GitBook: [#1183] No subject

Author: s0cm0nkey

blue-defense/active-defense.md

@@ -35,7 +35,7 @@ Honeypots are a core part of Active Defense. Beyond thier incredible value for l
 
 **Honey-Assets** - Files, Objects, Accounts, or other resources that would normally not be touches by any legitimate user or process, that are set to perform a specific action when accessed.
 
-* [Canary Tokens](http://canarytokens.org) - Canary Tokens are outstanding objects that can beacon back when activated. For example, you could create a Word document that calls back. Or, in this example, a little snippet of HTML code that calls back whenever it is activated
+* [Canary Tokens](http://canarytokens.org/) - Canary Tokens are outstanding objects that can beacon back when activated. For example, you could create a Word document that calls back. Or, in this example, a little snippet of HTML code that calls back whenever it is activated
   * [https://adhdproject.github.io/#!Tools/Attribution/CanaryTokens.md](https://adhdproject.github.io/#!Tools/Attribution/CanaryTokens.md)
   * [https://www.youtube.com/watch?v=mDnaEmpO1C4](https://www.youtube.com/watch?v=mDnaEmpO1C4)
 * [dcept](https://github.com/secureworks/dcept) - A tool for deploying and detecting use of Active Directory honeytokens
@@ -48,7 +48,7 @@ Honeypots are a core part of Active Defense. Beyond thier incredible value for l
 
 **Resources**
 
-* [https://www.honeynet.org/](https://www.honeynet.org)
+* [https://www.honeynet.org/](https://www.honeynet.org/)
 * _Using Canary Honeypots for Detection - Applied Network Security Monitoring, pg.317_
 
 {% embed url="https://youtu.be/14YuyMkfB9Q" %}
@@ -59,6 +59,7 @@ Ever wonder who is attacking you? Not what IP they are proxying through, but who
 
 * [Cowrie](https://github.com/cowrie/cowrie) - Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.
   * [https://adhdproject.github.io/#!Tools/Annoyance/Cowrie.md](https://adhdproject.github.io/#!Tools/Annoyance/Cowrie.md)
+  * [Guide to using Cowrie](https://slashparity.com/?p=734)
 * [Decloak](https://bitbucket.org/ethanr/decloak) - Used to identify the real IP address of a web user, regardless of proxy settings, using a combination of client-side technologies and custom services.
   * [https://adhdproject.github.io/#!Tools/Attribution/Decloak.md](https://adhdproject.github.io/#!Tools/Attribution/Decloak.md)
 * [HoneyBadger](https://github.com/adhdproject/honeybadger) - Used to identify the physical location of a web user with a combination of geolocation techniques using a browser's share location feature, the visible WiFi networks, and the IP address.

blue-defense/terminology-and-mapping.md

@@ -1,24 +1,25 @@
 # Standards, Frameworks, and Benchmarks
 
-### [MITRE ATT\&CK™](https://attack.mitre.org) 
+### [MITRE ATT\&CK™](https://attack.mitre.org/) 
 
 With over a dozen tactics and hundreds of techniques, MITRE Attack has become the defacto standard for event mapping. It can be used defensively to help you map both the attacks coming in against your network, as well as map your current coverage of visibility, to see where your organization can grow.
 
 * [Awesome List Collection: Mitre Attack](https://github.com/Shiva108/CTF-notes/tree/master/awesome-mitre-attack)
 * [Mitre Groups](https://attack.mitre.org/groups/) - Repository documenting known techniques performed by threat actor groups.
 * [Attack Navigator](https://mitre-attack.github.io/attack-navigator/) - A web-based tool for annotating and exploring ATT\&CK matrices. It can be used to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more.
-* [C.A.R. Cyber Analytics Repository ](https://car.mitre.org)- A knowledge base of analytics developed by [MITRE](https://www.mitre.org) based on the [MITRE ATT\&CK](https://attack.mitre.org) adversary model.
+* [C.A.R. Cyber Analytics Repository ](https://car.mitre.org/)- A knowledge base of analytics developed by [MITRE](https://www.mitre.org) based on the [MITRE ATT\&CK](https://attack.mitre.org/) adversary model.
 * [Caldera](https://github.com/mitre/caldera) - Scalable Automated Adversary Emulation Platform built around the Mitre techniques.
 * [Cascade](https://github.com/mitre/cascade-server) - A research project at MITRE which seeks to automate much of the investigative work a “blue-team” team would perform to determine the scope and maliciousness of suspicious behavior on a network using host data.
 * [Mitre Shield Framework ](https://shield.mitre.org/matrix/)- Mitre Shield is a new framework that maps defensive tools and techniques to the topic of Active Defense. This includes things like decoy accounts, canary tokens, and other forms of cyber deception.
-* [Mitre D3fend](https://d3fend.mitre.org) - Thanks to some support from the NSA, Mitre has created a cyber countermeasure based framework that helps defenders map defensive techniques to coverage of offensive techniques.
-* [Mitre Engage](https://engage.mitre.org/#) - MITRE Engage is a framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.
-* [ATT\&CK® EVALUATIONS](https://attackevals.mitre-engenuity.org)  - Evaluations of security tools based on MITRE technique coverage
-* [atomic-threat-coverage](https://github.com/atc-project/atomic-threat-coverage) - Atomic Threat Coverage is tool which allows you to automatically generate actionable analytics, designed to combat threats (based on the [MITRE ATT\&CK](https://attack.mitre.org) adversary model) from Detection, Response, Mitigation and Simulation perspectives
+* [Mitre D3fend](https://d3fend.mitre.org/) - Thanks to some support from the NSA, Mitre has created a cyber countermeasure based framework that helps defenders map defensive techniques to coverage of offensive techniques.
+* [Mitre Engage](https://engage.mitre.org) - MITRE Engage is a framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.
+* [ATT\&CK® EVALUATIONS](https://attackevals.mitre-engenuity.org/)  - Evaluations of security tools based on MITRE technique coverage
+* [atomic-threat-coverage](https://github.com/atc-project/atomic-threat-coverage) - Atomic Threat Coverage is tool which allows you to automatically generate actionable analytics, designed to combat threats (based on the [MITRE ATT\&CK](https://attack.mitre.org/) adversary model) from Detection, Response, Mitigation and Simulation perspectives
 * [https://github.com/OTRF/OSSEM-DM](https://github.com/OTRF/OSSEM-DM) - Collection of Mitre mappings connected to EventIDs and Mitre Data Sources.
 * [https://github.com/center-for-threat-informed-defense/attack-flow](https://github.com/center-for-threat-informed-defense/attack-flow) - ATT\&CK Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT\&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
   * [https://ctid.mitre-engenuity.org/our-work/attack-flow](https://ctid.mitre-engenuity.org/our-work/attack-flow)
   * [https://github.com/vz-risk/flow](https://github.com/vz-risk/flow) - Tools related to work with Attack Flow
+* [https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/](https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/)
 * [https://www.jaiminton.com/mitreatt\&ck](https://www.jaiminton.com/mitreatt\&ck)
 * [https://tryhackme.com/room/mitre](https://tryhackme.com/room/mitre)
 
@@ -54,7 +55,7 @@ Common and reasonably popular format that has some lacking in a granular classif
 * [ISO 22301](https://www.iso.org/en/contents/data/standard/07/51/75106.html) is the international standard that provides a best-practice framework for implementing an optimised BCMS (business continuity management system).
 * [ISO27001](https://www.iso.org/isoiec-27001-information-security.html) is the international standard that describes the requirements for an ISMS (information security management system). The framework is designed to help organizations manage their security practices in one place, consistently and cost-effectively.
 * [ISO 27701](https://www.iso.org/en/contents/data/standard/07/16/71670.html) specifies the requirements for a PIMS (privacy information management system) based on the requirements of ISO 27001. It is extended by a set of privacy-specific requirements, control objectives and controls. Companies that have implemented ISO 27001 will be able to use ISO 27701 to extend their security efforts to cover privacy management.
-* [EU GDPR (General Data Protection Regulation)](https://gdpr.eu) is a privacy and data protection law that supersedes existing national data protection laws across the EU, bringing uniformity by introducing just one main data protection law for companies/organizations to comply with.
+* [EU GDPR (General Data Protection Regulation)](https://gdpr.eu/) is a privacy and data protection law that supersedes existing national data protection laws across the EU, bringing uniformity by introducing just one main data protection law for companies/organizations to comply with.
 * [CCPA (California Consumer Privacy Act)](https://www.oag.ca.gov/privacy/ccpa) is a data privacy law that took effect on January 1, 2020 in the State of California. It applies to businesses that collect California residents’ personal information, and its privacy requirements are similar to those of the EU’s GDPR (General Data Protection Regulation).
 * [Payment Card Industry (PCI) Data Security Standards (DSS)](https://docs.microsoft.com/en-us/microsoft-365/compliance/offering-pci-dss) is a global information security standard designed to prevent fraud through increased control of credit card data.
 * [SOC 2](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html) is an auditing procedure that ensures your service providers securely manage your data to protect the interests of your comapny/organization and the privacy of their clients.

code-tools/README.md

@@ -7,6 +7,10 @@ The same is for code.
 
 To help with this basic understanding, there have been many platforms, tools, and projects created around making understanding code, easier. As a security analyst, most are not expected to be able to write Javascript or in-depth powershell commands. But should you be able to recognize them and and be able to understand a bit of their function? Absolutely! And there are tools that can make that easier.
 
+## Secure Coding
+
+* [https://github.com/6mile/DevSecOps-Playbook](https://github.com/6mile/DevSecOps-Playbook)
+
 ## Command Shells
 
 ### Bash
@@ -28,18 +32,18 @@ To help with this basic understanding, there have been many platforms, tools, an
 ## CLI Assistance Tools
 
 * [https://www.commandlinefu.com](https://www.commandlinefu.com) - An amazing repository of command strings accomplishing different tasks. Simply search the task and see what commands have worked for others.
-* [https://explainshell.com/](https://explainshell.com) - Write down a command-line to see the help text that matches each argument
+* [https://explainshell.com/](https://explainshell.com/) - Write down a command-line to see the help text that matches each argument
 * [cheat.sh](https://github.com/chubin/cheat.sh) - Command Line cheatsheet tool
 
 ## Code Reference Tools
 
-* [https://stackoverflow.com/](https://stackoverflow.com) - The one and only. More code has been made by snippets stolen from StackOverflow than anything else. If you cant figure out how to code something, stop here first.
-* [The complete table of ASCII characters, codes, symbols and signs](https://theasciicode.com.ar)
-* [Devhints](https://devhints.io) - One of the largest collections of coding cheatsheets and guides available on the internet.
-* [PublicWWW.com](https://publicwww.com) - Search engine for code
+* [https://stackoverflow.com/](https://stackoverflow.com/) - The one and only. More code has been made by snippets stolen from StackOverflow than anything else. If you cant figure out how to code something, stop here first.
+* [The complete table of ASCII characters, codes, symbols and signs](https://theasciicode.com.ar/)
+* [Devhints](https://devhints.io/) - One of the largest collections of coding cheatsheets and guides available on the internet.
+* [PublicWWW.com](https://publicwww.com/) - Search engine for code
 * [Browse code samples | Microsoft Docs](https://docs.microsoft.com/en-us/samples/browse/)
-* [https://ryanstutorials.net/](https://ryanstutorials.net) - A collection of free, introductory tutorials on several technology topics including: Linux command line, Bash scripting, creating and styling webpages with HTML and CSS, counting and converting between different number systems, and writing regular expressions
-* [https://www.markdownguide.org/](https://www.markdownguide.org) - free and open-source reference guide that explains how to use Markdown
+* [https://ryanstutorials.net/](https://ryanstutorials.net/) - A collection of free, introductory tutorials on several technology topics including: Linux command line, Bash scripting, creating and styling webpages with HTML and CSS, counting and converting between different number systems, and writing regular expressions
+* [https://www.markdownguide.org/](https://www.markdownguide.org/) - free and open-source reference guide that explains how to use Markdown
 
 {% content-ref url="learn-to-code.md" %}
 [learn-to-code.md](learn-to-code.md)
@@ -74,22 +78,22 @@ To help with this basic understanding, there have been many platforms, tools, an
   * [https://github.com/mattnotmax/cyberchef-recipes](https://github.com/mattnotmax/cyberchef-recipes)
 * [Hackvertor](https://hackvertor.co.uk/public) - Multi-function Code converter
 * [String Manipulation tool](https://manytools.org/http-html-text/string-manipulation/)
-* [https://encoding.tools](https://encoding.tools)  - Basic HTML decoding and hash conversion tool
+* [https://encoding.tools](https://encoding.tools/)  - Basic HTML decoding and hash conversion tool
 * [DCode toolkit](https://www.dcode.fr/tools-list) - dCode is free and its tools are a valuable help in games, maths, geocaching, puzzles and problems to solve every day!
-* [quipqiup](https://quipqiup.com) - Cryptoquip and Cryptogram solver 
+* [quipqiup](https://quipqiup.com/) - Cryptoquip and Cryptogram solver 
 * [Hex to ASCII | Hex to Text converter](https://www.rapidtables.com/convert/number/hex-to-ascii.html) 
 * [DDecode](http://ddecode.com/hexdecoder/) - Hex,Octal,HTML Decoder 
-* [AES encryption](https://aesencryption.net) [Encode/Decode](https://toolbox.googleapps.com/apps/encode\_decode/)
+* [AES encryption](https://aesencryption.net/) [Encode/Decode](https://toolbox.googleapps.com/apps/encode\_decode/)
 * [de4dot](https://www.kali.org/tools/de4dot/) - de4dot is a .NET deobfuscator and unpacker.
 * [gpp-decrypt](https://www.kali.org/tools/gpp-decrypt/) - Decrypt the given Group Policy Preferences string
 
 ### Javascript Decoders
 
-* [Online JavaScript beautifier](https://beautifier.io) - Beautify, unpack or de-obfuscate JavaScript and HTML, make JSON/JSONP readable, etc.
+* [Online JavaScript beautifier](https://beautifier.io/) - Beautify, unpack or de-obfuscate JavaScript and HTML, make JSON/JSONP readable, etc.
 * [UnPacker](http://matthewfl.com/unPacker.html) - Sort and organize JS into proper looking code. Makes it easier to read
 * [InfoSec Handlers Diary Blog - Advanced obfuscated JavaScript analysis](https://isc.sans.edu/diary/Advanced+obfuscated+JavaScript+analysis/4246) 
 * [Malware at Stake: JavaScript Obfuscation](https://secniche.blogspot.com/2012/04/javascript-obfuscation-manual-armor-1.html)
-* [JS NICE: Statistical renaming, Type inference and Deobfuscation](http://www.jsnice.org) 
+* [JS NICE: Statistical renaming, Type inference and Deobfuscation](http://www.jsnice.org/) 
 
 ### Shellcoding
 
@@ -104,8 +108,8 @@ To help with this basic understanding, there have been many platforms, tools, an
 * [Snyk](https://github.com/snyk/snyk) -  CLI and build-time tool to find & fix known vulnerabilities in open-source dependencies. It is one of the biggest support tools in DevSecOps. It even has its own [convention.](https://snyk.io/snykcon/)
 * [WhiteSource Bolt for GitHub](https://github.com/apps/whitesource-bolt-for-github) - WhiteSource Bolt for GitHub is a FREE app, which continuously scans all your repos, detects vulnerabilities in open source components and provides fixes.
 * [Brakeman](https://github.com/presidentbeef/brakeman) - A static analysis security vulnerability scanner for Ruby on Rails applications 
-* [Cppcheck](http://cppcheck.sourceforge.net) - A tool for static C/C++ code analysis 
-* [FindBugs](http://findbugs.sourceforge.net) - Find Bugs in Java Programs 
+* [Cppcheck](http://cppcheck.sourceforge.net/) - A tool for static C/C++ code analysis 
+* [FindBugs](http://findbugs.sourceforge.net/) - Find Bugs in Java Programs 
 * [Sobelow](https://github.com/nccgroup/sobelow) - Security-focused static analysis for the Phoenix Framework 
 * [bandit ](https://pypi.org/project/bandit/) - Bandit is a tool designed to find common security issues in Python code.
 * [Package Hunter](https://about.gitlab.com/blog/2021/07/23/announcing-package-hunter/) - Scan dependencies for potentially malicious code
@@ -120,11 +124,11 @@ To help with this basic understanding, there have been many platforms, tools, an
 
 ### Automation
 
-* [**NRE Labs**](https://labs.networkreliability.engineering) - learn automation by doing it. Right now, right here, in your browser.
+* [**NRE Labs**](https://labs.networkreliability.engineering/) - learn automation by doing it. Right now, right here, in your browser.
 
 ### **Grok**
 
-* [Grok Debugger](https://grokdebug.herokuapp.com)
+* [Grok Debugger](https://grokdebug.herokuapp.com/)
 
 ### **Hashes** 
 
@@ -133,8 +137,8 @@ To help with this basic understanding, there have been many platforms, tools, an
 
 ### **Hex Editors**
 
-* [HexEd.it ](https://hexed.it)- Browser-based Online and Offline Hex Editing 
-* [Hexinator](https://hexinator.com) - Powerful free hex editor
+* [HexEd.it ](https://hexed.it/)- Browser-based Online and Offline Hex Editing 
+* [Hexinator](https://hexinator.com/) - Powerful free hex editor
 * [Frhed](http://frhed.sourceforge.net/en/) - Free Hex Editor
 * [shed](https://www.kali.org/tools/shed/) - shed (Simple Hex Editor) is an easy application for viewing and editing files in text mode, using ncurses.
 
@@ -160,5 +164,5 @@ To help with this basic understanding, there have been many platforms, tools, an
 ### **Honorable Mention**
 
 * [Ciphey](https://github.com/ciphey/ciphey) - Fully automated decryption/decoding/cracking tool using natural language processing & artificial intelligence, along with some common sense.
-* [Replit](https://replit.com) - Collaborative, in-browser IDE to code in 50+ languages.
+* [Replit](https://replit.com/) - Collaborative, in-browser IDE to code in 50+ languages.
 * [bytecode-viewer](https://www.kali.org/tools/bytecode-viewer/) - an Advanced Lightweight Java Bytecode Viewer, GUI Java Decompiler, GUI Bytecode Editor, and much more.