Topic
MITRE ATT&CK
Avito Develops Cyberdetective Browser Game to Train Employees on Real-World Attacks Using MITRE ATT&CK Techniques
Fraud & Social Engineering
Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam
Other
Avanpost SmartPAM Adds 60 MITRE ATT&CK Signatures for Privileged Session Threat Detection
OtherAvito and BI.ZONE Launch Cyberdetective CTF for Non-Technical Employees Focused on Phishing and Social Engineering
Avito's Security Awareness team, in partnership with BI.ZONE, created the Cyberdetective jeopardy-style CTF competition specifically for non-technical staff who do not write code. The three-day event targeted 104 registered participants, with 44 completing tasks and 16 achieving maximum scores across scenarios involving phishing, OAuth consent abuse, file metadata analysis, and prompt injection. Tasks awarded flags not only for investigation but also for refusing risky actions such as granting excessive application permissions or clicking suspicious links. The design incorporated MITRE ATT&CK techniques including T1566.002 Spearphishing Link, T1528 Steal Application Access Token, and T1204.004 Malicious Copy and Paste. Organizers emphasized indirect hints to help participants recognize when an object required action, avoiding the common barrier where employees fail to understand that a strange string or domain needs examination. Feedback highlighted the value of hands-on decision-making over passive lectures, though some technical employees completed the set rapidly.
Detecting Lateral Movement with Neural Networks Trained Solely on Synthetic Data
A researcher generated entire corporate network histories using a 135-line configuration file to create synthetic authentication logs containing lateral movement attacks. Neural networks trained exclusively on these artificial datasets were then evaluated against 1.65 billion real authentication events from Los Alamos National Laboratory, including 749 red team events across 301 compromised machines. The best ensemble of six models flagged 3.6 million hourly machine windows and placed 16 genuine attacks among the top 23 highest-scoring entries, producing only seven false positives. In comparison, a simple threshold counter required 161,000 false alarms to reach the same detection level. The approach also demonstrated an iterative feedback loop where detector errors directly informed refinements to the synthetic world generator. The work shows that synthetic data can reach AUC performance comparable to models trained on real labeled attacks while providing full control over the underlying attack definitions.
Security Vision SIEM Tackles Alert Overload with Data Quality Monitoring and MITRE ATT&CK Coverage
The article examines persistent SIEM challenges illustrated by the 2013 Target breach, where FireEye detected the compromise but response processes failed. It cites recent statistics showing organizations receive nearly 3,000 daily alerts with 46 percent false positives and 63 percent left uninvestigated. Security Vision SIEM, built on the Low-Code Security Vision 5 platform, integrates event collection, normalization, correlation, asset context, and basic response. Key July 2026 updates add collection stability monitoring, SLA dashboards, statistical anomaly detection, Sigma rule exchange, and retrospective process chain reconstruction. The product offers more than 1,200 correlation rules covering over 70 percent of MITRE ATT&CK techniques along with FSTEC BDU mappings and expert response recommendations. It supports remote and agent-based collection across 150 integrations while providing visual No-Code tools for connectors, rules, and dashboards.
MEPhI Opens 2026 Admissions for Online Cybersecurity Master's Program with Yandex Practicum
The National Research Nuclear University MEPhI, in partnership with Yandex Practicum, is accepting applications for its online master's program in Cybersecurity for the 2026 intake. The two-year program leads to a state diploma in Information Security under code 10.04.01 and a professional retraining certificate from Yandex Practicum. Students can choose from four specialized tracks covering AppSec, DevSecOps, network security, and AI security. Admission is fully online and includes document submission via Gosuslugi, an entrance exam, and a motivation letter requiring at least 80 points. The program runs entirely remotely with evening and weekend classes, allowing students to combine studies with work while accessing student benefits and an educational loan at a subsidized 3% rate.
LangGraph Architecture Combines Hybrid RAG with YARA and Sigma Engines for Streaming Log Analysis
A new architectural pattern integrates LangGraph with a hybrid RAG system and deterministic signature engines to process large volumes of unstructured cybersecurity logs efficiently. The pipeline uses Vector for chunking logs into 250-line segments with 20-line overlap, Kafka for streaming, and an 8-node asynchronous DAG that runs AI and rule-based branches in parallel. Agent 1 groups events and generates hypotheses, while a hybrid RAG module performs query reformulation, vector plus BM25 search with 0.6/0.4 weighting, and LLM re-ranking against a translated MITRE ATT&CK knowledge base stored in ChromaDB. Parallel YARA and Sigma engines scan parsed logs using custom text-based rule implementations, with automatic YARA rule generation triggered when coverage gaps are detected. Final aggregation occurs in Agent 3, which validates findings, deduplicates confirmed incidents, and routes unconfirmed events for manual review while storing reports in PostgreSQL. Tested on a 43-minute synthetic dataset containing 38 MITRE techniques, the system achieved 85.7% precision and 78.9% recall at 3.5 lines per second using Gemini 2.5 Flash.