@joshlemon

Chief DIFR at @SoteriaSec_io | @SANSInstitute Principal Instructor | Digital Forensics & Incident Response geek

 Australia
joshlemon.com.au
Joined September 2009
  • Tweets2.7K
  • Following1.1K
  • Followers2.2K
232Media
Memory Analysis for #Linux has always been a bit hit-or-miss. @trailofbits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel. #MemoryForensics #IncidentResponse #DFIR #DigitalForensics
2
8
22
2,637
It also uses SQL-based queries to perform analysis, similar to #OSquery. blog.trailofbits.com/2026/02…

mquire: Linux memory forensics without external dependencies

We’re open-sourcing mquire, a tool that analyzes Linux memory dumps without requiring any external debug information.

blog.trailofbits.com
2
115
How would your organisation fare in detecting IP theft via a hard drive connected to a sensitive system? "Williams used a portable external hard drive to transfer the exploits out of secure networks at Trenchant's offices in Sydney and Washington, D.C." bleepingcomputer.com/news/se…

Ex-L3Harris exec jailed for selling zero-days to Russian exploit broker

The former head of Trenchant, a specialized U.S. defense contractor unit, was sentenced Tuesday to more than seven years in federal prison for stealing and selling zero-day exploits to a Russian...

bleepingcomputer.com
1
158
Microsoft is moving to disable NTLM by default, with some exceptions. If implemented, this will have a significant impact on threat actors abusing credentials within a network. #SecOps #IncidentResponse #ThreatDetection #SOC 🔗 techcommunity.microsoft.com/…
1
1
3
210
The move to IAKerb and local KDC for local and cached authentication will be....interesting. Falling back to NTLM for authentication using IP addresses instead of FQDNs, I suspect, will keep NTLM in most environments, but overall this is a hopeful step in the right direction.
113
Got some time at the end of the year? We’ve just published the SANS Institute Detection and Response Survey results. Free Download (requires login only) 🔗 go.sans.org/detection-respon… #DnR #ThreatDetection #IncidentResponse #CSIRT #SOC #CERT #Cybersecurity
1
2
186
This year I’ve pulled together a comparison from last year's data and tried to break down some of the results by organisation size.
56
Windows Event IDs and their importance for defenders. #ThreatHunting #DFIR
3
65
283
12,023
I'm not sure how accurate this is, but The Verge is reporting that @Sysinternals #SysMon will be integrated into @Windows 11 early next year. This will be a massive win for #DFIR and #SecOps people everywhere if it's correct. theverge.com/news/821948/mic…
1
117
Wow, @Microsoft is removing #WMIC from @Windows! But they aren't removing the underlying WMI framework, so threat actors will have to use PowerShell to access WMI. 🔗 techcommunity.microsoft.com/… #IncidentResponse #ThreatDetection #ThreatIntel #CSIRT #CERT
1
1
1
192
I'm not sure this will have a significant impact on what Threat Actors do with WMI, however, it'll at least force a Threat Actor to use PowerShell where there is better built-in visibility (if it's enabled), compared to WMIC.
2
97
That's a bit nasty - a threat actor uses #Velociraptor (open source IR tool) as their primary C2 implant on the victim's system. news.sophos.com/en-us/2025/0… #DFIR #IncidentResponse #ThreatDetection #ThreatIntel
1
2
7
563
You think they might also let the victim use it for responding to the compromise as well? 😂
95
🕵🏼‍♂️ Calling all Detection & Response People! 🚨 Don't forget to contribute to the @SANSInstitute Detection & Response Survey!  🔗 survey.sans.org/jfe/form/SV_… 🗓️ It closes at the end of this week! #ThreatDetection #IncidentResponse #CSIRT #CERT #SOC #CyberSecurity #SANSSurvey
1
1
177
It would be great to get as much feedback from the community as possible. I'll be publishing the report towards the end of this year so everyone can benefit from the findings.
72
It's time to update your detections if you haven't been looking for WebShells on your #SharePoint server. 🕵‍ Make sure you're detecting w3wp.exe > cmd.exe > PowerShell.exe Although really, cmd.exe being spawned by your SharePoint server really needs a thorough review.
1
1
2
130
Microsoft has released security updates that fully protect customers using all supported versions of SharePoint affected by CVE-2025-53770 and CVE-2025-53771. These vulnerabilities apply to on-premises SharePoint Servers only. Customers should apply these updates immediately to ensure they’re protected. Full guidance and detection details are available in our blog: msft.it/6010sDzSE

Blog MSRC | Microsoft Security Response Center

Microsoft Security Response Center Blog

microsoft.com
1
50
4
111
73,433
"I SPy" Entra ID Global Admin Escalation Technique @datadoghq Security Labs identified an abuse of Office 365 Exchange Online Service Principal allowing escalation to Global Admin. MSRC considers it "expected misconfiguration" so don't expect a fix. 🔗 securitylabs.datadoghq.com/a…
1
3
249
🚨 Alert on new credentials added to SPs. 🔥 Monitor changes to federated domains (federationConfiguration). 🕵🏼‍♂️ Hunt unusual Graph API calls to /domains, /credentials, and /federationConfiguration. #DFIR #ThreatHunting #EntraID #CloudForensics #M365 #ThreatDetection
137
This is a timely reminder to ensure any third-parties with access to your systems follow the same cyber policies you'd expect your internal staff to follow. bleepingcomputer.com/news/se… #IncidentReponse #DataBreach #CSIRT

M&S confirms social engineering led to massive ransomware attack

M&S confirmed today that the retail outlet's network was initially breached in a "sophisticated impersonation attack" that ultimately led to a DragonForce ransomware attack.

bleepingcomputer.com
2
366
#ScatteredSpider are particularly good at #SocialEngineering their way via a third-party to other victims. For clarity, #ScatteredSpider are considered the initial access group, #DragonForce #ransomware is the malware deployed once #ScatteredSpider are inside your network.
1
144
Here are some recent TTPs for Scattered Spider as well. crowdstrike.com/en-us/blog/c…

SCATTERED SPIDER Escalates Attacks Across Industries | CrowdStrike

CrowdStrike Services reports Q2 2025 incidents of SCATTERED SPIDER targeting aviation, insurance, and retail sectors. Learn more.

crowdstrike.com
105
Load more