Wj (@77_6a) header
Wj (@77_6a) profile picture

Wj

@77_6a

Opinions are my own and not the views of my employer/ex employers

Joined November 2010
  • Tweets1.9K
  • Following532
  • Followers119
27Media
Photo by Wj (@77_6a)Photo by Wj (@77_6a)Photo by Wj (@77_6a)Photo by Wj (@77_6a)Photo by Wj (@77_6a)
Been looking to start learning Kusto, or need brushing up on your skills? I have a couple of copies of the electronic version of 'The Definitive Guide to KQL' to give away! Repost or comment below and I will put you in the draw and in a couple of days I will draw out a couple of lucky winners. aka.ms/kqlmspress

The Definitive Guide to KQL: Using Kusto Query Language for operations, defending, and threat...

The Definitive Guide to KQL: Using Kusto Query Language for operations, defending, and threat hunting (Business Skills)

amazon.com
48
42
5
82
12,125
If you're looking for a sts:GetCallerIdentity replacement that doesn't log to CloudTrail, I've added a few more APIs that don't log and don't have support for additional logging with Data events. Perfect for a quiet `whoami` in the AWS control plane. hackingthe.cloud/aws/enumera…
Whoami - Get Principal Name From Keys - Hacking The Cloud

Whoami - Get Principal Name From Keys - Hacking The Cloud

During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.

hackingthe.cloud
1
20
73
2,885
New blog is up! On incident response in AWS using Athena and we even included an Athena Cheatsheet. Check it out: invictus-ir.com/news/cloud-n… #stayInvictus #CloudIncidentResponse #aws #dfir
AWS Cloud Native Incident Response: Part 2 | Invictus Incident Response

AWS Cloud Native Incident Response: Part 2 | Invictus Incident Response

Part two of our AWS IR series: using Athena and Glue to query CloudTrail, VPC Flow, S3, ELB and CloudFront logs, plus partitioning and nested field parsing.

invictus-ir.com
11
38
2,305
🔬 Engineering a SIEM part 3: Creating Cost-Effective, Scalable Detections AWS Lambda, Snowflake, and DynamoDB to manage alert deduplication, customizable alert routing CI/CD for automated testing and deployment By @Rippling’s Piotr Szwajkowski rippling.com/blog/engineerin…
Image from Clint Gibler (@clintgibler)
2
32
139
9,394
The moment you've been waiting for! 🎉 Replay sessions from #FIRSTCON24 are now available on YouTube! Access all TLP:CLEAR sessions here: zurl.co/15E7 #CyberSecurity #InfoSec #security
FIRSTCON24

FIRSTCON24

36th Annual FIRST Conference "BRIDGING SECURITY RESPONSE GAPS" For more information on the conference and access to materials, please visit https://www.first...

youtube.com
4
1
10
1,249
The schedule for fwd:cloudsec Europe is out! fwdcloudsec.org/conference/e… @ramimacisabird will be giving the opening talk, "How to 10X Your Cloud Security (Without the Series D)". Talks will be live-streamed on YouTube for free.
Schedule | fwd:cloudsec Europe 2026 | fwd:cloudsec

Schedule | fwd:cloudsec Europe 2026 | fwd:cloudsec

fwdcloudsec.org
16
2
40
6,096
"Tips for SOCLess Oncall" bit.ly/3LDpb8I <- a very, very fun read about doing D&R the modern, SOCless way! With usable details!
10
28
2,273
13 tickets remaining for Seattle DEATHCon! We've reserved the lucky 13th final ticket to be given away for free to a student or anyone who wouldn't be able to buy the ticket otherwise. Follow this account to see details of how to apply when the time comes!
2
9
1
14
1,566
DEATHCon Seattle tickets are live now. I struggled with EventBrite not letting me set the exact time for scheduled publishing, so I just had to hit the button manually 30 minutes earlier than planned. Go get em! deathcon.io/tickets.html
1
4
769
The next part of our #Kubernetes #Security fundamentals video series is out now! This time we're looking at the Kubelet API. talking about the ports it makes available and some of the potential for information leakage. youtu.be/OdkFPL7d73E?si=ytdc…
Kubernetes Security Fundamentals: API Security - Part 3

Kubernetes Security Fundamentals: API Security - Part 3

In this video we’ll continue our look at the details of how Kuberne...

youtube.com
1
14
31
1,615
Join us at New2Cyber in April for another fun CTF challenge!
SANSNew2Cyber (@new_2_cyber) profile pictureSANSNew2Cyber@new_2_cyber13 Mar 2024
We've teamed up with @KC7cyber for an awesome FREE CtF! All levels are welcome to dive into this thrilling #Cybersecurity challenge. Register and join us April 4: sans.org/u/1uk7
Image from SANSNew2Cyber (@new_2_cyber)
2
8
758
Takes more than 1 hour to report a faulty Dell monitor that is under warranty. Feels like @Dell is making it so hard so you don't report it and buy a new one instead.
2
5
42
You asked and we answered... Because of the interest in our merch, we've decided to run a giveaway! We're offering merch bundles to 10 lucky winners (items may vary to those shown). To enter: 🛡️ Follow us and @CysecCareers 🛡️ Retweet this tweet Worldwide. Closes Jan 5, 2024
Image from Centri (@centri_org)
101
572
22
333
55,378
#Infosec #Jupyterthon 2024 Back to welcome in the new year. We're looking for speakers, so get your thinking caps on and cool demos at the ready. 🎇 Also looking for input on the kinds of content that you'd like to see. 👷‍♀️➡️🔣 Check out @Cyb3rWard0g's announcement for links.
InfoSec Jupyterthon (@jupyterthon) profile pictureInfoSec Jupyterthon@jupyterthon15 Dec 2023
🚨 The #Infosec #Jupyterthon is back 📺! 🔥 🗓️February 2024! ❄️🔥Your opportunity to share your curiosity and inspire others🌎! @OTR_Community 🚀 Call for Notebooks (Dec 15th, 2023 - Jan 15th, 2024) forms.office.com/r/bKAyTRjja… 📢 Help us shape the event! forms.office.com/r/s8v9aQT5Y…
Image from InfoSec Jupyterthon (@jupyterthon)
2
4
451
Release notes here github.com/microsoft/msticpy…
Release Stability release · microsoft/msticpy

Release Stability release · microsoft/msticpy

A few bugs had crept in over the last couple of releases: some due to buggy coding, some due the world moving forward. So, many items in this release are to address these. Among the feature improve...

github.com
msticpy (@msticpy) profile picturemsticpy@msticpy4 Oct 2023
MSTICPy v2.8.0 released. Stability release - with several important fixes: - MS Sentinel failure when connecting using a connection string - Using supported method for multi-cloud Azure endpoints - Using msticpy in isolated environments.
1
1
2
489
🚨Our cloud incident response courses are now live, register at academy.invictus-ir.com 🎉 To celebrate we're giving away three vouchers one for each course, Like & Repost to enter the competition. 🥇 We will announce the winners next Monday
Image from Invictus Incident Response (@InvictusIR)
25
128
8
185
15,375
My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure. trustedsec.com/blog/okta-for…
Okta for Red Teamers

Okta for Red Teamers

Okta Delegated Authentication We’ll start with a technology offered to users deploying their Okta tenant alongside traditional on-prem Active Directory…

trustedsec.com
24
364
13
902
98,607
A week late, but it's another great episode on how security operations can learn alerting from SRE. While it may not be possible to just alert on symptoms for security operations, breaking down the causes leads to symptoms seems like a exercise. open.spotify.com/episode/6Vz…
EP133 The Shared Problem of Alerting: More SRE Lessons for Security

EP133 The Shared Problem of Alerting: More SRE Lessons for Security

Cloud Security Podcast by Google · Episode

open.spotify.com
4
36
We've just released our AWS CloudTrail Cheat sheet, blog post: invictus-ir.medium.com/aws-c… Link to cheat sheet: github.com/invictus-ir/aws-c… In this thread our Top 5 Events from CloudTrail for Incident Response! 🧵
AWS CloudTrail cheat sheet

AWS CloudTrail cheat sheet

We have moved this blog to our own website. This allows free access for everyone.

invictus-ir.medium.com
1
29
2
65
6,760
Thank you @KC7cyber for hosting the event yesterday, it was fun! I'm glad I stayed up for it. Very lucky to come in first, it was close and intense. :D
Image from Wj (@77_6a)
1
1
7
967
Load more