Interview
Sigma Rules and Threat Bounty: Building Detection Content with Mehmet Kadir Cirik
A Threat Bounty contributor explains how Sigma rules map to APT TTPs and what makes detection content publishable.
▚Threat Bounty Program
Aung Kyaw Min Naing
Threat Bounty Programme: How a Detection Engineer Joined and What He Writes
A working detection engineer's path into SOC Prime's Threat Bounty programme, with practical lessons for SOC teams.
APT
Lacefly APT Deploys Stealthy Merdoor Backdoor in Asia
Security teams should monitor for Merdoor backdoor activity as Lacefly APT targets critical sectors across South and Southeast Asia.
Detection Content
APT37 ROKRAT Switches to LNK Files: Detection Rules for Defenders
North Korea-linked APT37 has shifted ROKRAT malware delivery to LNK files. Here are Sigma detections and what defenders should hunt…
Conti
FIN7 and Ex-Conti Collaboration Delivers Domino Backdoor Malware
Russian-linked threat actors FIN7 and Conti affiliates deploy Domino backdoor in joint malware campaign.
DeathNote
Lazarus DeathNote Campaign Widens Its Net to Defense, Academia, and Auto Sectors
Lazarus Group shifts from crypto targets to defense contractors and universities in expanded DeathNote campaign. What security teams need to…
Detection Content
GuLoader Malware Targets US Financial Sector in Tax Season Attacks
Security teams should monitor GuLoader campaigns targeting financial firms with tax-themed phishing and obfuscated PowerShell delivery.
Aung Kyaw Min Naing
Threat Bounty Hits 542 Submissions, 119 Rules Cleared
SOC Prime's February 2023 Threat Bounty review took in 542 detection rules and approved 119, with QakBot, ProxyShell, and Royal…
Bootkit
BlackLotus UEFI Bootkit: What Security Teams Need to Know
BlackLotus exploits CVE-2022-21894 to bypass Secure Boot. Here's what it means for your security posture and how to detect it.
cyberattack
PlugX Trojan Masquerades as Windows Debugger to Bypass Detection
Security teams need updated detection rules for PlugX using debugger disguises
cyberattack
Mirai Variant V3G4 Keeps Hammering IoT Devices
Mirai botnet variant V3G4 has been exploiting IoT flaws for six months. Here is what defenders need to know and…
Aytek Aytemur
January Threat Bounty: 144 Sigma Rules Published from Community Effort
SOC Prime's Threat Bounty program validated 144 Sigma rules in January 2023, covering BlueNoroff activity and CVE-2023-21752 exploitation.