incident response

  1. AA20-183A: Defending Against Malicious Cyber Activity Originating from Tor

    Original release date: July 1, 2020 Summary This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) and Pre-ATT&CK framework. See the ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques. This advisory—written by the...
    • News
    • Thread
    • anonymity apt cisa command and control cybersecurity data exfiltration data manipulation denial of service exploitation fbi incident response indicators of compromise malicious activity network monitoring network security reconnaissance risk mitigation security tools threat actors tor
    • Replies: 0
    • Forum: Security Alerts

  2. AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

    Original release date: April 16, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques and mitigations. This Alert provides an update...
    • News
    • Thread
    • active directory credential theft cve-2019-11510 cyber threat cybersecurity data exfiltration detection exploitation incident response indicators of compromise lateral movement malware mitigation network security patching pulse secure remote access threat actor vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  3. AA20-073A: Enterprise VPN Security

    Original release date: March 13, 2020 Summary As organizations prepare for possible impacts of Coronavirus Disease 2019 (COVID-19), many may consider alternate workplace options for their employees. Remote work options—or telework—require an enterprise virtual private network (VPN) solution to...
    • News
    • Thread
    • access authentication cisa connections cybersecurity incident response infrastructure it security malware mfa mitigation nist patching phishing remote work security telework updates vpn vulnerabilities
    • Replies: 0
    • Forum: Security Alerts

  4. VIDEO AA20-049A: Ransomware Impacting Pipeline Operations

    Original release date: February 18, 2020 Summary Note: This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) framework. See the MITRE ATT&CK for Enterprise and Link Removed frameworks for all referenced threat actor techniques and mitigations. CISA...
    • News
    • Thread
    • cisa control systems cybersecurity data backup data integrity emergency response hmi incident response infrastructure it network loss of productivity mitigation network segmentation operational technology ot network phishing pipeline security ransomware spearphishing threat actor
    • Replies: 0
    • Forum: Security Alerts

  5. AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability

    Original release date: January 10, 2020 Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix a remote code execution (RCE) vulnerability, known as CVE-2019-11510, can become...
    • News
    • Thread
    • cisa cve-2019-11510 cyber attacks cybersecurity exploitation incident response malware mitigation network security patch management pulse secure rce remote access security advisory software update threat actors unauthorized access unpatched servers vpn vulnerability
    • Replies: 0
    • Forum: Security Alerts

  6. AA20-006A: Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad

    Original release date: January 6, 2020 Summary The Cybersecurity and Infrastructure Security Agency (CISA) is sharing the following information with the cybersecurity community as a primer for assisting in the protection of our Nation’s critical infrastructure in light of the current tensions...
    • News
    • Thread
    • apt techniques cisa cisa recommendations critical infrastructure cyber defense cyber threats cybersecurity data theft ddos attacks incident response iranian cyber irgc malware mitigation strategies network monitoring phishing security best practices threat intelligence user training vulnerability management
    • Replies: 0
    • Forum: Security Alerts

  7. Scalable infrastructure for investigations and incident response

    Traditional computer forensics and cyber investigations are as relevant in the cloud as they are in on-premise environments, but the methods in which to access and perform such investigations differ. This post will describe some of the challenges of bringing on-premises forensics techniques to...
    • News
    • Thread
    • challenges cloud computing cybersecurity data security digital evidence forensics incident response infrastructure investigations solutions
    • Replies: 0
    • Forum: Security Alerts

  8. AA18-284A: Publicly Available Tools Seen in Cyber Incidents Worldwide

    Original release date: October 11, 2018 Summary This report is a collaborative research effort by the cyber security authorities of five nations: Australia, Canada, New Zealand, the United Kingdom, and the United States.Link Removed[2][3][4]Link Removed In it we highlight the use of five...
    • News
    • Thread
    • china chopper command and control credential stealer cybersecurity exfiltration exploitation tools huc packet transmitter incident response jbifrost lateral movement malware mimikatz network defense network security powershell remote access trojan security practices threat detection vulnerabilities webshell
    • Replies: 0
    • Forum: Security Alerts

  9. TA18-275A: HIDDEN COBRA – FASTCash Campaign

    Original release date: October 2, 2018 | Last revised: December 21, 2018 Systems Affected Retail Payment Systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS), the Department of the Treasury (Treasury), and the...
    • News
    • Thread
    • atm fraud banking sector compromise indicators cyber attack cybersecurity dhs fastcash fbi financial transactions hidden cobra incident response iso 8583 malware mitigation techniques network exploitation payment systems security recommendations spear-phishing threat intelligence unauthorized access
    • Replies: 0
    • Forum: Security Alerts

  10. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers

    Original release date: October 3, 2018 Systems Affected Network Systems Overview The National Cybersecurity and Communications Integration Center (NCCIC) is aware of ongoing APT actor activity attempting to infiltrate the networks of global managed service providers (MSPs). Since May 2016...
    • News
    • Thread
    • apt authentication cloud security credential theft cybersecurity data protection incident reporting incident response logging managed service providers mitigation network architecture network security operational controls powershell risk management supply chain system integrity technical alert threat detection
    • Replies: 0
    • Forum: Security Alerts
  11. L

    Windows 10 Help with finding backdoor

    Ok, so i have been hacked. Even with rsa key, this person still gets in into my ssh server. I watched bitvise popup and say "accepting connection from china on ip 111.x.x.x" So somehow they are getting in and i do not know how. As of now, the server is turned off. here is a pic. So how do i...
    • LT72884
    • Thread
    • backdoor bitvise china connection cybersecurity data protection hacking incident response ip address malware network remote access rsa key security server ssh system security trojan troubleshooting vulnerability
    • Replies: 10
    • Forum: Windows Networking

  12. Microsoft’s Cyber Defense Operations Center shares best practices

    Today, a single breach, physical or virtual, can cause millions of dollars of damage to an organization and potentially billions in financial losses to the global economy. Each week seems to bring a new disclosure of a cybersecurity breach somewhere in the world. As we look at the current state...
    • News
    • Thread
    • behavioral analytics best practices cloud security cyber defense cybersecurity data analysis data protection endpoint protection forensics incident response malware defense microsoft multifactor authentication risk management security monitoring security operations security strategies threat detection user awareness vulnerability management
    • Replies: 0
    • Forum: Security Alerts

  13. AA18-337A: SamSam Ransomware

    Original release date: December 03, 2018 Summary The Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) are issuing this activity alert to inform computer network defenders about SamSam...
    • News
    • Thread
    • access control backup strategy brute force cybersecurity data protection dhs exploit kits fbi incident response malware network security ransomware rdp remote desktop samsam suspicious activity system updates tor two-factor authentication vulnerabilities
    • Replies: 1
    • Forum: Security Alerts

  14. TA18-276B: Advanced Persistent Threat Activity Exploiting Managed Service Providers

    Original release date: October 03, 2018 Systems Affected Network Systems Overview The National Cybersecurity and Communications Integration Center (NCCIC) is aware of ongoing APT actor activity attempting to infiltrate the networks of global managed service providers (MSPs). Since May 2016...
    • News
    • Thread
    • apt attack vectors cloud computing credential theft cybersecurity data protection incident reporting incident response malicious activity managed service providers mitigation techniques nccic network security operational controls security controls system administration technical alert threat actors threat intelligence vulnerability management
    • Replies: 0
    • Forum: Security Alerts

  15. TA18-275A: HIDDEN COBRA – FASTCash Campaign

    Original release date: October 02, 2018 Systems Affected Retail Payment Systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS), the Department of the Treasury (Treasury), and the Federal Bureau of Investigation...
    • News
    • Thread
    • atm banking infrastructure cyber threat cybersecurity dhs fastcash fbi financial fraud hidden cobra incident response iso 8583 malicious activity malware network defense payment systems risk mitigation spyware technical alert treasury vulnerability
    • Replies: 0
    • Forum: Security Alerts

  16. TA18-074A: Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors

    Original release date: March 15, 2018 Systems Affected Domain Controllers File Servers Email Servers Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert...
    • News
    • Thread
    • critical infrastructure cyber kill chain cybersecurity dhs email security energy sector fbi incident response indicators of compromise industrial control systems intrusion detection malicious activity malware network security remote access russian government spear phishing technical alert threat actors watering hole attack
    • Replies: 0
    • Forum: Security Alerts

  17. TA17-318B: HIDDEN COBRA – North Korean Trojan: Volgmer

    Original release date: November 14, 2017 Systems Affected Network systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS...
    • News
    • Thread
    • backdoor trojan botnet cybersecurity dhs fbi hidden cobra incident response indicators of compromise ip addresses malicious activity malware malware analysis mitigation network defense network security north korea spear phishing trojan user-agent volgmer
    • Replies: 0
    • Forum: Security Alerts

  18. TA17-318A: HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL

    Original release date: November 14, 2017 Systems Affected Network systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS...
    • News
    • Thread
    • command and control cybersecurity dhs fallchill fbi hidden cobra incident response indicators of compromise ip addresses malware malware analysis malware detection mitigation techniques network defense network security north korea remote administration tool system information threat report tls communications
    • Replies: 0
    • Forum: Security Alerts

  19. TA17-293A: Advanced Persistent Threat Activity Targeting Energy and Other Critical...

    Original release date: October 20, 2017 Systems Affected Domain Controllers File Servers Email Servers Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert...
    • News
    • Thread
    • apt control systems credential harvesting cyber espionage cybersecurity dhs energy sector fbi ics incident response indicators of compromise malicious activity malware network security scada spear phishing staging targets technical alert threat detection watering hole attack
    • Replies: 0
    • Forum: Security Alerts

  20. TA17-164A: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure

    Original release date: June 13, 2017 | Last revised: July 07, 2017 Systems Affected Networked Systems Overview This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert...
    • News
    • Thread
    • application vulnerabilities botnet cyber attacks cybersecurity ddos deltacharlie dhs fbi hidden cobra incident response indicators of compromise ip addresses lazarus group malware mitigation network security north korea security advisory software patch threat intelligence
    • Replies: 0
    • Forum: Security Alerts