This article evaluates various Transformer engineering methodologies applied to machine data — malware behavioral logs from the Speakeasy emulator. Speculatively, the same conclusions about the Transformer engineering methods drawn in this article can be expanded to any set of system logs, for instance, operating system telemetry like Sysmon on Windows…

This article is a how-to guide with code samples for security professionals and data scientists who wish to apply machine learning techniques for cyber-security needs. — Introduction Applicability of Machine Learning (ML) algorithms — in the industry, tutorials, and courses — is heavily biased towards building the ML models themselves. From our point of view, however, the data preprocessing step (i.e., …

Abstract Control of compromised machines within the target network happens through specifically designed Command & Control (C&C, C2) infrastructure. This article describes the rationale behind C2 design decisions and provides a step-by-step setup of the C2 redirector. The report may be valuable for defensive analysts as insight in operations of adversary…

Abstract This article describes utilizing Windows Sysmon Events for behavioral security analytics. The decision heuristic is based on the Recurrent Neural Network (RNN), which considers event sequence. This work aims to provide a reader with a necessary epistemic background on techniques from Data Science or Information Security domains and to show…

Introduction Recently, we performed analysis on high volume of Windows Event Logs in XML format. Provided file was truncated, i.e. with incorrect XML structure. Standard Python xml library does not provide any options in order to deal with such a tagging problem. …

Disclaimer An important value that moves cyber security boundaries forward is the magnificent work done by researchers worldwide. Luckily for everyone in this industry, often this work is shared freely and publicly. One of the research directions, offensive tradecraft, provides possibilities for security engineers and analysts to improve their defensive posture…