SOC Prime Risk Bounty —  January 2023 Outcomes | Script Tech

Risk Bounty Publications

The primary month of 2023 has introduced invaluable contributions from our Risk Bounty members of the worldwide cyber group. The SOC Prime group obtained 626 guidelines for assessment and assessment submitted by our detection content material specialists. Consequently, 144 guidelines efficiently handed verification and have been printed on the SOC Prime Platform for monetization, and these guidelines contributed considerably to collective cyber protection.

Discover detections

It is at all times a good suggestion to take part in discussions with the SOC Prime group on our Discord server and discuss your detection engineering experience and your Risk Bounty program actions.

We strongly encourage Risk Bounty members to observe the Program Phrases and Content material Necessities to take pleasure in probably the most streamlined expertise of releasing your detections for monetization on the SOC Prime platform. As well as, Risk Bounty members can observe the suggestions to enhance detection content material offered by our content material specialists throughout verification and, if relevant, apply the instructed ones to their detections.

The fundamental technical requirement for sigma guidelines instructed for publishing and monetization with Risk Bounty is that your Sigma rule needs to be behavioral risk detection content materialwhich implies it’s essential to determine and detect cyber threats by analyzing conduct patterns (refers to how a system or course of works, together with actions reminiscent of creating recordsdata and processes and their interrelationships, altering registry keys, and setting of community connections, and so forth.), fairly than counting on particular indicators of compromise (IOCs) (IP addresses, file names, malware hashes, and different figuring out data), or meant to be triggered by alerts from different safety options. safety.

One other vital requirement is that it have to be a novel detection, that doesn’t violate the mental property rights of any third social gathering.

MAIN Risk Bounty Detection Guidelines

Suspicious processes and recordsdata to bypass MoTW [Mark-of-the-Web] by BlueNoroff Group (by way of process_creation) rule sigma risk looking by Aytek Aytemur detects a suspicious rundll32 course of, which runs marcoor.dll, a malicious file that’s related to BlueNoroff Group.

Attainable BlueNoroff group execution when getting/executing payload by way of shortcut file (by way of process_creation) rule sigma risk looking by Nattatorn Chuensangarun detect suspicious BlueNoroff group exercise acquiring and executing a further payload of the script when the sufferer double-clicked the shortcut file.

Attainable malicious Zoom software program installer execution exercise by way of instructions related to detection (by way of process_creation) rule sigma risk looking by emre oh detects execution instructions related to the malicious zoom installer. On this malware marketing campaign, the malicious installer ‘ZoomInstallerFull.exe’ executes IcedId Loader, ‘maker.dll’, utilizing rundll32.exe with the ‘init’ parameter.

Attainable exploit try detection ‘CVE-2023-21752’ (by way of File_Event) rule sigma risk looking by Kyaw Pyiyt Htet (Mik0yan) detects creation of malicious recordsdata from tried exploitation of Home windows Backup Service Elevation of Privilege Vulnerability (CVE-2023-21752).

One other Kyaw rule can be within the high 5 Risk Bounty guidelines of the month. Attainable system shell session by way of CVE-2023-21752 Related command detection exploit (by way of CmdLine) Risk Looking Sigma detects the era of the ‘ntauthoritysystem’ shell session by an try to use the Home windows Backup Service elevation of privilege vulnerability – CVE-2023-21752.

most important authors

The Risk Bounty score relies on evaluation of distinctive SOC Prime consumer actions with the Risk Bounty guidelines detection code and doesn’t embrace feedback or content material evaluations. The next authors scored highest for his or her Risk Bounty detections primarily based on evaluation of January 23 exercise:

Nattatorn Chuensangarun

osman demir

Sittikorn Sangrattanapitak

emir erdoğan

kaan yeniyol

The common Risk Bounty payout for November is $1,418.

Code your CV in detection engineering and monetize your Blue Group abilities. ? Be a part of SOC Prime Risk Bounty now!