FireEye Bookmark

AD security

Sandbox

Malware

• Total Hash (https://totalhash.cymru.com/)
• Malware sample (http://dasmalwerk.eu/)
• https://0x00sec.org/t/indicators-of-packers/12984
• abuse.ch
• http://vxvault.net/ViriList.php

Webshell

• Behinder (冰蝎) anquanke 

• Behinder - prevent detection

Malware Analyais

• Entropy
• Decoding Malicious powershell (Sophos)
• Covert commands to powershell compatible

RSA bookmark

• SecureCare Online (knowledge.rsasecurity.com)
• RSA Entitlement Server(download.rsasecurity.com)
• RVC (EMC vLab)

DLP Resources

• DLP wiki
• Winnow Algorithm
• Learning RSA DLP 
• RSA DLP SE training
• DLP technical training
• Request for RSA DLP license key, go to http://dlplicenses.corp.emc.com/
• DLP CSE exam guide
• DLP Endpoint Enforce Advanced Options
• DLP 8.0 SP2 support matrix
• DLP 8.5
  DLP 8.0 SP2
  DLP 8.0 SP1
  DLP 8.0.0
  DLP 7.2.0 P1
  DLP 7.2.0
  DLP 7.0.2 P2

ECAT Resources

• RSA ECAT (inside emc)
• Google Yara Project

SA Resources

• RSA SA 10.4 local demo 4.1
• ECAT Live

Network Security

• McAfee SiteAdvisor (http://www.siteadvisor.com/sites/)
• SAN IP History (http://isc.sans.org/ipinfo.html)
• User-Agent.me (http://user-agents.me/)
• User-Agent online paser (https://udger.com/resources/online-parser)
• Google SafeBrowse()
• Rapid APT Id Service (http://scan.xecure-lab.com/)
• urlvoid(http://www.urlvoid.com/)
• Cuckoosandbox (https://cuckoosandbox.org/)

Reading

• http://fraudwatchinternational.com/malware/vbe-malware-vs-malware-analysis-sandboxes/
  
• http://blog.prowling.nu/2012/10/modifying-virtualbox-settings-for.html
  
• http://discogscounter.getfreehosting.co.uk/js-noalnum.php
• https://www.wintips.org/how-to-enable-admin-shares-windows-7/
• https://support.microsoft.com/en-hk/help/2696547/how-to-detect-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and
• Detect Golden/Silver Ticket use in AD
• Minikatz overview defense detection (SANS reading)
• Sandbox evasion detection
• Enable/Disable SMBv1/v2/v3
• Malware use certutil
• https://0x00-0x00.github.io/research/2018/10/31/How-to-bypass-UAC-in-newer-Windows-versions.html

Microsoft (EMS)

• www.microsoft.com/en-us/cloud-platform/enterprise-mobility-trial
• www.microsoft.com/en-us/cloud-platform/identity-management
• www.microsoft.com/en-us/evalcenter/evaluate-microsoft-advanced-threat-analytics

Proofpoint

• Supported file type