Adversary: Turla - Carbon [ONLY LINUX]
Sequence of actions ┌──(caldera-env)─(attacker㉿kali)-[~/…/caldera/plugins/emu/data] └─$ jq '.[] | select(.adversary == "Turla - Carbon")' commands-output.json { "adversary": "Turla - Carbon", ...
Binnacle of my Research
Extracting all commands for a given adversary
Inspect the plugin emu/data/ folder (caldera-env)─(attacker㉿kali)-[~/…/caldera/plugins/emu/data] └─$ ls abilities adversaries adversary-emulation-plans sources abilities.txt adversarie...
Caldera
Why Caldera? The idea behind installing Caldera in the Kali Linux machine is to create a systematic sequence of attacks covering Caldera-related Links Caldera Github: MITRE ...
Summary && Pending
Summary Due to problems in the server performance due to vm-load: Elasticsearch & Kibana VM was migrated to Server ITM4. Current network for initial testing: After having reconfig...
Problems and Solutions
Problems 1. Excess of virtual elements on Server ITM2. The current network element distribution across the hard-servers is leading to a “Server Resource Overload”. Elasticsearch Server ...
How to track down events [Pending]
Preliminars Some questions How do we label events? or how do we obtain labeled events? How do we associate an system event (either a network packet sent or received, a filesystem occurrence, ...
General Troubleshooting
Current Status Network Architecture Figure 1. Current network architecture. Both servers are connected through network interface eno2. The opnsense router has a new network LAN interface that ac...
SSL Errors on ...
Syptom In the Elastic Agent Endpoint, deployed in the Windows server, we see these error logs at C: > Program Files > Elastic > Endpoint > data > log > endpoint-00000: {"@times...
Verifying Why Fleet Agents Status are "Offline" [Under monitoring]
Syptom After the installation of the fleet agents on all the elements We detected that there is a possible issue with the Elastic-Agent installed in the Windows Server. Theref...
[Paper Review]
“Title ROSPaCe: Intrusion Detection Dataset for a ROS2-Based CyberPhysical System and IoT Networks”: Journal: SCIENTIFIC DATA - NATURE Context: CyberPhysical System and IoT Networks Add...