Motasem Hamdan
Motasem Hamdan
  • 864
  • 4 022 513
Aurora EDR for Cybersecurity & Incident Response | TryHackMe Aurora EDR
In this video walkthrough, we covered Aurora endpoint and detection response agent tool that is used in detecting and responding to cyber security incidents. Aurora runs on top of Windows OS and detects events based on Sigma rules and adds them to Windows Event Viewer for further analysis. Aurora also supports response methods such as suspending, killing or dumping the process. This video was part of TryHackMe Aurora EDR room.
****
Receive Cyber Security Field, Certifications Notes and Special Training Videos
ua-cam.com/channels/NSdU_1ehXtGclimTVckHmQ.htmljoin
******
Writeup
motasem-notes.net/en/aurora-edr-for-cybersecurity-incident-response-tryhackme-aurora-edr/
TryHackMe Aurora EDR
tryhackme.com/r/room/auroraedr
********
Google Profile
maps.app.goo.gl/eLotQQb7Dm6aiL8z6
LinkedIn
[1]: www.linkedin.com/in/motasem-hamdan-7673289b/
[2]: www.linkedin.com/in/motasem-eldad-ha-bb42481b2/
Instagram
motasem.hamdan.official
Twitter
ManMotasem
Facebook
motasemhamdantty/
Переглядів: 148

Відео

Using SOC & Threat Intelligence in Cybersecurity | TryHackMe Threat Intelligence for SOC
Переглядів 4889 годин тому
In this video walkthrough, we covered the concept of threat intelligence, how it's performed and what are the IOCs collected during threat intelligence and how they are used and standarized to be implemented in SOC to hunt for threats and prevent future cyber attacks. This video is part of TryHackMe Threat Intelligence for SOC which is part of SOC Level 2. Receive Cyber Security Field, Certific...
Craft CMS CVE-2023-41892 Vulnerability Exploitation | POC
Переглядів 23016 годин тому
In this video walkthrough, we covered the CVE-2023-41892 proof of concept that affected Craft CMS manually and with Metasploit framework. CVE-2023-41892 is a security vulnerability discovered in Craft CMS, a popular content management system. Craft CMS versions affected by this vulnerability allow attackers to execute arbitrary code remotely, potentially compromising the security and integrity ...
Investigating a Hacked PhpMyAdmin Database With The Elastic Stack | TryHackMe Slingshot
Переглядів 255День тому
We covered investigating a cyber incident scenario ,where PhpMyAdmin database was hacked along with its e-commerce website, using the elastic stack (logstash, Kibana and elastic search) and KQL queries. We uncovered the scanner the attacker used to fingerprint the database, the directory enumeration tool and the credential brute-force tool used to gain access to the admin panel of the website. ...
Ransomware Detection with Advanced Elastic Search Queries | TryHackMe Advanced ELK
Переглядів 34314 днів тому
In this video walkthrough, we covered using advanced queries in Kibana and Elastic Search such as using nested queries, queries to extract number and date ranges, proximity queries, fuzzy searches and queries including regular expressions to extract insights from cyber security incidents and pertinent to this scenario was Ransomware infection on web and email servers. Receive Cyber Security Fie...
Memory Forensics with Volatility | PDF Malware Analysis with Any.Run | Cyber Incident Response
Переглядів 53114 днів тому
In this video walkthrough, we covered a cyber incident response case study that involved a malicious PDF malware delivered through a phishing email. The PDF malware once opened, spawned a powershell session in a hidden window that execute a base64 encoded command to retrieve another malicious file from a C2 server. We extracted the sample using Volatility plugins then we uploaded the sample to ...
Wazuh SIEM Explained | TryHackMe Creating Custom Wazuh Alerts
Переглядів 87814 днів тому
We covered and explained Wazuh as a SIEM and IDS/IPS solution along with its use case in the cyber security area and its components such as Wazuh indexer, Wazuh server, the dashboard and Wazuh agents. We also compared Splunk and Wazuh in relation to their use as SIEM, data analysis products and main components. We also covered the important components, mainly the decoders and rules, in Wazuh th...
Elastic Stack & Logstash Explained For Data Analytics & Cybersecurity | TryHackMe
Переглядів 29321 день тому
In this video walkthrough, we covered and explained Elastic stack that consists of Logstash, Elastic Search and Kibana. The three components are used for data collection, data processing, analysis and data visualziation. We also covered the installation and configuration of all Elastic Stack components. We configured Logstash to collect logs from the Linux authentication log file, process the c...
Open Source Intelligence Techniques | The Case of Blackhat SEO | TryHackMe WebOSINT
Переглядів 35821 день тому
In this video walkthrough, we covered another case of Open Source Intelligence where we used investigated a domain name using different open source intelligence (OSINT) tools to uncover its history. We also used the wayback machine "archive.org" to look at the past appeareances of the given domain and extract other hints. We found that one of the given domains uses PBNs or private blog networks...
Open Source Intelligence Tools & Techniques Explained With Case Studies
Переглядів 1,1 тис.Місяць тому
In this video walkthrough, we briefly explained and discussed OSINT techniques and tools using practical scenarios that involve extracting public information from Domain names, social media websites (LinkedIn, Reddit,etc) and even location information using Google hangouts and Foursquare. Receive Cyber Security Field, Certifications Notes and Special Training Videos ua-cam.com/channels/NSdU_1eh...
Event Analysis and Logs Parsing with Splunk | TryHackMe Fixit
Переглядів 289Місяць тому
In this video walkthrouugh, we discussed Splunk configuration files namely, props.conf,transforms.conf,fields.conf,inputs.conf, indexes.conf and mentioned the purpose and goal of each one of them. Splunk configuration files are used to configure log parsing rules, fields extraction and set log storage and retention rules. Use these config files when Splunk doesn't extract the fields properly fr...
Collecting and Analyzing Web Server Logs with Splunk | TryHackMe Splunk: Setting up a SOC Lab
Переглядів 412Місяць тому
In this video walkthrough, we explained the process of installing and configuring Splunk by showing the steps that involve choosing the role of Splunk whether it will be main server or a forwader, configuring the forwaders to collect logs and create the indexes that store the collected logs. We demonstrated one practical scenario that involves manually uploading web server logs to a main instan...
Splunk Search Processing Language | TryHackMe Splunk: Exploring SPL
Переглядів 366Місяць тому
In this video walkthrough, we covered an introduction to Splunk Search Processing Language (SPL) and discussed the basic commandsand various types of functions used in comparison, boolean and logical operations. Splunk Search Processing Language is used to execute commands and functions to extract useful insights from the logs ingested into the SIEM. These insights help cyber security analysts ...
Dynamic Malware Analysis of Konni RAT Malware APT37 With Any.Run
Переглядів 441Місяць тому
In this video walkthrough, we analyzed Konni RAT Malware which was developed by advanced persisten group APT37 according to MITRE ATT&CK. We performed dynamic malware analysis using Any.run cloud malware analysis tool. Konni malware masqureades as word document file which when opened downloads a spyware executable designed to exfitlrate and send machine OS and credentials data to the main C2 se...
Introduction to Logging & Logs | TryHackMe Intro to Logs
Переглядів 685Місяць тому
In this video walkthrough, we covered an introduction to logging where we discussed the logic of creating logs and why we create logs. Logs are created and generated to track performance, analyze security incidents and to establish a pattern from which future events can be predicted. Logs can be system logs, application logs, security logs, audit logs, server logs and database logs. The process...
How to Scan and Clean an Infected Wordpress Website With Malware
Переглядів 371Місяць тому
How to Scan and Clean an Infected Wordpress Website With Malware
Analyzing Cybersecurity Incidents with Zeek IDS | TryHackMe Zeek Exercises
Переглядів 617Місяць тому
Analyzing Cybersecurity Incidents with Zeek IDS | TryHackMe Zeek Exercises
Linux Privilege Escalation For Beginners | Nebula Exploit Exercises Walkthrough | Level 13-15-19
Переглядів 461Місяць тому
Linux Privilege Escalation For Beginners | Nebula Exploit Exercises Walkthrough | Level 13-15-19
Linux Privilege Escalation For Beginners | Nebula Exploit Exercises Walkthrough | Level 01-12
Переглядів 694Місяць тому
Linux Privilege Escalation For Beginners | Nebula Exploit Exercises Walkthrough | Level 01-12
BurpSuite Repeater | Sequencer | Encoder/Decoder | TryHackMe BurpSuite
Переглядів 354Місяць тому
BurpSuite Repeater | Sequencer | Encoder/Decoder | TryHackMe BurpSuite
Living Off The Land Binaries & Attack Tools Explained | TryHackMe
Переглядів 6582 місяці тому
Living Off The Land Binaries & Attack Tools Explained | TryHackMe
Firmware Vulnerability Scanning & Security Testing with BugProve
Переглядів 3342 місяці тому
Firmware Vulnerability Scanning & Security Testing with BugProve
Firewall Evasion Techniques | Full Tutorial
Переглядів 9562 місяці тому
Firewall Evasion Techniques | Full Tutorial
Hardware Hacking & Firmware Analysis For Beginners | EP1
Переглядів 8772 місяці тому
Hardware Hacking & Firmware Analysis For Beginners | EP1
Complete Guide to Intrusion Detection/Prevention System | TryHackMe Network Security Solutions
Переглядів 6412 місяці тому
Complete Guide to Intrusion Detection/Prevention System | TryHackMe Network Security Solutions
MITRE ATT&CK Framework APT28 | Cyber Security Case Study | CTF Walkthrough
Переглядів 5643 місяці тому
MITRE ATT&CK Framework APT28 | Cyber Security Case Study | CTF Walkthrough
Clearing Tracks in Windows | TryHackMe Evading Logging & Monitoring
Переглядів 4933 місяці тому
Clearing Tracks in Windows | TryHackMe Evading Logging & Monitoring
Bypassing Anti-Malware Scanning Interface (AMSI) Explained | TryHackMe Runtime Detection Evasion
Переглядів 4433 місяці тому
Bypassing Anti-Malware Scanning Interface (AMSI) Explained | TryHackMe Runtime Detection Evasion
Practical Malware Phishing Email Analysis | TryHackMe Greenholt Phish
Переглядів 6553 місяці тому
Practical Malware Phishing Email Analysis | TryHackMe Greenholt Phish
Practical Phishing Email Analysis | PhishTool & Any.Run | TryHackMe
Переглядів 9153 місяці тому
Practical Phishing Email Analysis | PhishTool & Any.Run | TryHackMe

КОМЕНТАРІ

  • @christoland1813
    @christoland1813 13 годин тому

    Hi, I am new to this. How did you know the yara rule was thor-webshells? Was it simply because it was the only rule that was for webshells and the yara rule mathced the file with webshell metaslsoft?

    • @christoland1813
      @christoland1813 9 годин тому

      nevermind, it was in the hints. thanks this was a very helpful video

  • @Voiceee-ix8zn
    @Voiceee-ix8zn 16 годин тому

    Nice Work!

  • @eliaslopezvillalpando6795
    @eliaslopezvillalpando6795 День тому

    Very helpful, thanks amigo 🔥❤

  • @simonetimjr4938
    @simonetimjr4938 День тому

    Please can you share me your study notes. Thanks in advance

    • @MotasemHamdan
      @MotasemHamdan День тому

      Hello, you can subscribe to the channel membership tier 2 to get access to all the notes, link below ua-cam.com/channels/NSdU_1ehXtGclimTVckHmQ.htmljoin Or if you are interested in one subject among the others, you can pay for one time. The notes that are available for one time purchase can be found below buymeacoffee.com/notescatalog/extras

  • @Maccanarchy
    @Maccanarchy День тому

    The typos are good, shows us you make mistakes too

  • @gemuhhans2262
    @gemuhhans2262 День тому

    how can one view the contents of flag1 with burn suite. I guess many of us can't use burp suite. A tutorial will be great. thanks

  • @Marwan_Alkhatib
    @Marwan_Alkhatib День тому

    How to get ur note that ur use in ??

    • @MotasemHamdan
      @MotasemHamdan День тому

      Hello, you can subscribe to the channel membership tier 2 to get access to all the notes, link below ua-cam.com/channels/NSdU_1ehXtGclimTVckHmQ.htmljoin Or if you are interested in one subject among the others, you can pay for one time. The notes that are available for one time purchase can be found below buymeacoffee.com/notescatalog/extras

  • @ashlove8554
    @ashlove8554 День тому

    Good walkthrough but you should put timestamps in video

  • @Maccanarchy
    @Maccanarchy 2 дні тому

    I'm literally commenting on all your videos just to help you get more reach, your work is amazing mate. Thanks again

  • @a_bp
    @a_bp 3 дні тому

    good video

  • @memepasmal77
    @memepasmal77 3 дні тому

    Thank you for the great job.

  • @tiavee
    @tiavee 4 дні тому

    not helpful since I don't know where you get the second IP address from. I don't have tun0 like you do in kali

  • @addisonhall2098
    @addisonhall2098 4 дні тому

    This channel has become a staple for learning cybersecurity!

  • @JNET_Reloaded
    @JNET_Reloaded 4 дні тому

    cant save to playlist

  • @khalilrehman6998
    @khalilrehman6998 4 дні тому

    Great sir kindly make one video for use cases i mena how to create use cases

  • @Maccanarchy
    @Maccanarchy 4 дні тому

    Your videos are fantastic, and your explanations are extremely clear, keep up the good work and thanks again.

  • @caseyconklin-ko4rw
    @caseyconklin-ko4rw 5 днів тому

    when running the nmap scan for port 1443 & 1338, wouldn't it be more efficient to do -p 1443,1338?

  • @duongduy1914
    @duongduy1914 5 днів тому

    When I entered the website, I was asked to log in to my account and I didn't know where I was signing up??

  • @johnvardy9559
    @johnvardy9559 5 днів тому

    what a lesson.Wow

  • @ZEFO199
    @ZEFO199 5 днів тому

    network miner pro? pcap need professional

  • @GOODBOY-vt1cf
    @GOODBOY-vt1cf 6 днів тому

    4:00

  • @Macj707
    @Macj707 6 днів тому

    I am not doing Craft CMS I am a tryhackme student.. but thsi is great... love the PoCs thanks for the updates and the content.. Chef Crisp Wuz Here. This is a quality channel.

  • @frankdaniel49
    @frankdaniel49 6 днів тому

    You saved me. Thank you

  • @Macj707
    @Macj707 6 днів тому

    CHEF CRISP WUZ HERE!

  • @Macj707
    @Macj707 6 днів тому

    CHEF CRISP WUZ HERE!... I had the same problem parsing the shortcuts looking for the regripper I dont know what the problem is

  • @whitby1208
    @whitby1208 6 днів тому

    At 20:00 can someone explain me why he changed the get request to get when it was get already.

  • @Maccanarchy
    @Maccanarchy 6 днів тому

    Absolute legend

  • @Macj707
    @Macj707 7 днів тому

    CHEF CRISP WUZ HERE!

  • @Macj707
    @Macj707 7 днів тому

    Yeah I could not find the file either... but had the md5 to get the sha256 but I didnt get that part

  • @Macj707
    @Macj707 7 днів тому

    CHEF CRISP WUZ HERE!

  • @Macj707
    @Macj707 7 днів тому

    CHEF CRISP WUZ HERE!

  • @z3t4r44
    @z3t4r44 7 днів тому

    I was stuck in lvl 4 after finding 'analytics' as the table name...

  • @Voiceee-ix8zn
    @Voiceee-ix8zn 7 днів тому

    Great Video covering the POC, please make a video covering SQLmap 😊

  • @rajvithalani
    @rajvithalani 7 днів тому

    Last question's answer showing wrong for me

  • @ashabusuffah1033
    @ashabusuffah1033 7 днів тому

    How to hacking android

  • @wolfrevokcats7890
    @wolfrevokcats7890 8 днів тому

    0:07 doesn't make sense? Why?

  • @alechernandez5506
    @alechernandez5506 8 днів тому

    This room is really not for beginners, is it? This requires me to understand how to navigate through linux proficiently. I have passed the linux rooms but this is all still new to me. I want to understand logs for my CySA+ exam but this is making me question linux more than logs themselves...

  • @Hinksmn
    @Hinksmn 9 днів тому

    at 7:30 what did you press to close the GNU Nano idk how to close it

  • @Voiceee-ix8zn
    @Voiceee-ix8zn 9 днів тому

    Hello Sir, sir I would really like to see, some uncut challenges 😊😊

  • @ME-ov7vp
    @ME-ov7vp 9 днів тому

    great video, i answered this questions before watching your video i only got stuck on one, your video helped me

  • @arianajaimesc1285
    @arianajaimesc1285 10 днів тому

    Thank you so much

  • @daguru4089
    @daguru4089 10 днів тому

    Can you set cookies from the developer tools instead of using burp suite?

  • @mohamedmohamed-yt3bi
    @mohamedmohamed-yt3bi 10 днів тому

    for question 1 in task 4, i used this query to look up the Galaxy A30, frame matches GALAXY, then i got 3 hits, the 3rd one that is of the IP 172.16.13.49 is the one meant to be for Galaxy A30, if you look up the host name field, you find you will find it in there.

  • @user-ii5gy3cl3v
    @user-ii5gy3cl3v 10 днів тому

    I am very happy when I saw this channel that is fantastic in the cybersecurity field

  • @y4s3rj4m4l-ik8mz
    @y4s3rj4m4l-ik8mz 10 днів тому

    perfect Bro thanks

  • @joeb9026
    @joeb9026 11 днів тому

    Montasem you are an excellent teacher. I actually learn how to use the cyber security tools when I watch your videos. THM can ask some confusing questions sometimes and you help clear them up for me. THANK YOU

  • @Macj707
    @Macj707 11 днів тому

    Learning with you again today... CHEF CRISP WUZ HERE

  • @mailoisback
    @mailoisback 11 днів тому

    What is this site that you used for practice?

  • @zerot2Dev
    @zerot2Dev 11 днів тому

    file .bat có thể bỏ qua uac được không ? tôi đang gặp rắc rối với cài đặt python 1 cách tự động