#blueteam — Public Fediverse posts

SafeLine : un WAF prêt à protéger vos applis web des bots malveillants https://www.it-connect.fr/safeline-waf-prise-en-main/ #Cybersécurité #BlueTeam

We have updated https://www.valtersit.com/methodology/ with the actual information #CVE #Dokploy #infosec #SysAdmin #cybersecurity #Linux #infosec #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta

📋 Server Security Checklist — Essential Hardening Guide 🛡️

Securing servers is critical to protect sensitive data, applications, and networks. Here’s a quick checklist every sysadmin and security engineer should follow to reduce risk and strengthen resilience. ⚡🔐

1️⃣ System & OS Hardening
🔹 Keep OS and packages updated (apply patches regularly).
🔹 Remove or disable unused services & software.
🔹 Configure secure boot and BIOS/UEFI passwords.

2️⃣ Access Control
🔹 Enforce strong passwords + MFA for all accounts.
🔹 Use role-based access (least privilege).
🔹 Disable root/administrator login over SSH/RDP.

3️⃣ Network Security
🔹 Restrict inbound/outbound traffic with firewalls.
🔹 Segment critical servers from general networks.
🔹 Disable unused ports & protocols.

4️⃣ Secure Remote Access
🔹 Use SSH with key-based auth (disable password logins).
🔹 Enforce VPNs for admin access.
🔹 Monitor and log remote sessions.

5️⃣ Logging & Monitoring
🔹 Enable centralized logging (syslog/SIEM).
🔹 Monitor failed login attempts & unusual activity.
🔹 Configure alerts for critical events.

6️⃣ Data Protection
🔹 Encrypt sensitive data at rest & in transit (TLS, disk encryption).
🔹 Regularly back up data to secure, offline storage.
🔹 Apply strict database access policies.

7️⃣ Application & Patch Management
🔹 Keep middleware, frameworks, and apps patched.
🔹 Remove default credentials and sample configs.
🔹 Use secure coding practices.

8️⃣ Malware & Intrusion Defense
🔹 Deploy antivirus/EDR for endpoints.
🔹 Enable IDS/IPS at the network edge.
🔹 Scan regularly for vulnerabilities.

9️⃣ Physical & Cloud Security
🔹 Restrict physical access to server rooms.
🔹 Harden cloud instances with provider tools (security groups, IAM).
🔹 Regularly review cloud audit logs.

🔟 Policy & Compliance
🔹 Apply CIS/NIST benchmarks.
🔹 Document access, configs, and changes.
🔹 Train admins in security best practices.

#ServerSecurity #CyberSecurity #InfoSec #BlueTeam #SysAdmin #ITSecurity #SecurityChecklist #DefensiveSecurity

A HUGE thank you to Mental Health Hacker's first PLATINUM sponsor, @blumirasec

This will enable us to bring even MORE to the @blueteamvillage
this year! Our partnership with BTV will enable us to help bring resources, content, and giveaways at @defcon this year! See ya'll soon!!

A Security Tool Your IT Team Can Actually Use

Blumira simplifies cybersecurity by combining ease of use with powerful protection. We enable teams big and small to defend effectively.

#defcon #defcon33 #blueteam #defensivesecurity #siem #mentalhealth

Happy Monday everyone!

The Cisco Talos Intelligence Group shares their findings of APT #SneakyChef using the #SugarGh0st malware that targets a scope of contries in the EMEA region who use documents that appear to belong to government agencies. The researchers state that this campaign is on a wider scale than the previously witnessed back in November of 2023 but with all the same calling cards (link to older article is the second bullet of the summary, its a good read as well).

Looking at the older report, we get an idea of what these documents did and how the group gained access to their victims machines and some technical details:

Notable MITRE ATT&CK Tactics, Techniques, and sub-techniques:
TA0001 - Initial Access
T1566.001 - Phishing: Spearphishing Attachment - A RAR document containing an LNK file was delivered to the victims. In the recent campaign, an SFX script executes to drop a decoy document, DLL loader, encrypted SugarGh0st, and a malicious VB script.

TA0003 - Persistence
T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows) - The malicious VB script gained persistence by writing a command to the registry key "UserInitMprLogonScript" which will run whatever script is defined in the value when a user that belongs to either a local workgroup or domain logs into the system. The command in this instances was "regsvr32.exe /s %temp%\update.dll (the DLL came from the malicious SFX script).

TA0004/TA0005 - Privilige Escalation or Defense Evasion
T1055 - Process Injection - After the user logs into a machine, the command that targets the DLL dropped in the attack executes. This command reads the encrypted SugarGh0st RAT "authz.lib", decrypts it and injects it into a process.

These are just some of the TTPs seen in the new attack but I would highly recommend checking out the older article to get some more technical information about past behaviors associated with SneakyChef and the SugarGh0st RAT. Enjoy and Happy Hunting!

Article Source:
SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques
https://blog.talosintelligence.com/sneakychef-sugarghost-rat/

November 2023 Article:
https://blog.talosintelligence.com/new-sugargh0st-rat/

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #Intel471