In this article we demonstrate a detection evasion technique using CLR that may be useful for penetration testing as well as a couple of tips for SOCs to help detect such attacks.

В данной статье мы продемонстрируем технику ухода от обнаружения с использованием очистки памяти CLR, а также приведем практические советы для аналитиков SOC по выявлению таких атак.

A different cup of TI? The added value of commercial threat intelligence

Xander Bouwman, Delft University of Technology, the Netherlands; Harm Griffioen, Hasso Plattner Institute, University of Potsdam, Germany; Jelle Egbers, Delft University of Technology, the Netherlands; Christian Doerr, Hasso Plattner Institute, University of Potsdam, Germany; Bram Klievink, Leiden University, the Netherlands; Michel van Eeten, Delft University of Technology, the Netherlands

Commercial threat intelligence is thought to provide unmatched coverage on attacker behavior, but it is out of reach for many organizations due to its hefty price tag. This paper presents the first empirical assessment of the services of commercial threat intelligence providers. For two leading vendors, we describe what these services consist of and compare their indicators with each other. There is almost no overlap between them, nor with four large open threat intelligence feeds. Even for 22 specific threat actors – which both vendors claim to track…