WELCOME

broser extensions detections https://github.com/elastic/protections-artifacts/blob/b427449015fcbd81bbf2f0aa5f4dc800f64ccb96/behavior/rules/macos/persistence_suspicious_browser_preference_file_modification.toml?utm_source=substack&utm_medium=email brwoser crdes stealing https://github.com/elastic/protections-artifacts/blob/b427449015fcbd81bbf2f0aa5f4dc800f64ccb96/behavior/rules/windows/credential_access_failed_access_attempt_to_web_browser_files.toml?utm_source=substack&utm_me

A honeypot is a 'a container in which honey is kept'. Honeypots should be left for honey! Rule #1: Don’t Call cyber deception "Honeypots" The term "honeypot" carries negative connotations that can hinder leadership buy-in and jeopardize your cyber deception project before it even starts. There are two primary concerns: Attracting Unwanted Threats – The misconception that honeypots invite cybercriminal activity, increasing the risk of attackers breaching containment and infil

Microsoft Sentinel Overview SIEM, or Security Information and Event Management, is a security solution that helps organizations identify and respond to potential security threats by collecting, analyzing, and correlating security events and data from various sources. Sentinel is Microsoft SIEM product. Comparable products to Sentinel include: Splunk Elastic CrowdStrike Falcon scale Google SecOps Cortex XSIAM One of the things that is important for SIEMs to be successful is t