troyhunt.com/weekly-update-516/
Article: Weekly Update 517: Cyber Ransoms - published 3 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a...
https://www.troyhunt.com/weekly-update-517/
Article: Welcoming the Sri Lankan Government to Have I Been Pwned - published 3 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.Today, we welcome the 48th government onboarded to Have I Been Pwned’s free gov service: Sri Lanka. Sri Lanka CERT now has access to monitor Sri Lankan government domains against the data in HIBP, h...
https://www.troyhunt.com/welcoming-the-sri-lankan-government-to-have-i-been-pwned/
Article: Weekly Update 518: IoT Doorlock Nirvana with UniFi - published 3 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I genuinely think I've nailed the IoT door lock situation! Well, Ubiquiti has, but I think I've worked out how to put it all into a residential house and have it make sense. There are a few basic te...
https://www.troyhunt.com/weekly-update-518/
Article: A Cautionary Tale About Data Breach Claims, Verification and Carhartt - published 2 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.You're not going to believe this, but turns out you can't always take criminals at their word. Actually, I'll walk that back a bit as it may not even be the cybercrime guys who got this wrong, but i...
https://www.troyhunt.com/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt/
Article: Weekly Update 519: Breaches & Data Integrity - published 2 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.It does feel like I've bitten off too much and am now chewing like crazy this week. The 3D printing talk with Elle in Oslo, the "normal" NDC infosec talk, the cyber-broken talk with Scott in Copenha...
https://www.troyhunt.com/weekly-update-519/
Article: Weekly Update 520: The Unscripted Edition - published 2 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I've started playing around with YouTube's "create video thumbnail", which hopefully will give me back a bit of time in my day (it used to be a manual job in Photoshop) and be a bit more interesting...
https://www.troyhunt.com/weekly-update-520/
Article: Weekly Update 521: Breach Perception v. Reality - published about 2 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the news would have you believe. There...
https://www.troyhunt.com/weekly-update-521/
Article: Weekly Update 522: Live From Oslo with Scott Helme - published about 2 months ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.Heads up: the first 7 mins is a bit quiet until we worked out the external mic was misbehaving - sorry! But get through that and have a listen to Scott's experiences with how Report URI is identifyi...
https://www.troyhunt.com/weekly-update-522/
Article: Weekly Update 523: Live From a Norwegian Fjord - published about 1 month ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.How's that view?! With NDC Oslo now done, it's a little bit of sightseeing before heading to Denmark for GOTO in Copenhagen for Scott's and my "Cyber-broken" talk. In the meantime, this week is most...
https://www.troyhunt.com/weekly-update-523/
Article: Weekly Update 524: Live From Copenhagen - published about 1 month ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arr...
https://www.troyhunt.com/weekly-update-524/
Article: Weekly Update 525: AI Data Breach Hyperbole - published 26 days ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was th...
https://www.troyhunt.com/weekly-update-525/
Article: Weekly Update 526: Building HIBP AI/SI First - published 20 days ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now accepted t...
https://www.troyhunt.com/weekly-update-526/
Article: Weekly Update 527: Cybergeddon News v. Reality - published 12 days ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took...
https://www.troyhunt.com/weekly-update-527/
Article: Weekly Update 528: Reading AI-generated Code & the Economics of Solar - published 7 days ago.
Content: Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course.By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have reall...
https://www.troyhunt.com/weekly-update-528/
Article: What Is DevSecOps Automation? Definition & Examples - published about 20 hours ago.
Content: DevSecOps automation operationalizes secure software delivery practices. CIS-4 — Secure Configuration of Enterprise Assets and Software, Automation is ...
https://nhimg.org/glossary/devsecops-automation/
Article: What Is DevSecOps Principles? Definition & Examples - published about 18 hours ago.
Content: devsecops is best understood as a way of organising software delivery so security is part of the workflow, not a separate review at the end. It ...
https://nhimg.org/glossary/devsecops-principles/
Article: Cloud, Deployment & DevSecOps Engineer - Nominal | Built In NYC - published about 11 hours ago.
Content: Nominal is hiring for a Cloud, Deployment & DevSecOps Engineer in New York, NY, USA. Find more details about the job and how to apply at Built In ...
https://www.builtinnyc.com/job/cloud-deployment-devsecops-engineer/12135166
Article: Associate Director, DevSecOps Architect | Princeton, NJ, USA - eFinancialCareers - published about 5 hours ago.
Content: See job details and apply here for this associate director, devsecops architect job in Princeton, NJ, USA with S&P Global on eFinancialCareers US.
https://www.efinancialcareers.com/jobs-United_States-Princeton-Associate_Director_DevSecOps_Architect.id24982645
Article: Frontier Labs are bringing Software Security into Lime light. I started experimenting if we can ... - published about 4 hours ago.
Content: Complete the check below to continue. Skip to Navigation Skip to Right Sidebar. Go to devsecops · r/devsecops in 11h. u/_h4xr. Locked post. Stickied ...
https://www.reddit.com/r/devsecops/comments/1xqvsek/frontier_labs_are_bringing_software_security_into/
Article: When Every Cybersecurity Company Sounds the Same, How Do You Build Trust? - published about 8 hours ago.
Content: Cybersecurity has no shortage of innovation. New AI capabilities, emerging threats, and rapidly evolving products are transforming the industry at ...
https://www.cybersecurity-insiders.com/when-every-cybersecurity-company-sounds-the-same-how-do-you-build-trust/
Article: Ethiopia opens AI defence research lab with UAE backing - University World News - published about 7 hours ago.
Content: According to Ethiopia's Ministry of Defence, the facility houses dedicated laboratories for AI, cybersecurity, communications, automation ...
https://www.universityworldnews.com/post.php?story=20261107112149213
Article: Malaysia facing increasingly complex cybersecurity risks - The Star - published about 5 hours ago.
Content: The situation escalated when the National Cyber Security Agency (Nacsa) raised the National Cybersecurity Threat Level from low to medium on ...
https://www.thestar.com.my/news/nation/2026/11/08/malaysia-facing-increasingly-complex-cybersecurity-risks
Article: Better digital literacy needed to combat cyber threats - deputy minister - Malaysiakini - published about 6 hours ago.
Content: Teo added that national cybersecurity matters are the National Cyber Security Agency's responsibility, while MCMC can provide assistance and technical ...
https://www.malaysiakini.com/news/888746-better-digital-literacy-needed-to-combat-cyber-threats-deputy-minister
Article: As Europe prepares for the worst, Britons get schooled in preparedness | CBC News - published about 6 hours ago.
Content: Warnings have been widespread recently. Richard Horne, the head of the U.K.'s National Cyber Security Centre (NCSC), which is part of the government's ...
https://www.cbc.ca/news/world/britain-be-ready-campaign-emergency-prep-9.7413720
Article: Better digital literacy needed to combat cyber threats — Teo - The Edge Malaysia - published about 10 hours ago.
Content: Teo said national cybersecurity matters fell under the responsibility of the National Cyber Security Agency, while MCMC was always ready to provide ...
http://www.theedgemarkets.com/node/824985
Article: Protesters storm Microsoft data centre site in Amsterdam amidst growing European backlash - published about 10 hours ago.
Content: CYBER-SECURITY November 7, 2026 0. Italian Foreign Minister Antonio Tajani has publicly disclosed that... Kraków gunman linked to far-right ...
https://www.europeaninterest.eu/protesters-storm-microsoft-data-centre-site-in-amsterdam-amidst-growing-european-backlash/
Article: Fridge hacks exposed a chilling weakness. Now experts fear far worse is still to come - published about 10 hours ago.
Content: In the days following those attacks, researchers at the cyber security firm Claroty set out to test just how exposed internet-connected infrastructure ...
https://www.independent.co.uk/tech/fridge-hacks-ai-cyber-security-b3079934.html
Article: Hot fridges, a fake nuclear alert and a $6bn heist: are we in the foothills of a hacking epidemic? - published about 8 hours ago.
Content: We are in the “foothills” of a new hacking landscape, the head of the UK's National Cyber Security Centre said this week. Referring to flaws in IT ...
https://www.theguardian.com/news/ng-interactive/2026/nov/08/hot-fridges-a-fake-nuclear-alert-and-a-6bn-heist-are-we-in-the-foothills-of-a-hacking-epidemic
Article: AI gone rogue: It can take even us by surprise, says cybersecurity expert - EU Perspectives - published about 10 hours ago.
Content: One of its areas of focus is the growing role of artificial intelligence in cybersecurity. Dr Alexandros Zacharis, who leads ENISA's AI team, works ...
https://euperspectives.eu/2026/11/ai-cybersecurity-expert-artificial-intelligence-threats-interview-zacharis/
Article: A Cybersecurity Tsar Cannot Replace a Clear Chain of Responsibility - Atalayar - published about 7 hours ago.
Content: South Korea's president, Lee Jae Myung, called on 3 November for consideration of a powerful government-wide cybersecurity coordinating body.
https://www.atalayar.com/en/opinion/abdulla-saeed-alhebsi/cybersecurity-tsar-cannot-replace-clear-chain-of-responsibility/20261106132739230316.html
Article: OpenAI Partners With JPMorgan on Codex and Cybersecurity AI - TokenPost - published about 20 hours ago.
Content: OpenAI is expanding its work with JPMorgan Chase into coding and cybersecurity, adding its Codex agent and specialized cyber models to a bank ...
https://www.tokenpost.com/news/business/50655
Article: Japan forms elite 'Top Gun' team to counter hackers and bolster cybersecurity - published about 9 hours ago.
Content: Japan plans to form an elite cybersecurity team to tackle hacker attacks and cybersecurity risks arising from AI.
https://www.zaobao.com.sg/en/news/world/japan-forms-elite-top-gun-team-counter-hackers-and-bolster-cybersecurity
Article: Hot fridges, a fake nuclear alert and a $6bn heist: are we in the foothills of a hacking epidemic? - published about 8 hours ago.
Content: The cybersecurity expert Tal Be'ery has speculated that criminal hackers are struggling to make money from these flaws, as shown by a recent ...
https://www.theguardian.com/news/ng-interactive/2026/nov/08/hot-fridges-a-fake-nuclear-alert-and-a-6bn-heist-are-we-in-the-foothills-of-a-hacking-epidemic
Article: Why Your Container Image Ships a Shell and a Secret | Practical DevSecOps - LinkedIn - published 1 day ago.
Content: Your container image ships a compiler, a shell and a secret. Most of what the build carries is never used at runtime. An attacker will use it.
https://www.linkedin.com/posts/practical-devsecops_why-your-container-image-ships-a-shell-and-activity-7524803260801789952-LKrm
Article: Labiyb M Said, DevSecOps - CertDirectory.io - published about 18 hours ago.
Content: DevSecOps. IT professional with 2+ years' experience in support, automation, cloud (AWS/Azure), Linux, and DevOps. Skilled in testing, scripting, ...
https://certdirectory.io/profile/labiyb-m-said
Article: DevSecOps Developer / CIAM Architect — Public Transit (Montreal) - Abbeal - published about 13 hours ago.
Content: DevSecOps / CIAM developer needed in Montreal for a public transit operator. Ping/Keycloak/Okta, OAuth2/OIDC/SAML2, Kubernetes, Terraform.
https://abbeal.com/en/careers/developpeur-devsecops-ciam-transport-montreal
Article: Post-Quantum Security: The Era of Crypto-Agility and Crypto-Resilience - NTT Data - published about 22 hours ago.
Content: Head of Cybersecurity at NTT DATA Benelux & France. LinkedIn. Related blogs. Header Cybersecurity Month. Blog. Cybersecurity as a business priority.
https://www.nttdata.com/en-lu/insights/blog/post-quantum-security-the-crypto-agility-era
Article: Govt revises CSA draft, worries stay | The Daily Star - published about 12 hours ago.
Content: ... cyber security law and align some offences, such as defamation, with the Penal Code. The draft Cyber Security (Amendment) Act, 2026 will define ...
https://www.thedailystar.net/news/bangladesh/news/govt-revises-csa-draft-worries-stay-4318061
Article: How AI is breaking cybersecurity | Decoder - BigGo Finance - published about 19 hours ago.
Content: Alex Stamos, chief security officer at Cognition, argues that the multi-billion-dollar cybersecurity industry built over the past two decades is ...
https://finance.biggo.com/podcast/9943380416a03089
Article: Weight Loss Drugs Online: Secure Data Encryption Standards - BMJ Open - published about 14 hours ago.
Content: Regulatory frameworks cited focus on licensure and prescription enforcement rather than technical cybersecurity standards for telehealth weight ...
https://bmjopen.bmj.com/sites/default/files/highwire/i42630_empty_i42630_6r9ok7.html?vid=6xy0rreClD
Article: UH MyChart "back up and running", after cybersecurity incident - News 5 Cleveland - published about 13 hours ago.
Content: ... patient portal, is now "up and running" after more than two weeks of disruption due to a cybersecurity incident.
https://www.news5cleveland.com/news/local-news/we-follow-through/uh-mychart-back-up-and-running-reportedly-recovered-from-cybersecurity-incident
Article: UH restores patient access to MyChart system that was shut down by cybersecurity incident - published about 12 hours ago.
Content: ... cybersecurity incident that disrupted its online systems for more than two weeks. UH announced Saturday that MyChart had been restored, allowing ...
https://www.cleveland.com/metro/2026/11/uh-restores-patient-access-to-mychart-system-that-was-shut-down-by-cybersecurity-incident.html
Article: AfroTech's Morgan DeBaun Says Cybersecurity Is Millennials' Safest Bet - Forbes - published about 11 hours ago.
Content: Examines why AfroTech CEO Morgan DeBaun calls cybersecurity the most promising career as AI spreads. Drawing on DeBaun's remarks at AfroTech 2026 ...
https://www.forbes.com/sites/jasminebrowley/2026/11/07/afrotechs-morgan-debaun-says-cybersecurity-is-millennials-safest-bet/
Article: Windows Defender Exploit Guard ASR VBScript/JS Rule - published about 9 years ago.
Content: Microsoft has been adding to Windows 10 the features of the Enhanced Mitigation Experience Toolkit (EMET) in to the OS. On the 1709 release they added more features and expanded on them as part of Windows Defender Exploit Guard One of the features of great interest for me is Attack Surface Reduction. I have used this feature in EMET with great success as a m...
https://www.darkoperator.com/blog/2017/11/6/windows-defender-exploit-guard-asr-vbscriptjs-rule
Article: Windows Defender Exploit Guard ASR Obfuscated Script Rule - published about 9 years ago.
Content: On this blog post I will cover my testing of the Attack Surface Reduction rule for Potentially Obfuscated Scripts. This is one of the features that intrigued me the most. One obfuscates the scripts for several reasons:Bypass detection controls like AV, automatic log analysis and other controls. Hinder analysis of the script to determine its purpose and actio...
https://www.darkoperator.com/blog/2017/11/8/windows-defender-exploit-guard-asr-obfuscated-script-rule
Article: Windows Defender Exploit Guard ASR Rules for Office - published almost 9 years ago.
Content: On this blog post I continue looking at the ASR rules, this time I'm looking at the ASR rules for Office. The ASR rules for office are:Block Office applications from creating child processesBlock Office applications from creating executable contentBlock Office applications from injecting code into other processesBlock Win32 API calls from Office macroThese ...
https://www.darkoperator.com/blog/2017/11/11/windows-defender-exploit-guard-asr-rules-for-office
Article: Operational Look at Sysinternals Sysmon 6.20 Update - published almost 9 years ago.
Content: Sysmon has been a game changer for many organizations allowing their teams to fine tune their detection of malicious activity when combined with tools that aggregate and correlate events. A new version of Symon was recently released. Version 6.20 fixes bugs and adds new features. Some the of the note worthy changes for me are:Enhancements in WMI Logging. Ab...
https://www.darkoperator.com/blog/2017/11/24/operational-look-at-sysinternals-sysmon-620-update
Article: Rebuilding My Playbook .. Knowledge Base - published almost 9 years ago.
Content: I find myself in the situation where I lost my personal playbook by user error. I accidentally deleted the VM where I ran xWiki where it was kept and did not realized the mistake until days later. Even if painful to rebuild it is a good opportunity to think on how to better organize it and put it in a more flexible format. I Initially called my collection o...
https://www.darkoperator.com/blog/2017/12/10/nmba1hrmndda8m3eo7ipoh7bxvphz4
Article: Operating Offensively Against Sysmon - published about 8 years ago.
Content: Sysmon is a tool written by Mark Russinovich that I have covered in multiple blog post and even wrote a PowerShell module called Posh-Sysmon to help with the generation of configuration files for it. Its main purpose is for the tracking of potentially malicious activity on individual hosts and it is based on the same technology as Procmon. It differs from ot...
https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
Article: Getting DNS Client Cached Entries with CIM/WMI - published almost 7 years ago.
Content: What is DNS CacheThe DNS cache maintains a database of recent DNS resolution in memory. This allows for faster resolution of hosts that have been queried in the recent past. To keep this cache fresh and reduce the chance of stale records the time of items in the cache is of 1 day on Windows clients. The DNS Client service in Windows is the one that manages t...
https://www.darkoperator.com/blog/2020/1/14/getting-dns-client-cached-entries-with-cimwmi
Article: Tracking WMI Activity with PSGumshoe - published over 4 years ago.
Content: WMI (Windows Management Instrumentation) is the Microsoft implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF). This allows for a unified way to manage a group of systems by administrators allowing them to get information about the system, its current state...
https://www.darkoperator.com/blog/2022/3/27/tracking-wmi-activity-with-psgumshoe