An overview of a web shell with a hands-on lab was covered in the post Web Shells. An Introduction and Detection Strategies with YARA Hands-On Labs. The following post will expand on this initial lab to provide additional detection strategies using Splunk as a security information and event management (SIEM)…

As a cybersecurity leader, your organization most likely runs a publicly facing web site. …

Visibility into unique organizational machine data is a core capability for cybersecurity teams and provides the foundation to building incident detection capabilities. …

YARA is a powerful analysis tool that can be integrated into organizational cybersecurity processes to improve malware detection and prevention capabilities. YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. [1] Using an adversary model like MITRE ATT&CK, cybersecurity leaders…

Cost Justification. The Tough Questions. As a cybersecurity leader, have you been asked the following questions: Why are we spending this amount on a technology? What value does this provide to the business? Are other business units using this technology? Was it a challenge to answer these questions? If so, building a data source cost…