Threat Hunting | Detection Engineering | Defensive Automation (ex @Countercept, @mwrlabs)
Joined April 2008
- Tweets386
- Following447
- Followers832
- Likes272
James D retweeted
Our team at @elastic has been developing this feature for almost six years and we are excited to share our work with the security research community. Thanks to @GabrielLandau @joehowwolf and many others who have contributed to this effort over the years!
Elastic Security makes our ransomware protection artifact open! Learn more here about our commitment to openness and transparency and how detection capabilities need to evolve to keep pace with ransomware threats: go.es.io/3IiBFkd
James D retweeted
Dude, you can wipe whatever WEVTXs you want 🪠
@HuntressLabs gon' find the user accounts, session times, machines, and method for your lateral movement 🕵️♀️
You'd be surprised what #RDP-related event logs can reveal
ponderthebits.com/2018/02/wi…
James D retweeted
I have never before criticized a competitor by name on the @1Password blog.
This is an exception.
blog.1password.com/not-in-a-…
James D retweeted
Hunt, search, and extract Windows event log records with Chainsaw, now in #toolsmith 148. Experiments with an old #DFIR malware case, as well as APT Simulator. The saw is the law! @AlexKornitzer @FranticTyping @sigma_hq @cyb3rops holisticinfosec.io/post/chai…
James D retweeted
Check out the first post in my new blog series "On Detection: From Tactical to Functional". The first post explores how we can leverage source code to discover which API Functions an attack tool is using which serves as a base for further investigation.
posts.specterops.io/on-detec…
James D retweeted
macOS malware often (ab)uses APIs such as NSCreateObjectFileImageFromMemory, NSLinkModule etc) to execute in-memory payloads.
Apple has recently updated dyld3 (+these APIs), such that the in-memory payload is now first/always written out to disk 💾
See: github.com/apple-oss-distrib…
James D retweeted
I may be very late on this but I stumbled on @gitlab's handbook for transparency and I really enjoy reading through the reporting on their Security team's KPIs: about.gitlab.com/handbook/en…
James D retweeted
I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅
If you're in #infosec and you feel a little down this week, this video is for you💙
James D retweeted
F-Secure is hiring my replacement, a new Head of Threat Intelligence, based in Europe. This is a genuinely exciting opportunity to grow a CTI capability from its infancy in to a mature function. The role has a lot of freedom to pursue as desired and..
emp.jobylon.com/jobs/120443-…
James D retweeted
Let's quickly look at how Defenders can benefit from tools like Chainsaw, Sigma, docs from KAPE & Velociraptor, and Security Onion 🕵️♂️
We'll use real, shady data - fresh out the kitchen 🧑🍳
Along the way, I'll share some tips and shortcuts to cut faster through data and logs
🧵
James D retweeted
For the person who invented "thrunting" to try and abbreviate "threat hunting": please put your photo frame and potted plant in the cardboard box. Security is on its way.
James D retweeted
I am hiring for a Snr Threat Intelligence Researcher role. The key two responsibilities of this role will be to track threat activity across data from our services/products & open source and to help dev additional capability in this area.
emp.jobylon.com/jobs/112020-…
James D retweeted
Here is an idea to identify running beacons:
1. Beacons ThreadState often is: DelayExecution
2. Calltrace to NtDelayExecution includes unknown regions
Works also fine against beacons sitting in file backed memory
github.com/thefLink/Hunt-Sle…
James D retweeted
Literally ANY idea you might have along the lines of “this behavior will only be seen in a malicious context” will be proven wrong once you are looking at behavioral data at scale across many industries and geographies. Much of detection engineering work is elimination of fps
One common refrain in #infosec circles is "I've never seen a legitimate (macro doc|HTA|etc) these are all evil" - yet this ignores the natural bias that we will almost always focus on/look for ONLY malicious items of these types. Trying to understand the business logic behind 1/2
James D retweeted
Awesome research on macOS #ESF and some practical examples for threat detection by my colleague Connor labs.f-secure.com/blog/esfan…
James D retweeted
Made this a while back, might also help
RDP Event Log DFIR: dfironthemountain.wordpress.… << Good overview and testing of alternate RDP log sources
James D retweeted
🔥🔥🔥🔥
👏 Thank you and great work @BlackMatter23! 👏
We've added a link to these rules in our report.
thedfirreport.com/2021/03/29…
📢Anyone want to convert these to Sigma rules? We'll send you free swag 😀 DM us if interested.
It was the most time consuming #ThreatIntel report in my career😤
#REvil TTPs hunting campaign is finished:
- 37 detection ideas
- 81 detection rules (Windows/Sysmon/EDR)
plus BloodHound & BITS jobs:
bit.ly/2XAEx8h
Excellent work @TheDFIRReport team!
#threathunting
James D retweeted
During a podcast today, the concept of "blueteam 'zero day'" came up, a detection method so dramatically novel that it needs to be kept secret from the attackers. How common do you think this is? #question
James D retweeted
Cobalt Strike User-Defined Reflective Loader written in Assembly & C. Was 20 times harder than I thought it would be.. but I learned allot and I am grateful. Looking forward to building on this for evasion!
Massive Credits to: @SEKTOR7net @stephenfewer
github.com/boku7/CobaltStrik…
