Blue Team Toolkit başlıklı teknik kaynağın içeriği, mavi takım & siem alanında pratik bilgiler sunmaktadır. Aşağıda belgeden hareketle hazırlanan teknik inceleme yer almaktadır.
Genel Bakış
Day-13 Blue Team Toolkit Network Discovery and Mapping 6 tools: Nmap – Network scanner Nuclei – Vulnerability scanner Masscan – Fast network scanner Angry IP Scanner – IP/Port scanner ZMap – Large-scale network scanner Shodan – Internet-facing asset search engine Vulnerability Management: 🟢OpenVAS – Open-source vulnerability scanner 🟢Nessus Essentials – Vulnerability scanner 🟢Nexpose – Vulnerability management tool 🟢HackerOne – Bug bounty management platform Security Monitoring: Sysmon – System monitor for Windows Velociraptor – Endpoint visibility and collection tool SysmonSearch – Sysmon event log visualization Wazuh – Open-source SIEM and security monitoring ELK Stack (Elasticsearch, Logstash, Kibana) – Log management & monitoring Splunk – Security information and event management Graylog – Log management and analysis OSSIM – AlienVault’s open-source SIEM SIEMonster – Community-driven SIEM platform Nagios – Infrastructure and security monitoring Zabbix – Network and system monitoring Threat Tools and Techniques: LOLBAS – Living Off The Land Windows Binaries GTFOBins – Living Off The Land Linux Binaries filesec.io – Attacker file extensions KQL Search – KQL query aggregator Unprotect Project – Malware evasion techniques knowledge base Chainsaw – Fast Windows forensic artefacts searcher freq – Domain generation algorithm malware detection yarGen – YARA rule generator EmailAnalyzer – Suspicious email analyser VCG – Code security scanning tool Threat Intelligence: MISP – Malware Information Sharing Platform AlienVault OTX – Open Threat Exchange platform VirusTotal – File, URL, and hash threat intelligence AbuseIPDB – Malicious IP address reporting and lookup ThreatFox – IOCs (Indicators of Compromise) database YETI – Your Everyday Threat Intelligence platform MITRE ATT&CK – Adversary tactics and techniques knowledge base Anomali ThreatStream – Threat intelligence management platform OpenCTI – Open Cyber Threat Intelligence platform Incident Response Planning: NIST 800-61 – Computer Security Incident Handling Guide SANS Incident Handler’s Handbook – Practical IR guidance TheHive – Incident response and case management platform Cortex – Observable analysis and automated response DFIR IR Playbooks – Open-source digital forensics & IR playbooks RTIR (Request Tracker for Incident Response) – Incident ticketing system Shuffle SOAR – Security Orchestration, Automation, and Response Velociraptor – Endpoint visibility and forensic collection GRR Rapid Response – Incident response framework by Google IRIS – Incident Response Investigation System Malware Detection and Analysis: Cuckoo Sandbox – Automated malware analysis sandbox REMnux – Linux distro for reverse engineering malware Intezer Analyze – Malware code reuse & genetic analysis PeStudio – Windows executable analysis tool Ghidra – Software reverse engineering suite YARA – Pattern matching for malware detection ClamAV – Open-source antivirus engine Radare2 – Reverse engineering framework MalwareBazaar – Repository of malware samples Hybrid Analysis – Free malware analysis platform Data Recovery: TestDisk – Partition recovery and disk repair PhotoRec – File recovery from disks, memory cards, and media Recuva – Windows file recovery tool R-Studio – Advanced data recovery software for Windows, Mac, and Linux EaseUS Data Recovery Wizard – File and system recovery solution Digital Forensics: Autopsy – Open-source digital forensics platform FTK (Forensic Toolkit) – Comprehensive forensic investigation suite Sleuth Kit – Command-line forensic analysis toolkit X-Ways Forensics – Advanced forensic analysis software Volatility – Memory forensics framework CAPE Sandbox – Automated malware analysis and forensics KAPE – Forensic collection and triage tool Velociraptor – Endpoint visibility and collection for investigations Plaso – Log file timeline analysis Redline – Host investigative tool for memory and file analysis Security Awareness Training: SANS Security Awareness – Training programs and resources PhishLab – Phishing simulation and user education TryHackMe – Cybersecurity challenges platform HackTheBox – Cybersecurity challenges platform PhishMe – Phishing training and simulations Warning: (Below Link Which I have attachment Of Official Websites and Incase if you find any suspect website please go with scan with VIRUSTOTAL and research it) Network Discovery and Mapping Nmap Nmap (short for Network Mapper) is a free and open-source network scanner tool used to discover hosts and services on a computer network, and to probe for information about their characteristics....
Temel Kavramlar
It can be used to determine which ports on a network are open and what services are running on those ports....
Teknik Uygulama
Including the ability to identify security vulnerabilities on the network....
Örnek Senaryo
You can download the latest release from here Usage: nmap 192.168.1.1 – Scan a single IP nmap 192.168.1.1-254 – Scan a range of IPs nmap -iL targets.txt – Scan targets from a file nmap 192.168.1.1 -p 21 – Port scan for a specific port (e.g., port 21) nmap 192.168.1.1 -A – Aggressive scan (OS detection, version detection, script scanning, traceroute) CheatSheet: NMAP FULL COMMANDS Nuclei A specialized tool designed to automate the process of detecting vulnerabilities in web applications, networks, and infrastructure....
Dikkat Edilmesi Gerekenler
Nuclei uses pre-defined templates to probe a target and identify potential vulnerabilities....
Özet
It can be used to test a single host or a range of hosts, and can be configured to run a variety of tests to check for different types of vulnerabilities....
Bölüm 7
Install: • git clone https://github.com/projectdiscovery/nuclei.git; \ cd nuclei/v2/cmd/nuclei; \ go build; \ mv nuclei /usr/local/bin/; \ nuclei -version; Usage: nuclei -u https://example.com – All the templates get executed from default template installation path nuclei -u https://example.com -t cves/ -t exposures/ – Custom template directory or multiple template directory nuclei -list http_urls.txt – Templates can be executed against list of URLs nuclei -list urls.txt -t cves/ -exclude-templates cves/2020/CVE-2020-XXXX.yaml – Excluding single template CheatSheet: NUCLEI 🟢Masscan A port scanner that is similar to nmap, but is much faster and can scan a large number of ports in a short amount of time....
Bölüm 8
Masscan uses a novel technique called "SYN scan" to scan networks, which allows it to scan a large number of ports very quickly....
Bu makale "Blue Team Toolkit" kaynağından üretilmiştir. Tam metin ve orijinal doküman /root/pdf klasöründe mevcuttur. İçerik eğitim amaçlıdır.