2 min
Research
What a Difference a Year Makes: Revisiting Our Inaugural Fortune 500 ICER One Year Later
It's now been a year since we released our first Fortune 500 ICER, so we decided to take a quick look at a key control, DMARC, to look for improvements.
4 min
InsightVM
InsightVM vs. Managed Vulnerability Management: How to Choose Which Rapid7 Offering Is Right for You
In this blog, we explain our two vulnerability management offerings—InsightVM and our Managed Vulnerability Management Service—so you can make an informed decision about which is right for you.
13 min
InsightIDR
Import External Threat Intelligence with the InsightIDR Threats API
In this blog, we explain how to automate updating threat feeds in InsightIDR using the REST API.
4 min
Podcast
How BlackICE Creator Rob Graham Became a Security Textbook Author
On this week’s episode of Security Nation, we spoke with Rob Graham, the founder of Errata Security Consultancy, well-known security blogger, and soon-to-be book author.
1 min
Automation and Orchestration
Introducing the Rapid7 InsightConnect App for Splunk
Rapid7 is excited to announce our new integration between InsightConnect and Splunk.
2 min
Metasploit
Metasploit Wrap-Up 10/11/19
Exploiting Windows tools
There are two new Windows modules this week, both brought to you by the
Metasploit team.
The Windows Silent Process Exit Persistence module
, from our own
bwatters-r7 , exploits a Windows tool that
allows for debugging a specified process on exit. With escalated privileges, an
attacker can configure the debug process and then use the module to upload a
payload which will launch e
2 min
Research
Rapid7 Introduces Industry Cyber-Exposure Report: Deutsche Börse Prime Standard 320
Today, Rapid7 released our fifth Industry Cyber-Exposure Report (ICER) examining the overall exposure of the companies listed in the Deutsche Börse Prime Standard index.
5 min
Project Sonar
How to Reduce Exposure in the Cloud
In this blog, we share the top cloud configuration mistakes organizations make and four rules to implement so you can migrate securely to the cloud.
2 min
Patch Tuesday
Patch Tuesday - October 2019
This month's Patch Tuesday
is mainly notable in that there isn't a whole lot to note, which is a change of
pace. No 0-days, no vulnerabilities that had been publicly disclosed already,
and nothing that could allow worms to proliferate. And nothing from Adobe
. Of course, that doesn't mean there's
nothing to do: Microsoft still published 59 CVE
6 min
Vulnerability Disclosure
R7-2019-32: Denial-of-Service Vulnerabilities in Beckhoff TwinCAT PLC Environment
Rapid7 researcher Andreas Galauner has discovered two vulnerabilities affecting the TwinCAT PLC environment.
5 min
MSSP
Why Do Managed Detection and Response (MDR) Services Exist in a World Dominated by MSSPs?
In this blog, we break-down why Managed Detection and Response (MDR) services can survive in a market dominated by MSSP's.
1 min
Metasploit
Metasploit Wrap-Up 10/4/19
Command and Control with DOUBLEPULSAR
We now have a DOUBLEPULSAR exploit module
thanks to some
amazing work by our own wvu , Jacob Robles, and some
significant contributions from the wider community. The module allows you to
check for the DOUBLEPULSAR implant, disable it, or even load your own payloads
as well; it really deserves its own blog post…
2 min
Penetration Testing
This One Time on a Pen Test: “Let Me Get That for You”
In this blog, we discuss how our team successfully gained access to a client's physical building in an unlikely way.
12 min
SAML
SAML All the Things! A Deep Dive into SAML SSO
In this blog, we will take a deep dive into everything you need to know about Security Assertion Markup Language (SAML).
20 min
Research
Open-Source Command and Control of the DOUBLEPULSAR Implant
Metasploit researcher William Vu shares technical analysis behind a recent addition to Framework: a module that executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB and allows users to remotely disable the implant.