Welcome to our weekly security detection and report update. Our Incident Detection Engineering (IDE) Team is constantly hard at work. Creating, testing, and writing detections for you! This week, we've made several important updates to improve your security posture and enhance the functionality of our detections. As you might know, monthly, we also release an overview of the entirety of what was changed in the product. However in these updates we'll focus on the net new content that IDE provides on an ongoing basis, musings from our team, and maybe the occasional horoscope if you're lucky.
Introduction and Overview
Yet another example of the awesome Blumira community we have. We get detection requests from many of our customers, and love it when we can turn them into something that benefits everyone!
New Detections
This update introduces:
Network Tunneling Tool: Chisel
Chisel is a free and open source network tunneling tool that can be used to establish tunnels for various protocols over HTTP.
Tunneling tools may be used by administrators for legitimate business uses like enabling remote access. These tools can also be used to bypass network security controls, obscure malicious activities, or exfiltrate sensitive data if used by threat actors who have gained unauthorized access to a system or network.
Below is an example of what Chisel commands typically look like:
chisel client 172.16.2.30:9312 socks .\chisel.exe client --fingerprint btbVntqWX6JOOx+Qe97DSZrVYmwNIvYfBfzoFGrIdmw= 172.16.2.30:9312 R:socks C:\Users\Public\conhost.exe client 192.168.0.10:443 R:192.168.0.10:43657:socks
To learn more about the network tunneling tool Chisel, see the following resources:
- Status: Enabled
- Log type requirement: Windows, Blumira Agent for Windows, Blumira Agent for Linux, Blumira Agent for Mac
Amanda Berlin
Amanda Berlin is Lead Incident Detection Engineer at Blumira, bringing nearly two decades of experience to her position. At Blumira she leads a team of incident detection engineers who are responsible for creating new detections based on threat intelligence and research for the Blumira platform. An accomplished...
More from the blog
View All PostsSecurity Detection Update – 2024-10-3
Read MoreNow Available: SIEM Cloud Connector Status Notifications
Read MoreSecurity Detection Update - 2024-9-19
Read MoreSubscribe to email updates
Stay up-to-date on what's happening at this blog and get additional content about the benefits of subscribing.