November 30, 2022

#secops is undoubtedly challenging, but our analysis of detection policies/rules vs the usefulness of alerts suggests many organizations are making it even harder on themselves. Full study: https://www.securonix.com/resources/quantifying-siem-effectiveness/

Recently, I was developing RCE exploits for Xiongmai NVR/IPC. I was focused on 7 vulnerabilities published between 2017 and 2022 (a couple of which had no CVE). Based on my research, I put together a write-up explaining why Xiongmai devices are interesting, shared thoughts on exploit dev, and shared some caught-in-the-wild exploitation.