Threat Hunting | Detection Engineering | Defensive Automation (ex @Countercept, @mwrlabs)
Joined April 2008
- Tweets386
- Following447
- Followers832
- Likes272
Pinned Tweet
I'm happy to announce the release of Chainsaw v2! 🥳
Chainsaw allows users to rapidly search through Windows event logs and hunt for threats using @sigma_hq detection rules, all without a SIEM!
Version 2 includes some exciting new features, info in 🧵
github.com/WithSecureLabs/ch…
Slides from this talk are now available here: github.com/FranticTyping/con…
My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀
pretalx.com/bsides-london-20…
My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀
pretalx.com/bsides-london-20…
Scaling detection and response operations at Coinbase part 2 & 3:
🔍 Driving context into detection logic with machine and user profiles
🔧 Codifying automatic remediation for high-risk detections
📫 Automating alert triage with employees via Slackbot
coinbase.com/blog/scaling-de…
The first part of my blog series on how we’ve been scaling detection and response operations at Coinbase is live!
Interested in speeding up your investigations, increasing the visibility of key data sources, and improving quality of life for analysts?
coinbase.com/blog/scaling-de…
Awesome to see this new feature being added to chainsaw! Great work @AlexKornitzer @56616C6F72 💪
Our incident responders recently battled TheDukes/CozyBear/APT29 out of a customer environment. We also developed tooling to help investigate the timeline of the breach. We added 3 techniques for the analysis & timestamp enrichment of Shimcache entries withsecure.smh.re/19H
James D retweeted
Our team at @elastic has been developing this feature for almost six years and we are excited to share our work with the security research community. Thanks to @GabrielLandau @joehowwolf and many others who have contributed to this effort over the years!
Elastic Security makes our ransomware protection artifact open! Learn more here about our commitment to openness and transparency and how detection capabilities need to evolve to keep pace with ransomware threats: go.es.io/3IiBFkd
James D retweeted
Dude, you can wipe whatever WEVTXs you want 🪠
@HuntressLabs gon' find the user accounts, session times, machines, and method for your lateral movement 🕵️♀️
You'd be surprised what #RDP-related event logs can reveal
ponderthebits.com/2018/02/wi…
James D retweeted
I have never before criticized a competitor by name on the @1Password blog.
This is an exception.
blog.1password.com/not-in-a-…
James D retweeted
Hunt, search, and extract Windows event log records with Chainsaw, now in #toolsmith 148. Experiments with an old #DFIR malware case, as well as APT Simulator. The saw is the law! @AlexKornitzer @FranticTyping @sigma_hq @cyb3rops holisticinfosec.io/post/chai…
v2 highlights💡
📖 Support for event logs in XML and JSON format
🎯 Increased sigma rule logic support. More detections!
📘 Chainsaw output displays important information more clearly
🔎 Better filtering/searching options
🦖 Updated Velociraptor Plugin bit.ly/3woOaFz
Also, a massive shout out to @AlexKornitzer for all of his work on v2. He managed to take my “lockdown 2020 Christmas project” and turn it into a much more polished solution. ❤️
Really cool to see this tool finally public! If you’re still viewing alert data in a jira ticket, I’d recommend checking out the approach DetectTree takes to visualise detections, it makes a massive difference.
Happy to drop this new open-source tool that connects the dots during a cyber attack to help blue teams cut down response times, avoid alert fatigue, and communicate during an incident.
More info here >> labs.withsecure.com/tools/de…
#cybersecurity #incidents #infosec
James D retweeted
Check out the first post in my new blog series "On Detection: From Tactical to Functional". The first post explores how we can leverage source code to discover which API Functions an attack tool is using which serves as a base for further investigation.
posts.specterops.io/on-detec…
James D retweeted
macOS malware often (ab)uses APIs such as NSCreateObjectFileImageFromMemory, NSLinkModule etc) to execute in-memory payloads.
Apple has recently updated dyld3 (+these APIs), such that the in-memory payload is now first/always written out to disk 💾
See: github.com/apple-oss-distrib…
James D retweeted
I may be very late on this but I stumbled on @gitlab's handbook for transparency and I really enjoy reading through the reporting on their Security team's KPIs: about.gitlab.com/handbook/en…
James D retweeted
I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅
If you're in #infosec and you feel a little down this week, this video is for you💙
James D retweeted
F-Secure is hiring my replacement, a new Head of Threat Intelligence, based in Europe. This is a genuinely exciting opportunity to grow a CTI capability from its infancy in to a mature function. The role has a lot of freedom to pursue as desired and..
emp.jobylon.com/jobs/120443-…
