Detect Hackers & Malware on your Computer (literally for free)

[@_JohnHammond]

wowee zowee speaking of which take a look-see at jh.live/training for more and my newsletter at jh.live/newsletter omegalul

[@sync9827]

Step 1: Download and execute a binary from a random website I've never heard of. xD

[@LennyMiller739]

It wasn't a binary, it was an exe. Silly billy

[@vladimirpain3942]

exe? Now I am all calm and comfortable.

[@LennyMiller739]

@@vladimirpain3942 And to make it even better I'll put it in a little winrar archive. Everybody has a least one memory of opening that little atack of books to decompress the roms and play the games they had as a kid - it's so nostalgic, isn't it. CLICK ME, COME ON - YOU KNOW YOU WANT TO.

[@thisunity]

@@LennyMiller739 exe is a binary file, silly willy

[@max06de]

A word of advice: Be careful who you trust. Even a software promising your security can be a disguised bad actor. (Not saying aurora is one of those!)

[@siren_grnk]

But it very well could be, who knows what they collect and store. Trust no one.

[@ftincel]

exactly what i thought.

[@kipchickensout]

​@@TheStevenWhitingthat's exactly what I also want

[@AbandonedVoid]

​@@TheStevenWhitingCybersecurity used to be a place for computer nerds, now it's filled with Machiavellian sell outs trying to make a quick buck. But if you really care about a project like this being open source, then you should start the project yourself. If it gets enough momentum, I'd probably do bug bounties for it as volunteer work.

[@farmeunit]

@@TheStevenWhitingWazuh… or Security Onion.

[@FIXm8]

best way to not get hacked is to live in the woods without any technology

[@Hid4ri]

What if there is a psycho there with an axe??

[@franklinndubuisi7479]

​@@Hid4riYou GAZA the Psycho

[@hamburgerbuns9752]

@@Hid4ri lol physiclly "hacked"

[@Hid4ri]

​@@franklinndubuisi7479who's that?

[@Hid4ri]

​@@franklinndubuisi7479don't get it sorry dude, I was only making a joke because in the woods you may come across a crazy person who is looking to "hack" with his axe. I'm sorry 😢

[@Rennu_the_linux_guy]

Bruh John's icon sizes getting progressively bigger in every video like the sheriff's hat in scary movie is killing me

[@KieSeyHow]

Probably holding that CTRL key too long when hyperactive scrolling through windows. :D

[@myekuntz]

Hey just want to say thank you for taking the time and going step by step on not just this but how to open a zip file ,us noobs gotta start somewhere, thanks again 😊

[@5ter1ingNothings]

Ah! Thank you for this. This won you a subscription from me because this is a great way for me to dive deeper into cyber security and discover more. I appreciate this. New student of Cybersecurity Technician so this will be of incredible use.

[@SEAhawkstwelfthman]

"Paranoia! Paranoia! Everybody's coming to get me...Just say you never met me..." Nah, just playing. This is an interesting tool. Thanks for the video and educating the community on it man!

[@FuzzerHash]

Thank you, John, for sharing content like this with us.

[@ChrisC-Pi]

Looks interesting but my first thoughts are that the plain text yml based signatures are vulnerable, they should be locked in an encrypted vault, otherwise an attacker can just change the rules before running their attack on a machine and then ta da no alert pops up.

[@dgfokfgxfglhmkfmlgh]

You can prolly make a rule to detect the rules manipulations I guess

[@sagenorris693]

You always find the coolest tools and resources! Awesome stuff, John, as always!

[@youreale]

Every software you install is increasing your attack surface. It would actually be better to show signs of malware infection rather than installing a magical black box to do it.

[@floridapenguin6330]

Great Job I absolutely love it I already have something flagged that antivirus did not flag and I think this is one of the ways to get familiar with how ones system works even from a beginners level of understanding.

[@itsallasimulationman]

"it's not a matter of if, but when." ancient cybersecurity proverb.

[@holetarget4925]

Most of famous software companies are in fact selling user data to aggregators. I know this because I bought these when I worked in a famous consulting co😢😅

[@EliteTech24]

A little bit of click bait and knowledge not simplified for the public viewers who is really trying to find solutions. But great work from the ones who understands.

[@itssoaztek4592]

Great stuff! Thank you! I am very excited about your idea to have more content exploring Aurora EDR. Can't wait 🙂

[@zuberkariye2299]

It's quite confusing to determine the number of EDR/SIEM/SOAR tools available, as there are numerous options such as Splunk, Aurora, Corelight, Zeek, MS Sentinel, Snort, Wireshark, Datadog, Graylog, Security Onion, ELK, LogRhythm, and Google Chronicle. As a beginner, it can be overwhelming to choose the right tool. Can someone please explain the differences between these tools and offer guidance on which one I should focus on?

[@denissetiawan3645]

Focus on your company that already have, or in budget.

[@CYBERSECURITY.101]

Choosing the right security tool can indeed be overwhelming, especially with such a diverse landscape! Understanding the differences between EDR, SIEM, SOAR, and specific tools like the ones you mentioned is crucial for making an informed decision. Let's break it down: Types of Tools: EDR (Endpoint Detection and Response): These tools focus on protecting endpoints (laptops, servers) from malware, exploits, and intrusions. They monitor endpoint activity, detect anomalies, and enable incident response. Examples: Crowdstrike Falcon Insight, McAfee Endpoint Security, SentinelOne. SIEM (Security Information and Event Management): SIEM tools aggregate security data from various sources (firewalls, logs, servers) to provide a unified view of security events. They help with log analysis, threat detection, and compliance. Examples: Splunk, ArcSight, LogRhythm. SOAR (Security Orchestration, Automation and Response): SOAR tools automate repetitive security tasks like incident ticketing, remediation workflows, and playbook execution. They integrate with other security tools to streamline incident response. Examples: Demisto, Palo Alto Cortex XSOAR, Rapid7 Nexpose. Understanding the Differences: EDR is focused on endpoints, while SIEM has a broader scope, covering all security data. SIEM provides visibility, while EDR offers deeper analysis and response capabilities for endpoints. SOAR automates tasks based on SIEM and EDR data, streamlining incident response. Choosing the Right Tool: Consider your needs: What are your main security concerns? Do you need endpoint protection, centralized event management, or automated response? Evaluate your budget: Tools vary in pricing and complexity. Choose one that fits your budget and skillset. Start small: Don't try to implement everything at once. Begin with a core tool (e.g., EDR for endpoint protection) and expand later. Research and compare: Look for independent reviews, test demos, and compare features before making a decision. Specific Tools: Splunk: SIEM platform with advanced analytics and reporting capabilities. Aurora: Open-source SIEM platform known for its flexibility and customization. Corelight: Open-source network traffic analysis tool for intrusion detection. Zeek: Another open-source network traffic analysis tool with strong threat detection capabilities. MS Sentinel: Cloud-based SIEM and SOAR solution from Microsoft. Snort: Open-source network intrusion detection and prevention system. Wireshark: Network traffic analyzer for troubleshooting and security investigations. Datadog: Cloud-based monitoring platform with security features. Graylog: Open-source SIEM platform with a user-friendly interface. Security Onion: Open-source security suite with various security tools. ELK Stack: Open-source stack combining Elasticsearch, Logstash, and Kibana for log analysis and visualization. LogRhythm: SIEM platform with built-in SOAR capabilities. Google Chronicle: Cloud-based SIEM and SOAR solution from Google. For beginners: Start with a free or open-source tool: Many excellent options are available like Corelight, Zeek, Security Onion, ELK Stack. Focus on learning the fundamentals: Understand the concepts of EDR, SIEM, and SOAR before diving into specific tools. Seek help from the community: Join online forums and communities to learn from other security professionals. Remember, the best tool is the one that fits your specific needs and budget. Take your time, research, and don't hesitate to ask for help.

[@MogensHertz]

Both question and answer was brought to you by ChatGPT 😅

[@jollygrimreaper]

@@CYBERSECURITY.101 okay, AI

[@ТоварищКамрадовСоциалистКоммун]

how about asking yourself if you need any of them? they are for sysadmin or for a corporate segment. In that case it might be wise to use what is already purchased, installed and working. Otherwise, and especially for a private/small home network it's recommended to use standard security package included in your windows defender, like HIPS and similar utilities. If you feel it's not enough, consider enhanced protection from Eset, or Kaspersky, or Comodo, or Zonealarm, or similar

[@xCheddarB0b42x]

Interview reply from employer when I inquired about expectations: "No incidents." I almost popped off, "How do you know you aren't in one now?" heh

[@KieSeyHow]

There are two psychology thought experiments to try on prospective employees, one is the Gift Scenario, and the other is the Meadow Scenario. But the bottom line is, threats not perceived or expected result in different behaviour than otherwise. Good perception, leads to mitigating behaviour, before threat vectors resolve. All intelligence assets undergo such training, perhaps IT security personnel should also be taught to think in similar ways. Expect threats, when there are none. Just because none is detected, does not mean it is not there. This also applies to industrial maintenance, inspection, police work, intelligence, public works, and actuarial work.

[@luiytheninja3655]

@@KieSeyHow Idk why you got your information for this comment, but... From day one, I've been taught to be proactive, and look for threats before they occur, which is exactly how to do what you described. Guess, I'm just having trouble, understanding the purpose, of your comment.

[@BlizzetaNet]

So far, Aurora is behaving. Love it!

[@justinpinson8575]

love it as always. would love to see more along this path!

[@aDaily1222]

John I think you're trying to appeal to the "average user" but the average user doesn't have the technical knowledge for this stuff. I didn't realize until scrolling through the comments how many people outside the industry are watching these videos. People in the industry know you're a legend and take you seriously. Alot of your viewers right now dont even know who you are. I'm honestly not sure how they found this video. They probably got a virus and searched "how to know if i got hacked" lol. Anyways, you're great. So is the content. We appreciate it! Keep it up!

[@jjann54321]

IMO I think as John's audience grows, more and more people are joining (watching) for reasons other than the "core" of his channel's message/content. From day one, his content has been on focusing on Red/Blue Team day-to-day with some videos being very technically detailed while others (his most popular, ironically) are John installing TOR and trolling the *Dark Web.* If you look at John's video catalog you can see the spectrum from Skiddie to Malware Analyst/Engineer and everything in between. Rather than people criticizing John's content for it not being "double-clicking on the .exe file and selecting Accept, Next, Next, Finish" they should challenge themselves, step up their game and possibly learn something, gain a little insight and experience.

[@alfonzo7822]

Funnily enough that's roughly how I found John's channel 2 years ago! Now working in IT and doing a degree in Cyber Security, so it worked out ok for me.

[@megsman4749]

My internal sigma rule detects adware.

[@joshmorgantech]

Why do they have to ask for my email??

[@2b2tJourney]

The day I get infected and I am looking for something to remove the malware this video comes out and I find out about it to late this is why y’all need to turn notifications on!!!

[@FlyboyHelosim]

Notifications don't mean a damn thing when you're subscribed to dozens of channels.

[@_noizmusic]

@@lumikarhu Not true actually, Aurora has response actions, although limited in the Lite version.

[@ТоварищКамрадовСоциалистКоммун]

in order to be able to make a meaningful response action, the utility should be host-based

[@2Kayz177]

it’s easy to remove if it’s in temp or application data but… if it’s in your kernel it’s a different chapter

[@TC-hl1ws]

Too complicated for the general public including me but thanks for bringing this to our attention.

[@aDaily1222]

This video isnt for the general public lol

[@jjann54321]

I think John said something about "Blue Team Professionals" or aspiring Blue Team Pros? This must be your first John Hammond video...? Oh, and the CLI isn't scary once you've worked with it for a while, give it a shot.

[@OGMann]

Funny how i lived in the command line for 35 years, and people today are just discovering it. Thank God for gui's, eh? 😂

[@wooshbait36]

@@OGMann wow you are so cool. You want a medal?

[@sCiphre]

@@wooshbait36 we'd be just fine without one if you'd kindly step off the lawn.

[@pedrobarthacking]

Amazing content always John! Thank you!

[@joelanzo]

Huntress Agent similar to Aurora uses a web browser dashboard, why not a local dashboard installed on the computer ?

[@5c4rfAc3]

loved this one!! always great education, and inspirational! keep it up!

[@techfan7808]

A very nice ad for aurora

[@UltiGintiFacts]

When I was dwonloading i had 2 threats by windows saying two trojons

[@DataWalkerSolutions]

I got 3 trojans

[@Wildmikes]

Block all incoming connections at firewall built in setting with some exception rules. Plus VPN and DNS leak tweak at regedit you should be gold.

[@KieSeyHow]

With Windows 10 and above you'd have to start with zero trust, blocking both out and in, so each connection can be verified and researched. My local systems (both Linux and Windows) have run like that for more than 10 years.

[@ТоварищКамрадовСоциалистКоммун]

indeed the most of the job is done by properly configured firewall. the rest of the job is done by properly configured HIPS utility and you might want to get an antivirus just for your convenience , to help you make a right decision secure DNS with or witthout filters to avoid phishing, other stuff like ublock origin are for a better protection and mostly for convenience

[@Felttipfuzzywuzzyflyguy]

Thank you SOC Analysts!

[@8eck]

Very interesting topic, would love to see more series about it. Like & Subscribed!

[@dlcrdz00]

Totally random question but I noticed that Windows flags Aurora-Lite as having a Trojan. Is this normal considering the product?

[@Robert.C-z2x]

Big fan of your videos ! For all the beginners out here ,is the AV detecting a false positive because Aurora is using sigma rules ? Would be great to hear your take on this matter

[@FlyboyHelosim]

Video is all about getting hacked... clicks accept on cookies prompt without an ounce of care.

[@GhostRevenge36]

Ive got a problem. My antivirus won't let me download this because it wants to tamper with Windows defender. And the antivirus sees this as a threat. I just don't want a hacker piggy backing on any downloads. Did anyone else get this?

[@DataWalkerSolutions]

yes. my windows defender said it was a virus

[@sirdewd2197]

Can it be out on routers or other network devices or is it only on end user devices?

[@BenjaminTiessen]

I hate that i have to give my personal information to download it... Not worth it.

[@james_nash]

Noob here. Why do this instead of your av system off the shelf? What’s the benefit?

[@LennWeltmeister]

Video starts at 7:16

[@CitizenFortress]

Wouldn't Wazuh be able to do all this too?

[@hugohernandez6968]

Hi John, thank you for sharing this. I was actually setting up wazuh through another great video you made. Essentially are they the same except wazuh does give you central management?

[@TheCodingHat]

I saw it was you and was bamboozled by the comments. Surprised you arent a bit more popular

[@iWhacko]

anything like this for Mac?

[@rakesharman4203]

My windows defender is considering this as malware 😮

[@gaganshesha2171]

Same brother

[@gaganshesha2171]

Have you found any solution?

[@noctornus99x]

Why does it say “.” Is not recognized in the command prompt

[@tlskillman]

Just tried to download free Aurora. No go. Never got the verification email.

[@martinhoneves]

I got the verification but never the links....

[@imaantagonist6322]

Was this a giant ad? Felt like it.

[@Kumoyuri_0002]

Downloaded the lite version and got detected by windefender as a wacatac trojan

[@gaylewashburn1137]

When I go to "extract" I get a "virus detected" message.

[@joshuameaders8053]

With so many tools & tech, do you think reviewing so many would eventually have a negative impact on the I.T community? Deluding the pool of options so great that paralysis by analysis inevitably sets in. I find myself overwhelmed with tools when coming to your page.

[@phabeondominguez5971]

Maybe IT isn't for you then? Tech is always advancing so it's always changing, ya gotta keep up or else YOU become irrelevant.. feel me?

[@evanottinger1672]

The jump scare when this came on after a softly spoken Tib3rius video

[@ShinobuFX]

I love this! please do more, thank you!

[@garycacoon]

Is this the same as sysdig and falco

[@PurpleTeamer]

Tried to download the license file from the link in the email, but getting a PR_END_OF_FILE_ERROR. could not access my license file.

[@bartomiejb6730]

ufffffff i got that same situation.

[@florian2251]

@@bartomiejb6730 Could you make sure that you're using an up-to-date browser? Which version of Firefox do you use?

[@kimpedersen]

Same - but its working now.

[@PurpleTeamer]

@@kimpedersen Thank for sharing an update. Will retry this evening 👍

[@KCM25NJL]

I can see an opportunity for someone to write a little beautiful soup that skims the LOLbins and generates sigma files on the fly as new attack vectors are published.

[@seansingh4421]

Yes Yes Yes !! Thanks for the idea, If I can manage to it (I’m ChemE not software lol) I’ll even give you cut 😂

[@SimonePGGG]

What is the difference between this and thor can you help me understand please?

[@bleakyfinder2692]

why fix, if it anit broke.

[@saschafahling4698]

Edge won't let me download saying it is a trojan👍

[@CoreyANeal2000]

Could this be done with a complete copy of a device or through data?

[@Muziek37414]

Would love to know more about the sigma rules and how to create custom ones

[@americansoil8260]

Are there any open software for siem

[@johnarnold893]

This is a Windows only thing so what does that tell you?

[@samblack8344]

When I ran the script I never got a warning from aurora what does that mean in?

[@mranonymous9355]

Thanks John. Was this a paid presentation?

[@louey2x]

is it actually Cisco using TCP? and how do we confirm that it is, maybe it's one of the unassigned UDP ports.

[@senshi01]

I received the email. Gone to the link to download it. No download button for me I guess...

[@Helpexplorer]

Can you Show a Linux Solution?

[@uuu12343]

Question, does this work over the network? Or just the local machine?

[@Abbaking-i4b]

Buying softwares norton and more have been brutal

[@willi1978]

is there no log of commands somewhere in windows?

[@Unpluggeddddd]

Best macOS equivalent?

[@overthe1]

Thanks for very useful content. Very interesting for every Cyber Security Specialist.

[@Vicorcivius]

Running windows and talking about detecting malware on your computer. :D

[@dlcrdz00]

Hi John, is there a download or install for Aurora on Linux?

[@thegeminiclub]

Hey! How do hackers make it look like I’m using Facebook and dating apps/sites on my phone if I don’t have any of those ?

[@justanothergrunt9053]

To be fair, if someone preaches this to me I feel like it’s gonna probe my stuff regardless. I’ll look into it 😂.

[@Sloptit]

Specially when its this guy saying that stuff

[@justanothergrunt9053]

@@Sloptit Yeah. It's a product push. TRUST ME I AM- . No one's taking that away from him but come on this is an advertisement video. No you can't have my data.

[@KieSeyHow]

Pretty much the same vibes here, especially when delivered by some guy who feels like he is on uppers or speed. I learned in my work to never fully trust people with that kind of energy.

[@justanothergrunt9053]

@@KieSeyHow Yeah

[@aDaily1222]

its literally John Hammond. Dudes a legend. You must not be in the CyberSecurity field lol. @@KieSeyHow

[@paprikar]

Why is there a titanfall logo on the preview?

[@sikalobamuzyamba5751]

Does aurora detect man in the middle attacks ?

[@emdxemdx]

So, it's basically like Snort, right?

[@nazstreamsini4870]

is there an open source software that do stuff like aurora agent? the free version very lack feature and I could add the feature I need my self but it is not open source

[@vladimirmisata]

To Watch This In Absolute SLO-MO Is Quite Annoying And Frustrating. Like Bro, Great Stuff, But What Could Be Even Greater Is The Speed To Mind Input Ratio. Like, Giving Some Time To Take In And Absorb The Info, Then Proccess The Information By A Couple Of Seconds Than The Causual Milli-seconds!? Would Love To Match And Be On Par, But Their Are Days That Go Against The Forces Of The Universe In Which The Universe Always Wins! A Couple Seconds Invested Would Be A Real Great Benifet As A Win, Win From A Team Perspective Angle. Much Gratitude. Thank You And Appreciated For Your Dedicated Service!

[@richardglabella]

Interesting. Thanks for sharing!

[@aaronag7876]

What if you bought a laptop / Desktop from eBay with windows already installed ? How can I check that they haven't installed a key logger or Malware etc ? I bought a laptop and moved the 1TB M2 Drive onto the 2nd drive and not primary drive. My primary drive is 512gb has a Dual boot Ubuntu / Win11 but I want to use the 1TB M2 drive but don't want to add my personal details till Im sure it's clean. Thanks

[@phabeondominguez5971]

No matter how thoroughly you "clean" it you won't ever be 110% sure,. So it's ALWAYS best to wipe it and clean install an OS on it. PEACE

[@shawnhenderson2968]

Not sure what I'm doing wrong but I can't access aurora in the terminal. So it won't let me run the scripts. Any help is appreciated

[@oculosprudentium8486]

Can I use this for Android phone and tablet ?

[@Dominik-K]

Thanks for the video, this tool is certainly one I'll look into more deeply

[@cesarb1111]

How it works the MUI of Xiaomi un Android? Are they embebed sistems?

[@CoolFire666]

Would be interesting to try, but they don't seem to have any Linux support as far as I can tell :(

[@Thuja814]

:(

[@TopGunUFS007]

why

[@MrDober33]

Hi John, downloaded Aurora run it but damn Kaspersky keeps deleting the files

[@drmalc0m]

I want to see John in 35 years... If he looks like the CEO of Jurassik Park

[@infotruther]

Yiu didn't link it?

[@custume]

on this business our mantra is : "there are NO invulnerable systems, only hard to crack"

[@ianraphael8968]

nice work john...love all the way from Kenya

[@batmob8437]

"Sometimes it misses..." Lols! Deliberately even! 😝

[@nobodynowhere8890]

its an advertising video, isn't there a need to flag a video as "advertising" if its ?

[@tonderaishowmoretaruvings84]

Thanks John