McHughSecurity

OSINT for Missing Persons (Part 1 – Intro)

April 10, 2020 A.McHugh 2 Comments

This is post 1 of 1 in the series “Missing Persons OSINT”

Sometime ago I participated in an event run by TraceLabs in conjunction with the Australian Federal Police to locate pieces of information for missing persons across Australia. The twist on this event being it was gamified to allow competing teams to try and beat each other to amass the most amount of points according to a points award system.

I will now be competing in the Missing Persons CTF on the 11th of April 2020, and in the lead up to this now virtual CTF – I will be building some more capable infrastructure and tooling to support this challenge.

So for those new starters, what do you need as a bare minimum to start digging and submitting indicators?

Open-Source Intelligence

Deploying (and using) TheHive4 [Part 1]

April 5, 2020 A.McHugh 3 Comments

This is post 1 of 4 in the series “The Hive Installation”

Deploying (and using) TheHive4 [Part 1]
Building TheHive4 (4.0.5) and configuring MISP, Cortex and Webhooks.
Building the Assemblyline Analyzer for TheHive’s Cortex.
TheHive 4.1.0 Deployment and Integration with MISP

I have been an off and on user of TheHive for nearly a year now, and it is encouraging to see the development and release of TheHive4 (even if in pre-release). In this post I will walk through the deployment, configuration and migration of TheHive to TheHive4, and what improvements have been implemented into this release.

Build

Threat hunting with Elasticsearch and Kibana (Part 1)

April 4, 2020 A.McHugh 2 Comments

As part of my final Masters degree research component I have been collecting data from honeypots which I have seeded around the globe. The objective being to distil this data in to organisational threat data based on a fictitious business.

Part of the complication I am going to start facing, is how to how Elasticsearch and Kibana to find specific information for me from this live data set.

Previously I have indicated that a data set exists which was produced by the Canadian Institute for Cybersecurity, called IDS 2018, which contains Windows Event Logs and PCAP files relating to a set of simulated attacks generated for the purposes of teaching people how to hunt within similar datasets.

Here I will be discussing the deployment, configuration and interaction with this data set to achieve the outcome required.

Digital Forensics & Incident Response, Security Operations, Threat Intelligence

OSINT for Threat Intelligence

March 14, 2020 A.McHugh No Comments

It seems to be a significant buzzword nowadays, but Threat Intelligence is available in an abundance from a wide range of curators and commercial suppliers.

So what does it take to correlate observables such as precursors to determine if they are an indicator of compromise, and by whom have they been generated?

Blog, Open-Source Intelligence

Loading Windows Event Logs to Elasticsearch

January 13, 2020 A.McHugh No Comments

So whilst playing through an element of Kringlecon 2019 I came across a task which didn’t really suit my Christmas challenge of going to Linux full-time. One such challenge involved a Windows Event Log file with no ready access to a Linux derivitive of Event Viewer. My Kali laptop for my Christmas challenge was already…

Digital Forensics & Incident Response, Operate

Building a Cuckoo Sandbox

May 28, 2019 A.McHugh 1 Comment

Sometimes there is a need to analyse files in a live environment where their composition and provenance may not be entirely certain. For the most part we can try to reply on virus detection and heuristics to detect potentially malicious files, but what about those files which have not yet been identified, or have been specifically crafted for your organisation as a targeted attack?

Note: I have updated this article to reflect the current installation requirements for Cuckoo on Ubuntu 18.04 (as at 22nd Feb 2021).

Read More “Building a Cuckoo Sandbox” »

Build, Digital Forensics & Incident Response

Extracting RAM from VirtualBox session

May 28, 2019 A.McHugh No Comments

Over the last few months I have been playing with Cuckoo, and reworking its function to suit my own requirements. Part of this has involved the separation of components within Cuckoo into functional units. This particular component relates to extracting the RAM from a VirtualBox machine for analysis after ceasing the VM. For this to…

Digital Forensics & Incident Response, Operate