Widespread Phishing and Business Email Compromise Campaign
In this blog post we cover a widespread phishing campaign Recon recently observed targeting...
Widespread Phishing and Business Email Compromise Campaign
Recon's Guide to Testing for the Log4J Vulnerability using Canarytokens
This guide will walk you through using CanaryTokens.org to generate a token and how to use that...
Recon's SOAR Playbook To Detect Log4J Exploitation
The recent Log4j vulnerability (CVE-2021-44228) is unprecedented in its global scope and impact....
Scaling Enterprise Forensic Timelining
In July, Eric & Whitney gave a talk titled "Breaches Be Crazy" at the SANS DFIR Summit outlining...
OPENSOC @ DEF CON 29
It’s that time of year again - DEF CON! We were thrilled to run OpenSOC again at DEF CON this year,...
An Encounter with Ransomeware-as-a-Service: MEGAsync Analysis
Recon's SOC recently responded to an attempted ransomware and extortion attack. It had all the...
An Encounter With TA551/Shathak
The Recon incident response team recently responded to a case of business email compromise. The...
Threat Hunting - A Critical Component of High Performing SOCs
Whether your cybersecurity detection and response capabilities are in-house or managed through a...
SOC X 2021 - A Recap
We can't start a recap post without a huge THANK YOU to the community for joining us last week and...
Detecting Threats with Graylog Pipelines - Part 3
Now that we've normalized and enriched our events, let's get into the actual threat detection logic...