Windows IR: системный подход. Часть 3 — задачи, автозапуск, учётные записи, журналы
Это третья часть материала, посвящённого реагированию на инциденты ИБ в Windows. Вторая часть была посвящена изоляции хоста и разбору процессов и сл…
Последние новости
⚑ Сообщить о проблемеTech news from the best sources
Все темы
- игры
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Detection Engineering Starts With the Logs You Decided to Keep
Detection Engineering Starts With the Logs You Decided to Keep Detection content is written against telemetry. If the telemetry does not exist, the…
How to Tune Python Reconnect Jitter for Incident Dashboard Event Delivery
When an incident-response dashboard reconnects, the hard problem is not opening a socket. It is deciding which events to replay, in what order, whil…
Feature Flag Kill Switch Versus Managed Flags: 3 Outage Health Monitoring Checks
The page says customer-support notifications are failing. The on-call sees delivery errors, but a green process check offers little comfort: did the…
Hardening a Self-Managed GitLab Instance After CVE-2026-85706
Hardening a Self-Managed GitLab Instance After CVE-2026-85706 Vulnerability overview CVE-2026-85706 was fixed in GitLab 19.3.2, 19.2.6 and 19.1.8 on…
Калькулятор трудозатрат SOC или как защитить свой FTE
Привет, Хабр! В прошлой статье мы разбирались, почему «Mean Time» метрики в отрыве от контроля качества превращают SOC в дорогой автокликер и как мы…
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline
Artifact Repositories Are Trust Anchors: Incident Response for a Compromised Build Pipeline A software artifact repository is usually described as i…
Windows Incident Response: системный подход. Часть 1
Недавно я писал материал о реагировании на инциденты информационной безопасности в Linux в двух частях ( одна , вторая ). Я попытался написать что-т…
Восстановление EVTX-записей: методы карвинга
Журналы событий Windows в формате EVTX являются одним из ключевых источников телеметрии при реагировании на инциденты. Они содержат свидетельства де…
Detecting and Containing CVE-2026-20344: A Monitoring Plan for Cisco FMC SQL Injection
Detecting and Containing CVE-2026-20344: A Monitoring Plan for Cisco FMC SQL Injection Patching is the fix for CVE-2026-20344, but detection is what…
Rotating Secrets After an AI-Tooling Compromise: A Checklist for the September 2026 KEV Wave
Rotating Secrets After an AI-Tooling Compromise: A Checklist for the September 2026 KEV Wave Three of the seven vulnerabilities CISA added to its Kn…
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650
When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 Opening CVE-2026-75650 is an unauthenti…
Beyond the Outage: Lessons from the GitHub Actions Incident for Your Software Planning Process
In the fast-paced world of modern software development, continuous integration and continuous delivery (CI/CD) pipelines are the backbone of efficie…
Locking Down Remote Support Tools Before They're Abused
RMM tools like ScreenConnect are a top attacker entry point. Here's why, and what to do about it. Remote monitoring and management (RMM) tools like…
When a Vendor You Use Gets Breached: What to Do Next
When a vendor is breached, don't wait for their update page: figure out fast what that vendor can see or touch inside your business, and act on that…
Building your own AI SRE moves the toil; it does not remove it
Now that Chronosphere leaders are telling engineering teams to build their own AI SRE, the honest question is who ends up carrying its pager. Their…
12 Signs Your Website Has Been Hacked
Originally published on the Bug Circuit blog . If your site shows a browser warning, redirects visitors somewhere strange, has admin accounts you di…
Run a Connected Health Record Pipeline Incident Without Guessing at the Data
At 09:14, successful connector jobs drop while queue age rises. At 09:17, dashboard reads remain normal because cached records are still available.…
CISA Wrote Its Incident Plan Mid-Breach. Write Yours Now.
An incident response plan is the thing you least want to be writing at 2 a.m. while an attacker is already inside your systems. Yet that is roughly…
GitHub ships a one-click self-revoke for users whose credentials just leaked
You forwarded the phishing email to the security channel about ninety seconds too late. The laptop is already cooperating with someone else. Your pe…
Responding to a Compromised AWS Access Key
You wake up to this email from AWS: Irregular Activity Detected for Your AWS Access Key As part of our standard monitoring of AWS systems, we observ…
Protecting GitHub from Supply-Chain Malware: Prevention, Cleanup, and Recovery
GitHub is not just a place where code lives. In most engineering organizations, it is part of the software delivery control plane. That means a comp…
Боль реагирования: как процессы информационной безопасности влияют на расследование инцидента
Расследование инцидентов — это критически важный подпроцесс управления инцидентами информационной безопасности, направленный на выявление первичного…
How to investigate suspicious SSH logins without giving AI a shell
A lot of Linux incident response starts with a login question, not a malware sample. Someone sees a spike of failed SSH attempts. A root login appea…
What Happens During an Incident (Part 4)
In Part 3, we separated signals on purpose: metrics tell you where to look logs and traces tell you what happened audit tells you what can be proven…
IRAS: Building a Production-Grade Autonomous Incident Response Agent
IRAS: Building a Production-Grade Autonomous Incident Response Agent Incident response at 3 AM is brutal. Your on-call engineer is woken up, scrambl…