Intrepid Techie retweeted
Have you tested RMMs in your environment? Do you only allow and try to prevent/detect all the others? That is the C2 of choice in 2023. Here is yet another example and excellent report from @TheDFIRReport thedfirreport.com/2023/10/30…
Intrepid Techie retweeted
So funny to see marketing people generate leads with “ransomware protection guides” which are basically the harding guides we used 20y ago except that everything is mapped to ATT&CK nowadays
Intrepid Techie retweeted
Major Dick Winters, renowned for his leadership, commanded a remarkable unit in World War II. During the D-Day operation, Winters and his comrades from Easy Company overcame a much larger German force, facilitating the Allied advance. They also liberated numerous Holocaust survivors who had endured unimaginable suffering at the Dachau concentration camp. As the war in Europe neared its end, they seized Hitler's personal mountaintop retreat in southern Germany and celebrated their victory on his terrace, indulging in champagne from his wine cellar. Despite his reluctance to be hailed a hero, Winters eventually shared his remarkable story, which later became immortalized in the acclaimed series "Band of Brothers."
Intrepid Techie retweeted
side tweet: seeing several infosec is a cost center threads.
Infosec and IT are revenue protection!
Show the % revenue comes from various systems. You're keeping those systems online and making money. You are NOT a cost center and never were.
Find leaders who see it that way!
Intrepid Techie retweeted
Lol - 4 open source projects and 1 commercial C2 framework
I case you don’t remember: it’s better when it’s open source because everyone can write detections for it and it’ll be less of a threat … oh wait
The 2023 @redcanary Threat Detection Report is here! redcanary.com/threat-detecti… I'm very proud of our team for producing this report. Check it out, I hope you'll find actionable takeaways for your team!
Intrepid Techie retweeted
ShareFinder: How Threat Actors Discover File Shares
Detection Opportunities:
➡️ Network
➡️ PowerShell Logs
➡️ LDAP Logs
➡️ Object Access Logs
thedfirreport.com/2023/01/23…
Intrepid Techie retweeted
built a quick app that uses gpt-3 to convert from English to RegEx so you don't have to waste time on stackoverflow: autoregex.xyz
Intrepid Techie retweeted
@RobertMLee joins me on the Unsolicited Response Show, bit.ly/3hQhwX6 He gives insightful & candid comments on the Biden Administrations efforts in ICSsec, we discuss our differences (in a nice way) on when an asset owner should be looking at detection products, & more.
Intrepid Techie retweeted
Hey @SANSICS, you're well represented here, spreading the word about your ICS Concepts video series, training, and ICS Security History... github.com/ITI/ICS-Security-…
Intrepid Techie retweeted
Our ✨BRAND NEW✨ #ICS landing page has all of our free resources in one, beautiful place!
Check it out here: sans.org/u/1bOi
Intrepid Techie retweeted
PAY WHAT YOU WANT! John Strand @strandjs is teaching a paid ($0 - $395) @WWHackinFest 4-day, 4-Hour sessions (16-hours), training course on — Getting Started in Security with BHIS and MITRE ATT&CK
Nov 16-19
Learn more: wildwesthackinfest.com/onlin…
Intrepid Techie retweeted
Twitter Compromise; SIGRed PoC; Apple Updates; SAP PoC; @sans_edu : Aaron Elyard
i5c.us/p7084
Intrepid Techie retweeted
Actual footage of my code review by research sponsor:
(open image for sequence)
Intrepid Techie retweeted
New paper in the SANS Reading Room!
This paper from @SANS_EDU grad student Aaron Elyard explores a tool he created to bridge the gap between the browser-based GUI and raw PowerShell, meant to improve analysis efficiency. Read now: sans.org/u/150m
Intrepid Techie retweeted
How the business thinks the disaster recovery process is going to go
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Intrepid Techie retweeted
New blog (and tool): Attacking Azure, Azure AD, and Introducing PowerZure
posts.specterops.io/attackin…
Intrepid Techie retweeted
Citrix Netscaler AMIs on @awscloud default vulnerable out of the box. The root password is set to the instance ID; that can be read from the metadata URL. CVE-2019-19781 from nobody to ssh as root in seconds.
