ANY.RUN<p>🚨 How to Spot <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ransomware</span></a> Activity Early with TI Lookup <br>Malware can leave your SOC blind unless you proactively hunt its behavior. Ransomware is a good example. </p><p>⚠️ Typically it only encrypts files without removing backups or logs. When it starts executing commands to hide activity and disrupt recovery, the impact becomes far more serious, leading to downtime, data loss, and business disruption. </p><p>If your SOC is familiar with these techniques and monitors them in advance, response will be faster and more effective. Let’s see how TI Lookup can be used to reveal these behaviors and close monitoring gaps. </p><p>👨💻 We started with a basic TI Lookup query for ransomware-related commands: threatName:"ransomware" AND commandLine:".exe *" <br>To refine the search, we gradually excluded irrelevant results: <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%257B%2522query%2522:%2522threatName:%255C%2522ransomware%255C%2522%2520AND%2520commandLine:%255C%2522.exe%2520*%255C%2522%2520NOT%2520commandLine:%255C%2522conhost.exe%255C%2522%2520NOT%2520commandLine:%255C%2522%2520-Embedding%255C%2522%2520NOT%2520commandLine:%255C%2522svchost.exe%2520-k%2520NetworkService%255C%2522%2520NOT%2520commandLine:%255C%2522DllHost.exe%2520%255C%2522%2522,%2522dateRange%2522:180%257D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%257B%2522query%2522:%2522threatName:%255C%2522ransomware%255C%2522%2520AND%2520commandLine:%255C%2522.exe%2520*%255C%2522%2520NOT%2520commandLine:%255C%2522conhost.exe%255C%2522%2520NOT%2520commandLine:%255C%2522%2520-Embedding%255C%2522%2520NOT%2520commandLine:%255C%2522svchost.exe%2520-k%2520NetworkService%255C%2522%2520NOT%2520commandLine:%255C%2522DllHost.exe%2520%255C%2522%2522,%2522dateRange%2522:180%257D</span></a> <br>🎯 This search query uncovers far more than <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IOCs</span></a>. It reveals attacker techniques that can enrich detection logic across your entire environment. </p><p>Let’s break down the commands ransomware uses to hide its tracks and block system recovery.<br>👾 See execution on a live system and download an actionable report: <a href="https://app.any.run/tasks/0f5784ac-bb52-46d5-8c14-616a4e34e336/?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoservice&utm_term=200825" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/tasks/0f5784ac-bb5</span><span class="invisible">2-46d5-8c14-616a4e34e336/?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoservice&utm_term=200825</span></a> </p><p>In this case, we observed ransomware leveraging a set of Windows utilities to erase traces and block recovery: <br>wevtutil.exe: Clearing event logs (Setup, Security, System, Application) and disabling security logging, effectively erasing traces of malicious activity and complicating analysis. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522wevtutil*%2520cl%255C%2522%2520OR%2520commandLine:%255C%2522wevtutil*%2520sl%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522wevtutil*%2520cl%255C%2522%2520OR%2520commandLine:%255C%2522wevtutil*%2520sl%255C%2522%2522,%2522dateRange%2522:180%7D</span></a> </p><p>bcdedit.exe: Changing boot configuration, allowing the system to ignore startup errors, and disabling Windows recovery environment to ensure persistence. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522bcdedit*%2520/set%255C%2522%2522,%2522dateRange%2522:180%7D%20" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522bcdedit*%2520/set%255C%2522%2522,%2522dateRange%2522:180%7D%20</span></a> </p><p>fsutil.exe: Deleting the USN (Update Sequence Number) journal to remove records of file changes. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522fsutil*deletejournal%255C%2522%2522,%2522dateRange%2522:180%7D%20" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522fsutil*deletejournal%255C%2522%2522,%2522dateRange%2522:180%7D%20</span></a> </p><p>cipher.exe: Overwriting free disk space to make deleted or unencrypted files unrecoverable. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522cipher*/w:C%255C%2522%2522,%2522dateRange%2522:180%7D%20" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522cipher*/w:C%255C%2522%2522,%2522dateRange%2522:180%7D%20</span></a> </p><p>wbadmin.exe: Deleting backup catalogs, making built-in Windows backups and shadow copies unavailable. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522wbadmin*delete%2520catalog%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522wbadmin*delete%2520catalog%255C%2522%2522,%2522dateRange%2522:180%7D</span></a> </p><p>schtasks.exe: Disabling System Restore tasks, preventing the creation of automatic restore points. <br>🔍 <a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522schtasks*/Change%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spot_ransomware_early&utm_content=linktoti&utm_term=200825#%7B%2522query%2522:%2522commandLine:%255C%2522schtasks*/Change%255C%2522%2522,%2522dateRange%2522:180%7D</span></a> </p><p>👨💻 Early visibility into techniques strengthens resilience. What can you do now?<br>Use TI Lookup to expand threat visibility with live attack data and enrich IOCs & behavioral rules with insights from real-world samples. </p><p>🎯 <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> ATT&CK Techniques <br>Data Encrypted for Impact (T1486) <br>Inhibit System Recovery (T1490) <br>Indicator Removal (T1070) </p><p>Strengthen resilience and protect critical assets through proactive security with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> 🚀 </p><p><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
veganism.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Veganism Social is a welcoming space on the internet for vegans to connect and engage with the broader decentralized social media community.
Administered by:
Server stats:
279active users
veganism.social: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.0-alpha.5
#mitre
1 post · 1 participant · 0 posts today
ANY.RUN<p><a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IOCs</span></a>:<br>SHA256:<br>560afd97f03f2ed11bf0087d551ae45f2046d6d52f0fa3d7c1df882981e8b346</p><p>8b079bae684fd287c605de8acae338401a76a412c6a802faf2cf6e9ec0cf6224</p><p>0ba3b2871e0ad3b4fba615ea76e2d5f7cefa80e87468c6dcfc9b44feb1e5ea7a</p><p>C2dd4543678f514b5323944993552c106a3d250b0c35cf16c2bb2171ab0a0199</p><p>C23f6a4286dc18bbf1ff06420357da1af1132dddf37ad6f51d9915fccca6c97e</p><p>File names & directories:<br>Shields.msi</p><p>%USERPROFILE%\AppData\Local\Programs\Advanced PDF Shaper Ultimate\LdVBoxSVC.exe</p><p>C:\WINDOWS\system32\openwith.exe</p><p>URLs:<br>hxxps[:]//84.200[.]80.8/gateway/6caqmphx.fan5l<br>hxxps[:]//zerontwoposh[.]live/gateway/n5eepk7n.2a6s4</p><p>TLS Certificates:</p><p>SN: 29769a39032fdff8 | Thumb: 6f13c27a9150db7d02e1e1ff849921cc2bb0754e<br>SN: 3ac75d9f42ced25b2c4534f40d08b41ffefe4ab | Thumb: b938263deb95997f9d47ce9ef9817b5def90eafa</p><p>SN: 3b5db13bb882d9c4 | Thumb: f2b2e768359891f0543cd830d728c923bfc3c307<br>C2 JARM fingerprint:</p><p>3fd3fd20d0000000003fd3fd3fd3fd9c542afc474937e300923d7c192419b1</p><p><a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> Techniques:<br>Phishing (T1566)<br>User Execution: Malicious Copy and Paste (T1204.004)<br>System Binary Proxy Execution: Msiexec (T1218.007)<br>Virtualization/Sandbox Evasion: System Checks (T1497.001)<br>Hijack Execution Flow (T1574)<br>Obfuscated Files or Information: Steganography (T1027.003)</p>
ANY.RUN<p>🚨 How <a href="https://infosec.exchange/tags/Rhadamanthys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Rhadamanthys</span></a> Stealer Slips Past Defenses using ClickFix<br>⚠️ Rhadamanthys is now delivered via ClickFix, combining technical methods and social engineering to bypass automated security solutions, making detection and response especially challenging.<br>👾 While earlier ClickFix campaigns mainly deployed <a href="https://infosec.exchange/tags/NetSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetSupport</span></a> RAT or <a href="https://infosec.exchange/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AsyncRAT</span></a>, this C++ infostealer ranks in the upper tier for advanced evasion techniques and extensive data theft capabilities.</p><p><a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> Sandbox lets SOC teams observe and execute complex chains, revealing evasive behavior and providing intelligence that can be directly applied to detection rules, playbooks, and proactive hunting.</p><p>🔗 Execution Chain:<br>ClickFix ➡️ msiexec ➡️ exe-file ➡️ infected system file ➡️ PNG-stego payload</p><p>In a recent campaign, the phishing domain initiates a ClickFix flow (<a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> T1566), prompting the user to execute a malicious MSI payload hosted on a remote server. </p><p>🥷 The installer is silently executed in memory (<a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> T1218.007), deploying a stealer component into a disguised software directory under the user profile.</p><p>The dropped binary performs anti-VM checks (T1497.001) to avoid analysis. </p><p>In later stages, a compromised system file is used to initiate a TLS connection directly to an IP address, bypassing DNS monitoring.</p><p>📌 For encryption, attackers use self-signed TLS certificates with mismatched fields (e.g., Issuer or Subject), creating distinctive indicators for threat hunting and expanding an organization’s visibility into its threat landscape.</p><p>🖼️ The C2 delivers an obfuscated PNG containing additional payloads via steganography (T1027.003), extending dwell time and complicating detection.</p><p>🎯 See execution on a live system and download actionable report: <a href="https://app.any.run/tasks/a101654d-70f9-40a5-af56-1a8361b4ceb0/?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_term=120825&utm_content=linktoservice" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/tasks/a101654d-70f</span><span class="invisible">9-40a5-af56-1a8361b4ceb0/?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_term=120825&utm_content=linktoservice</span></a></p><p>🔍 Use these <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> TI Lookup search queries to track similar campaigns and enrich <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IOCs</span></a> with live attack data from threat investigations across 15K SOCs:<br><a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522threatName:%255C%2522clickfix%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522threatName:%255C%2522clickfix%255C%2522%2522,%2522dateRange%2522:180%7D</span></a><br><a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522threatName:%255C%2522rhadamanthys%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522threatName:%255C%2522rhadamanthys%255C%2522%2522,%2522dateRange%2522:180%7D</span></a><br><a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522(threatName:%255C%2522clickfix%255C%2522%2520OR%2520threatName:%255C%2522susp-clipboard%255C%2522)%2520AND%2520threatName:%255C%2522netsupport%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522(threatName:%255C%2522clickfix%255C%2522%2520OR%2520threatName:%255C%2522susp-clipboard%255C%2522)%2520AND%2520threatName:%255C%2522netsupport%255C%2522%2522,%2522dateRange%2522:180%7D</span></a><br><a href="https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522(threatName:%255C%2522clickfix%255C%2522%2520OR%2520threatName:%255C%2522susp-clipboard%255C%2522)%2520AND%2520threatName:%255C%2522asyncrat%255C%2522%2522,%2522dateRange%2522:180%7D" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">intelligence.any.run/analysis/</span><span class="invisible">lookup?utm_source=mastodon&utm_medium=post&utm_campaign=rhadamanthys&utm_content=linktoti&utm_term=120825#%7B%2522query%2522:%2522(threatName:%255C%2522clickfix%255C%2522%2520OR%2520threatName:%255C%2522susp-clipboard%255C%2522)%2520AND%2520threatName:%255C%2522asyncrat%255C%2522%2522,%2522dateRange%2522:180%7D</span></a></p><p>👾 IOCs:<br>84.200[.]80.8<br>179.43[.]141.35<br>194.87[.]29.253<br>flaxergaurds[.]com<br>temopix[.]com<br>zerontwoposh[.]live<br>loanauto[.]cloud<br>wetotal[.]net<br>Find more indicators in the comments 💬</p><p>Protect critical assets with faster, deeper visibility into complex threats using <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ANYRUN</span></a> 🚀</p><p><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a></p>
Guia do Investidor<p>Mitre (MTRE3) libera pagamento aos acionistas, mas de um jeito que poucos esperavam</p><p>🇧🇷 Leia mais: <a href="https://guiadoinvestidor.com.br/mercado/mitre-libera-pagamento-aos-acionistas-mas-de-um-jeito-que-poucos-esperavam/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">guiadoinvestidor.com.br/mercad</span><span class="invisible">o/mitre-libera-pagamento-aos-acionistas-mas-de-um-jeito-que-poucos-esperavam/</span></a></p><p><a href="https://mastodon.social/tags/Mercado" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mercado</span></a> <a href="https://mastodon.social/tags/Mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mitre</span></a> <a href="https://mastodon.social/tags/MTRE3" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MTRE3</span></a></p>
G :donor: :Tick:<p>Anyone have experience of submitting a proposal for new sub-techniques to MITRE ATT&CK by MITRE ?</p><p>Yes I’ll go read the philosophy paper but any other hints/tips/guidance appreciated!</p><p><a href="https://infosec.exchange/tags/Community" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Community</span></a> <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://infosec.exchange/tags/MITREATTACK" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITREATTACK</span></a> <a href="https://infosec.exchange/tags/SecurityResearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityResearch</span></a></p>
BCWHS<p>MITRE ATT&CK & Cyber Risk Institute Mapping<br>Mapping Cyber Risk Institute framework to MITRE ATT@CK. Why not?<br><a href="https://wadebach.blackcatwhitehatsecurity.com/blog.cfm#CRImapping" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">wadebach.blackcatwhitehatsecur</span><span class="invisible">ity.com/blog.cfm#CRImapping</span></a><br><a href="https://mastodon.social/tags/Blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Blog</span></a> <a href="https://mastodon.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://mastodon.social/tags/Cyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cyber</span></a> <a href="https://mastodon.social/tags/Risk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Risk</span></a> <a href="https://mastodon.social/tags/Institute" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Institute</span></a> <a href="https://mastodon.social/tags/Mapping" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mapping</span></a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a></p>
BCWHS<p>MITRE ATT&CK & NIST 800-53 Mapping<br>33,579 mappings have been magically connected between MITRE ATT&CK and NIST 800-53.<br><a href="https://wadebach.blackcatwhitehatsecurity.com/blog.cfm#80053mapping" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">wadebach.blackcatwhitehatsecur</span><span class="invisible">ity.com/blog.cfm#80053mapping</span></a><br><a href="https://mastodon.social/tags/Blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Blog</span></a> <a href="https://mastodon.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://mastodon.social/tags/NIST" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NIST</span></a> <a href="https://mastodon.social/tags/Mapping" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mapping</span></a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <a href="https://mastodon.social/tags/CFML" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CFML</span></a></p>
BCWHS<p>MITRE ATT&CK & CISA CVE Mapping<br>I have a connection established with CISA's CVE JSON and MITRE ATT&CK's TAXII API. But how do I map them together?<br><a href="https://wadebach.blackcatwhitehatsecurity.com/blog.cfm#cvemapping" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">wadebach.blackcatwhitehatsecur</span><span class="invisible">ity.com/blog.cfm#cvemapping</span></a><br><a href="https://mastodon.social/tags/Blog" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Blog</span></a> <a href="https://mastodon.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://mastodon.social/tags/ATT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ATT</span></a>&CK <a href="https://mastodon.social/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CISA</span></a> <a href="https://mastodon.social/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a> <a href="https://mastodon.social/tags/Mapping" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mapping</span></a> <a href="https://mastodon.social/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a></p>
News Beep<p>Fire crews responding to blaze at Mitre 10 MEGA in West Auckland</p><p>“On arrival, we found the building to be heavily smoke-logged.” The fire was reported at 6.41pm, he said.…<br><a href="https://newsbeep.org/tags/NewsBeep" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NewsBeep</span></a> <a href="https://newsbeep.org/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>News</span></a> <a href="https://newsbeep.org/tags/Headlines" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Headlines</span></a> #10 <a href="https://newsbeep.org/tags/around" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>around</span></a> <a href="https://newsbeep.org/tags/at" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>at</span></a> <a href="https://newsbeep.org/tags/auckland" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>auckland</span></a> <a href="https://newsbeep.org/tags/blaze" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blaze</span></a> <a href="https://newsbeep.org/tags/crews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>crews</span></a> <a href="https://newsbeep.org/tags/fire" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fire</span></a> <a href="https://newsbeep.org/tags/from" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>from</span></a> <a href="https://newsbeep.org/tags/in" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>in</span></a> <a href="https://newsbeep.org/tags/mega" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mega</span></a> <a href="https://newsbeep.org/tags/mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mitre</span></a> <a href="https://newsbeep.org/tags/NewZealand" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NewZealand</span></a> <a href="https://newsbeep.org/tags/NZ" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NZ</span></a> <a href="https://newsbeep.org/tags/responding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>responding</span></a> <a href="https://newsbeep.org/tags/to" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>to</span></a> <a href="https://newsbeep.org/tags/tonight" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tonight</span></a> <a href="https://newsbeep.org/tags/west" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>west</span></a><br><a href="https://www.newsbeep.com/20636/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">newsbeep.com/20636/</span><span class="invisible"></span></a></p>
CybersecKyle<p>From yesterday:</p><p>MITRE Launches New Framework to Tackle Crypto Risks <a href="https://www.infosecurity-magazine.com/news/mitre-launches-new-framework/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">infosecurity-magazine.com/news</span><span class="invisible">/mitre-launches-new-framework/</span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a></p>
:hacker_p: :hacker_f: :hacker_t:<p><span class="h-card" translate="no"><a href="https://furry.engineer/@soatok" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>soatok</span></a></span> may I directly ask a question? </p><p>During an interview I was asked about <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://infosec.exchange/tags/ATT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ATT</span></a>&CK. I was aware of it but never considered it of actual utility. Do people use it actually?</p><p>Thanks 🙇</p>
CybersecKyle<p>CVE Foundation eyes year-end launch following 11th-hour rescue of MITRE program</p><p>“To set the record straight, there was no funding issue, but rather a contract administration issue that was resolved prior to a contract lapse,” </p><p><a href="https://cyberscoop.com/cve-program-funding-crisis-cve-foundation-mitre/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cyberscoop.com/cve-program-fun</span><span class="invisible">ding-crisis-cve-foundation-mitre/</span></a></p><p><a href="https://infosec.exchange/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a> <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a></p>
Xavier «X» Santolaria :verified_paw: :donor:<p>Updates from the <a href="https://infosec.exchange/tags/CVEFoundation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVEFoundation</span></a></p><blockquote><p>Representatives from the CVE Foundation met with representatives from CISA on 4/24/2025. The talks were positive and encouraging. All parties wish to keep the conversation and progress moving forward.</p></blockquote><p><a href="https://www.thecvefoundation.org/news" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">thecvefoundation.org/news</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/cve" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cve</span></a> <a href="https://infosec.exchange/tags/mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mitre</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a></p>
Doug Metz<p>I recorded a brief video, walking through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing - all in minutes.
<a href="https://youtu.be/hI1EqojI1DA" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/hI1EqojI1DA</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DFIR</span></a> <a href="https://infosec.exchange/tags/MalwareAnalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MalwareAnalysis</span></a> <a href="https://infosec.exchange/tags/YARA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>YARA</span></a> <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://infosec.exchange/tags/Rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Rust</span></a></p><p>MalChela: <a href="https://github.com/dwmetz/MalChela" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/dwmetz/MalChela</span><span class="invisible"></span></a></p><p>Blog: <a href="https://bakerstreetforensics.com" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">bakerstreetforensics.com</span><span class="invisible"></span></a></p>
Benjamin Carr, Ph.D. 👨🏻💻🧬<p><a href="https://hachyderm.io/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a> fallout: The splintering of the standard <a href="https://hachyderm.io/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> tracking system has begun<br>Earlier this week, CVE program faced doom as the <a href="https://hachyderm.io/tags/US" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>US</span></a> <a href="https://hachyderm.io/tags/government" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>government</span></a> discontinued funding for <a href="https://hachyderm.io/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a>, the non-profit that operates the program. Uncle Sam U-turned at the very last minute.<br>Meanwhile, the <a href="https://hachyderm.io/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EU</span></a> is rolling its own. <a href="https://hachyderm.io/tags/EuropeanUnion" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EuropeanUnion</span></a> Agency for <a href="https://hachyderm.io/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> (<a href="https://hachyderm.io/tags/ENISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ENISA</span></a>) developed and maintains this alternative, which is known as the <a href="https://hachyderm.io/tags/EUVD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EUVD</span></a>, or the European Union Vulnerability Database.<br><a href="https://www.theregister.com/2025/04/18/splintering_cve_bug_tracking/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">theregister.com/2025/04/18/spl</span><span class="invisible">intering_cve_bug_tracking/</span></a></p>
Marcus "MajorLinux" Summers<p>Saved at the final hour!</p><p>Security Database Used by Apple Goes Independent After Funding Cut [Updated] </p><p><a href="https://www.macrumors.com/2025/04/16/security-database-used-apple-goes-independent/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">macrumors.com/2025/04/16/secur</span><span class="invisible">ity-database-used-apple-goes-independent/</span></a></p><p><a href="https://toot.majorshouse.com/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://toot.majorshouse.com/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Apple</span></a> <a href="https://toot.majorshouse.com/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a> <a href="https://toot.majorshouse.com/tags/Mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mitre</span></a> <a href="https://toot.majorshouse.com/tags/Funding" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Funding</span></a> <a href="https://toot.majorshouse.com/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://toot.majorshouse.com/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tech</span></a></p>
Prof. Dr. Dennis-Kenji Kipker<p>Nach dem gestrigen Schock und der drohenden CVE-Abschaltung hat die US-Regierung die Finanzierungsvereinbarung mit der <a href="https://chaos.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> Corporation im so ziemlich letzten Moment verlängert.</p><p>Im Nachgang an den gestrigen Tag ergeben sich durchaus Parallelen zur bisherigen Trump'schen Salamitaktik in Fragen der nationalen Digitalregulierung mit außenpolitischer Relevanz.</p><p>Viel deutlicher als gestern konnte der Weckruf für die EU wohl nicht sein, eigene Wege zu finden und zu gehen.</p><p><a href="https://www.heise.de/news/Nach-drohendem-CVE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">heise.de/news/Nach-drohendem-C</span><span class="invisible">VE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html</span></a></p>
Joe Ortiz<p>In the very last minute, CISA extends funding to ensure 'no lapse in critical CVE services' for the next 11 months. Potential catastrophe of epic proportions averted....for now.</p><p><a href="https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/" rel="nofollow noopener" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/</span></a></p><p><a href="https://mastodon.sdf.org/tags/cve" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cve</span></a> <a href="https://mastodon.sdf.org/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://mastodon.sdf.org/tags/mitre" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>mitre</span></a> <a href="https://mastodon.sdf.org/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://mastodon.sdf.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.sdf.org/tags/cisa" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cisa</span></a></p>
Manuel 'HonkHase' Atug<p><a href="https://chaos.social/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a>-Aus abgewendet, <a href="https://chaos.social/tags/Schwachstellendatenbank" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Schwachstellendatenbank</span></a> der <a href="https://chaos.social/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EU</span></a> geht an den Start</p><p>"Entscheidung in letzter Minute - offenbar geht der Vertrag zwischen <a href="https://chaos.social/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CISA</span></a> und <a href="https://chaos.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> in die Verlängerung. Mehrere Initiativen präsentieren derweil Alternativen. </p><p>Die US-Cybersicherheitsbehörde CISA hat den Vertrag mit der MITRE Corporation, Betreiberin der CVE-Datenbank, offenbar in allerletzter Sekunde verlängert..."<br><a href="https://www.heise.de/news/Nach-drohendem-CVE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">heise.de/news/Nach-drohendem-C</span><span class="invisible">VE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html</span></a></p>
Nick Espinosa<p>Why The CVE Database Is Beyond Important To Cybersecurity and the World. Note: check out the video for a presentation on this one!</p><p>Edit: Funding has been extended for a while but this is still a critical issue. It's clear that no single source should be funding this critical project.</p><p><a href="https://mastodon.social/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>News</span></a> <a href="https://mastodon.social/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechNews</span></a> <a href="https://mastodon.social/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MITRE</span></a> <a href="https://mastodon.social/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CVE</span></a> <a href="https://mastodon.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://mastodon.social/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Vulnerability</span></a> <a href="https://mastodon.social/tags/USA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>USA</span></a></p><p><a href="https://youtu.be/-psdhAJINXc" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/-psdhAJINXc</span><span class="invisible"></span></a></p>
VegansExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload