Whether you're on the Defensive or Offensive side of security, it's important to understand how common attack tools look in an environment. As someone defending a network, the use of proper logging can help prevent visibility gaps. You could have the best perimeter detections that are available, but without visibility…
The Recon team is excited to announce the launch of SOC X, the Professional SOC Team World Championship! The inaugural event will be on March 4, 2021.…
The Recon team is thrilled to announce our newest offering, NDR Live Online! NDR Live Online gives organizations the opportunity to develop individual analysts and teams with remotely-delivered, live-fire, scenario-based, experiential training throughout the year.…
Our team are huge fans of Velociraptor. It's an incredibly powerful tool, for both DFIR and endpoint management. It currently supports Windows, Linux, and Mac endpoints, and BONUS: it's open source! We use it extensively, and we have also embedded it into our NDR Training! If you are unfamiliar: Source:…
Create a MITRE ATT&CK Navigator Map of an Adversary Emulation Plan…
We've been big fans of the Thinkst platform for a while now. We may have mentioned them a time or two :) Like many others, we get a lot of mileage out of their Canaries and Canary Tokens. We also love TheHive, as you probably already know. As we've long touted,…
Recently, our team was asked to provide training for an operational military Cyber Protection Team (CPT). The members of this team are working remotely but still need a way to provide cutting-edge training to keep their operators sharp and mission-ready.…
A quick guide on visualizing geographical information about IP addresses using Python…
Recon's CTO, Eric Capuano, and Lead Architect, Whitney Champion, were guests on the popular Detections podcast. Listen in to learn more about Recon, our Cybersecurity Partnership offering, OpenSOC Blue Team CTF, as well as our Network Defense Range training. Be sure to subscribe to this fantastic podcast to be better…
The Recon incident response team recently worked an intrusion case involving a ManageEngine Desktop Central server that was affected by CVE-2020-10189.…