Cybersecurity Mommy

#hoahoahoaseason #cybersecurity #it More cybersecurity content: https://www.youtube.com/watch?v=Bpt2lRxxJKQ&list=PLLIXzGRFEsvc&index=4 https://www.tiktok.com/@cybersecuritymommy https://www.patreon.com/cw/CybersecurityMommy https://linktr.ee/cybercroatia https://cybercroatia.org/ https://cyber-europe.org/ https://leonoramilisa.com/ https://whydonate.com/fundraising/cybercroatia https://www.udemy.com/course/how-to-land-your-first-cybersecurity-job-as-a-soc-analyst/?couponCode=A73E5735D4D2194A43B

Cybersecurity has its own superstitions. Never say “it’s quiet today.” Never trust a Friday deployment. Never assume zero alerts means zero threats. Always check whether the logs are actually arriving. And remember: nothing is more permanent than a temporary fix. If you work in cybersecurity long enough, you know exactly why these rules exist. More cybersecurity content: https://www.youtube.com/watch?v=Bpt2lRxxJKQ&list=PLLIXzGRFEsvc&index=4 https://www.tiktok.com/@cybersecuritymommy https://www.

T1681 Search Threat Vendor Data shows that threat intelligence does not have only one audience. Defenders use CTI to understand adversaries, but adversaries can also examine threat intelligence reporting to understand what defenders already know about them. Threat reports may expose domains, IP addresses, hashes, infrastructure relationships, malware indicators, TTPs, campaign timelines and attribution. Once an adversary realizes that specific infrastructure or indicators have been identified, t

T1682 Query Public AI Services is a MITRE ATT&CK Enterprise Reconnaissance technique focused on adversaries using publicly accessible AI services to support target research and preparation for later operations. The important distinction is that this is not a generic “AI attack” technique. Public AI services can help synthesize, aggregate and analyze publicly available information at scale. This may help identify organizations, personnel, technologies, business relationships and contact informati

Gather Victim Identity Information shows why identities themselves are part of the attack surface. During MITRE ATT&CK Reconnaissance, adversaries may collect information about employees, email addresses, accounts, credentials, roles and other identity-related data before any direct compromise occurs. The important distinction is that a person, identity, account, credential and privilege are not the same thing. A name can identify a person. A role can suggest potential access. An email address c

Search Open Technical Databases shows how much an adversary can learn about an organization without directly scanning its infrastructure. In MITRE ATT&CK Enterprise, T1596 belongs to the Reconnaissance tactic and focuses on searching publicly accessible technical databases for information about a target. T1596 includes DNS/Passive DNS, WHOIS, Digital Certificates, CDNs and Scan Databases. Together, these sources can reveal domains, subdomains, IP relationships, hosting providers, certificates, h

T1597 Search Closed Sources is a reminder that reconnaissance does not happen only on the open internet. In MITRE ATT&CK Enterprise, T1597 belongs to the Reconnaissance tactic and focuses on information obtained from sources where access may require payment, subscription, membership or other restricted access. T1597 includes Threat Intel Vendors and Purchase Technical Data. The important distinction from T1593 Search Open Websites/Domains is the access model. The information itself may be simila

POV: You work in cybersecurity. The security team is working overtime monitoring alerts, investigating suspicious activity, hunting threats, reviewing logs, correlating events across SIEM and EDR, checking endpoints, analyzing network traffic and trying to reduce the attack surface. Meanwhile, Ryan from marketing is three Google searches deep into “download free RAM” and about to single-handedly create the next incident response exercise. Sometimes the biggest cybersecurity challenge isn’t malwa

T1594 Search Victim-Owned Websites is a reminder that your own public website can become part of an adversary’s reconnaissance process. In MITRE ATT&CK Enterprise, T1594 belongs to the Reconnaissance tactic and focuses on searching websites and web resources controlled by the target organization for information that can support future operations. A corporate website can reveal much more than marketing content. Employee pages may expose identities and roles. Career pages can reveal technologies a

T1593 Search Open Websites/Domains is a reminder that reconnaissance does not always require scanning, exploitation or direct interaction with the target. Sometimes the information an adversary needs is already publicly available. Within the MITRE ATT&CK Enterprise Reconnaissance tactic, T1593 focuses on searching open websites and domains for information that can support future targeting. The technique includes Social Media, Search Engines and Code Repositories. Each can reveal a different part