Ali Hussein
-
Content Count
8 -
Joined
-
Last visited
-
Days Won
1 -
Invited by
james mckinlay
Recent Profile Visitors
679 profile views
-
Nice one. I hope it get setup easily not like Detectionlab
-
Copying my comment from somewhere else page 32 is wrong setting don't do it. according to MS kerberos preauth shouldn't be disabled https://social.technet.microsoft.com/wiki/contents/articles/23559.kerberos-pre-authentication-why-it-should-not-be-disabled.aspx.
-
Please share here any resources you find useful for team red. Books, tools, blogs and anything useful
-
Could anyone suggest a must read books for Blue team members?
-
Please join the BlueTeam/RedTeam clubs I created. it will be fun
-
-
I checked the documentation. I made them public clubs according to here https://invisioncommunity.com/4guides/how-to-use-ips-community-suite/managing-your-community/using-clubs-r306/ you can post and contribute to public clubs without the need to change.
-
-
-
I used the following https://www.incidentresponse.com/playbooks/ as a reference to build my own internal Incident Response playbooks. If anyone has more playbook references please share them here
-
Thanks @james mckinlay. I posted this to CarbonBlack forums and they said they will merge the ones I created to the threat intel feed they push to customers. once done with CBR I will move to map MITRE to sysmon and windows event logs probably by Jan
-
Hey, This is Ali Hussein. I do some SOC/IR/Pentesting.
