If you suffer a breach, I am absolutely saying you should review and secure your netinf, not just stick a ZT shaped plaster on top of it.

Especially if you have default creds, ejected MSSP and unauth'd routing protocols in the mix.

#blueteam, #dfir, #networking, #soc

Curious about all the open source and projects developed by @circl ?

CIRCL Open Source tools powering SOC & CSIRT teams.

#opensource #cybersecurity #soc #csirt #threatintel #threatintelligence

https://hdoc.cnw.circl.lu/JJKFoeHrS9Wf28L4tAyCNg?view#

5 Features Every AI-Powered #SOC Platform Needs in 2025
https://securityaffairs.com/180070/security/5-features-every-ai-powered-soc-platform-needs-in-2025.html
#securityaffairs #hacking

Exciting Announcement!

Join us tomorrow at 14:00 CET for the Kunai Workshop Virtual Summer School (VSS) organized by CIRCL!

What You'll Learn:
- The basics of Kunai
- Using Kunai tools (https://github.com/kunai-project/pykunai#)
- Configuring Kunai with MISP IoCs
- Building advanced log filtering and detection rules
- How to use Kunai and Yara

Program and Prerequisites:
Make sure to check out the program and complete the prerequisites before joining: https://github.com/kunai-project/workshops/tree/main/circl-vss-2025#readme

How to Join VSS: https://www.circl.lu/pub/vss-2025/

Don't miss this opportunity to enhance your skills with Kunai! See you there!

How exposure-enriched SOC data can cut cyberattacks in half by 2028 https://www.helpnetsecurity.com/2025/06/30/plextrac-data-exposure-management/ #Expertanalysis #Expertcorner #cyberattacks #Don'tmiss #Hotstuff #PlexTrac #News #data #risk #SOC

Someone should make a circuit board that fits in an original #tamagotchi shell and upgrades the screen and CPU so that it can do a lot of extra stuff; #gps location tracking, #meshtastic node, #pentesting and #radio #hacking like a #flipperZero, etc. Maybe some #arm #soc like a #RaspberryPi, or #Rockchip, or maybe just a little #ESP32. Maybe just cram a #Pebble watch in there or something.

Why the SOC needs its “Moneyball” moment https://www.helpnetsecurity.com/2025/06/25/soc-ai-powered-graphs/ #Artificialintelligence #Expertanalysis #cybersecurity #Expertcorner #Don'tmiss #Hotstuff #Illumio #opinion #News #data #SOC

Dear Cybersecurity Vendors, OEMs, and VARs,

If you're not pronouncing SOCaaS "suckass," you're doing it wrong.

Top Cyber Threats You Shouldn't Miss (June 18)

SuperCard Malware hijacks Androids to relay payment card data.
‍ Stargazers Malware targets Minecraft mod users with info-stealers.
Fake Bank Ads on Instagram scam users with deepfake tactics.

#SOC audits are why doves cry.
#sysadmin

Enterprise SIEMs miss 79% of known MITRE ATT&CK techniques https://www.helpnetsecurity.com/2025/06/09/siem-detection-coverage/ #threatdetection #cybersecurity #CardinalOps #MITREATT&CK #framework #report #survey #MITRE #News #SIEM #SOC

Kunai Sandbox is now live!

Curious about Kunai? Want to analyze Linux malware logs? Or share malware analysis to build detection rules? Kunai Sandbox has you covered!

Check out what Kunai can do:
Explore Kunai's log structure without running it locally
Analyze logs generated by Linux malware
Share malware analysis with others to build detection rules

See an example analysis of the perfctl #linux #malware: https://sandbox.kunai.rocks/analysis/59edbf8c-41b7-4144-97e0-9b0571446c02

The cloud security crisis no one’s talking about https://www.helpnetsecurity.com/2025/06/05/cloud-threats-detection/ #cloudsecurity #cybersecurity #report #survey #News #ARMO #SOC

Investigation Scenario

While reviewing company code in Github, you discover odd javascript that downloads+executes a file from an unknown domain that is currently inaccessible.

What do you look for to investigate whether an incident occurred?

New Blog Post: Kunai vs io_uring (https://why.kunai.rocks/blog/kunai-vs-io_uring)

Ever wondered how io_uring revolutionizes I/O operations in the Linux kernel? Inspired by Armo's blog post (https://www.armosec.io/blog/io_uring-rootkit-bypasses-linux-security/) about a PoC rootkit using io_uring, we explored this feature's security implications and how tools like Kunai can monitor these operations.

Key Takeaways:
io_uring boosts I/O performance by reducing system call overhead and enabling asynchronous operations
Security tools struggle to monitor io_uring due to its unique handling of operations
Kunai now provides visibility into io_uring operations, though blocking malicious activities remains challenging
Recent kernel versions have introduced auditing and security controls for io_uring, but these are still limited

Read more: https://why.kunai.rocks/blog/kunai-vs-io_uring