Resources / Journal

Journal of Interdisciplinary Security Studies

Long-form interdisciplinary analysis connecting cybersecurity with intelligence, conflict, human performance and operational readiness.

  2. 02

    12 min read

    Changing the Meaning of Processes and Challenges

    How process-focused feedback, neuroplasticity and a growth mindset reshape our relationship with effort, challenge and cybersecurity readiness.

    Growth MindsetNeuroplasticityResilienceRanger Program
  3. 03

    7 min read

    COM Hijacking for Persistance

    A technical exploration of Windows Component Object Model hijacking, including discovery, persistence techniques, scheduled-task abuse and defensive detection.

    COM Hijackingcyber threat intelligenceintelligenceinterdisciplinary cybersecuritypersistance
  4. 04

    9 min read

    Microsoft ATA Evasion(Over PTH, Golden Ticket)

    During these quarantine times, our team focusses on creating new updated topics for courses, analyses evasion, and threat hunting methods. For doing better threat hunting it is essential to know even better than the attacker.

    cyber threat intelligencegolden ticketintelligenceinterdisciplinary cybersecuritymicrosoftmicrosoft ata evasionover pass the hashremote code execution
  5. 05

    2 min read

    Microsoft SMBv3 Remote Code Execution Vulnerability Overview CVE-2020-0796

    This morning, Microsoft released patches for CVE-2020-0796 SMBv3 RCE Microsoft’s advisory said a crafted SMBv3 packet could be used to achieve remote code execution on a vulnerable SMB Endpoint with a large scope of windows versions:

    cyber threat intelligenceintelligenceinterdisciplinary cybersecuritymicrosoftremote code executionsmbv3 vulnerability
  6. 06

    5 min read

    Intelligence Planning

    The discipline of “Intelligence” is often assumed to be practiced only by governmental agencies. However, in the field of cybersecurity, it is applied more than you think. Common practices in an ordinary SOC environment, such as; alert triaging, incident investigation, penetration testing, and threat intelligence, are all different…

    cyber intelligencecyber threat intelligenceintelligenceinterdisciplinary cybersecurity
  7. 07

    5 min read

    Symantec Endpoint Protection Bypass + Meterpreter Pivoting

    In Red Teaming, it is essential to keep your tactical, mechanical skills, and operational competence updated with researches and drills. For operational competence against endpoint security solutions, we regularly research bypass methods, and separately combine our findings with tactical abilities like hiding and to operate undetected…

    code reviewedr bypassinterdisciplinary cybersecuritymeterpreterpivotingsecure developmentsymantec
  8. 08

    3 min read

    Fireye EDR Bypassed with Basic Process Injection

    During our SOC and Red Team researches, we like to give some time to understand the endpoints and their protection methods. EDR records system activities and events taking place on endpoints and provides security teams with the visibility they need to uncover incidents.

    code reviewedr bypassfireeyeinterdisciplinary cybersecurityprocess injectionsecure development
  9. 09

    1 min read

    Citrix ADC Remote Code Execution, CVE-2019-19781

    Last month, a critical vulnerability in Citrix ADC and Citrix Gateway was published under CVE-2019-19781. The vulnerability caught our attention as it suggested that an unauthenticated adversary could leverage it to compromise the device.

    citrixcitrix gatewaycode reviewidorinterdisciplinary cybersecuritynodejsRCEremote code executionsecure codingsecure developmentweb application security
  10. 10

    4 min read

    Exploit Implicit Coercion Bugs in Node.js Applications

    Implicit-type coercion conditions in dynamically typed programming languages have always led to tricky outcomes. If you have ever programmed in a language like Javascript, you have probably come across some funny cases like one of these;

    code reviewidorinterdisciplinary cybersecuritynodejssecure codingsecure developmentweb application security