SCRT Team Blog – Page 4 – Orange Cyberdefense Switzerland's technical blog

Automatically extracting static antivirus signatures

This blog post accompanies the talk we gave at Insomni’hack 2022. The source code as well as the slides can be found at:

https://github.com/scrt/avdebugger

Splunk Boss Of The SOC (BOTS) @Insomni’hack

It’s was a pleasure this year to meet you at the 2022 edition of our amazing security conference Insomni’hack !

With Splunk collaboration, we come back this year with “Splunk Boss Of The SOC” challenge.

Insomni’hack 2022 – Apiculture 2 write-up

The Apiculture challenges are dedicated to API attacks. The second level basically looks like a webpage dedicated to beehives:

Insomni’hack 2022 – Apiculture 1 write-up

The Apiculture challenges are dedicated to API attacks. It is basically a honey’s addict website:

Insomni’hack 2022 – GDBug write-up

The GDBug file is an ELF binary:

SOCs real-life challenges & solutions

Introduction

As SCRT’s blue teamers, we often deal with Security Operations Centers (SOCs). Being able to interact with many different SOCs for our consultancy service gives us the possibility to understand the main challenges a SOC faces and how to solve them.

TPM sniffing

TL;DR: we reproduced Denis Andzakovic’s proof-of-concept showing that it is possible to read and write data from a BitLocker-protected device (for instance, a stolen laptop) by sniffing the TPM key from the LCP bus.

Internal security recommendations survey

During the first wave of Covid and most people locked up at home, I wanted to engage with my colleagues in various departments here at SCRT by having them answer a simple survey. The survey related to what actions they would recommend and prioritize in order to secure the information system of a random company, which had just received notification that a cyberattack was imminent.

Event Masker – 2021.08 Release

We are proud to announce a new release for Event Masker, with many productivity tweaks and significant enhancements.

Splunk & advanced filtering with Event Masker

What is Splunk ?

Splunk is a Data-to-Everything Platform designed to ingest and analyze all kind of data. They can be visualized and correlated through Splunk searches, alerts, dashboards, and reports. Splunk is the #1 of 2020 Gartner Magic Quadrants in SIEMs for its performant analysis and visionary in Application Performance Management category.