ITSEC Newsletter 2024-12-26

Author

Henrik Falk
December 26, 2024

The Windows Registry Adventure #5: The regf file format

The intent of this post is not to repeat the information compiled in the existing resources, but rather to highlight specific parts of the format that have major relevance to security, or provide some extra context where I found it missing. A deep understanding of the low-level regf format will prove invaluable in grasping many of the higher-level concepts in the registry, as well as the technical details of software bugs discussed in future blog posts.

googleprojectzero.blogspot.com/2024/12/the-windows-registry-adventure-5-regf.html

Checking It Twice: Profiling Benign Internet Scanners - 2024 Edition

Today, we’ll examine these services' scanning patterns, protocols, and behaviors when they encounter new internet-facing assets. Understanding these patterns helps security teams better differentiate between routine internet background noise and potentially malicious reconnaissance activity.

www.greynoise.io/blog/checking-it-twice-profiling-benign-internet-scanners----2024-edition

A Primer on JA4+: Empowering Threat Analysts with Better Traffic Analysis

JA4+ is the collective name for a broad suite of network fingerprinting methods, which are designed to facilitate threat hunting, network characterization, and advanced traffic analysis. These techniques help security teams identify patterns and behaviors in encrypted and unencrypted traffic, enabling the detection of malicious activity or unusual behavior based on specific attributes.

www.team-cymru.com/post/a-primer-on-ja4-empowering-threat-analysts-with-better-traffic-analysis