In this part of our series, we will ensure that the system(s) or Network(s) affected by the attack after the Containment phase are destroyed after making the necessary evidence and investigations. However, the Eradication step should not be a primary and quick decision option. …

In this part of our series, we will examine a security breach incident where the defense layer of our system or systems was somehow breached. Step 3 of IR includes Containment, Eradication, and Recovery. Taking our compromised system or systems into containment in the 3rd step of IR will prevent…

In this part of my Article Series, we will focus on the Analysis phase. We will write detection rules on HIDS, NIDS, and SIEM systems that we have completed the installation. We will also examine the analysis stages using Sysmon and WinEventLog. We will try to touch on all the…

At this stage of my article series; We will focus on the monitoring, event tracking, and detection phases of our corporate inventories, which we determined with gap analysis during the preparation phase. In the first step, we will focus on the Detection part of IR’s Detection and Analysis phase. In…

Hi everyone, in this series of articles, we will cover the design, development, and incident response examples of IR Planning.The content of the article; What is the Preparation Phase? Workflow in Preparation Phase Creation of the Preparation Infrastructure The Design of the Preparation Inventory List IR Examples: IR Phishing Plan …

Endpoint Shield Let’s review Endpoint protection as Exploitation, Installation, C2, and Actions. And let’s try to block the strategies of the attackers, which we learned in our previous article, at every step. From the 4th to the 7th chain, we can think of the processes as slices that form from the base of…

The “Cyber Kill Chain” defined by Lockheed Martin helps us determine the evidence of an attacker’s attack steps by categorizing them in 7 different stages. …

Chapter 1 — Understanding the Enemy’s Footsteps Even successfully organized cybersecurity capabilities cannot protect a business from advanced attacks. However, when you design a strong security line, you will be able to prevent, detect, stop and overcome targeted cyber attacks. I will share the research I have done with you based on the books and articles written…

Serimizin bu bölümünde Containment aşamasına kadar taşıdığımız etkilenen sistem(ler) veya Ağ(lar)’ın gerekli kanıt ve incelemler sağlandıktan sonra etkilenen sistemelerin yok edilmesi işlemidir. Ancak birincil ve hızlı karar alınacak bir seçenek olmamalıdır. Bunun nedenlerini ve operasyon sürecini birlikte inceleyelim. Before Eradication Ilk adımda Containment sürecinin doğru ve ihlalsiz sürdürüldüğünden emin olunmalıdır. Süreç boyu…