Austin TX. area Information Security Professional
Austin, TX.
Joined September 2010
- Tweets7K
- Following188
- Followers3.9K
- Likes808
Hacker Hurricane left for BlueSky retweeted
Join #BSidesAustin (December 5-6) for “Tech to Exec” with Keith Turpin. @SecurityBSides @BSidesSATX @AustinISSA @dc512 #infosecurity
bsidesaustin.com/schedule
ALT Presentation highlight: Tech to Exec with Keith Turpin BSides Austin event dates: December 5 & 6, 2024 https://bsidesaustin.com/schedule
Hacker Hurricane left for BlueSky retweeted
You know what time it is? Time for our Call for Papers! Got an awesome talk in mind? We'd love to hear it. Submit your Call for Papers for the Information Warfare Summit today! Oh, and the conference is in person on October 11, 2023! See you there!
iwsokc.org/
Hacker Hurricane left for BlueSky retweeted
Holy shit this thing has taken off! Over 1,000 attendees 🤯 @HouSecCon just wow and thanks everyone for speaking, volunteering and attending!
Hacker Hurricane left for BlueSky retweeted
Love this "Coverage, Completeness, Configuration" model from @HackerHurricane - he says "it's the gaps that will kill you." @sansforensics #threathuntingsummit
Hacker Hurricane left for BlueSky retweeted
Announcement: I have updated sysmon-config. This is a clean benchmark before more advanced changes.
- I am promoting @olafhartong's modular and more exhaustive solution as a next-step.
- I am promoting @HackerHurricane's cheat sheets as a compliment.
github.com/SwiftOnSecurity/s…
Hacker Hurricane left for BlueSky retweeted
#MalwareLabDaily 0x16
MalwareArcheology's #Cheatsheets to help in configuring Windows systems and others, by @HackerHurricane
Auditing, #Logging, PowerShell, #Sysmon, @MITREattack , etc.
malwarearchaeology.com/cheat…
#BlueTeam #DFIR #SIEM #Audit #CyberSec #cybersecuritytips
Hacker Hurricane left for BlueSky retweeted
I never noticed how woefully inadequate Windows audit logging was until I moved from a sysadmin role over to security...
I really like @HackerHurricane's cheat sheets:
malwarearchaeology.com/cheat…
For AD, Microsoft put a nice list here for MDI deployments:
docs.microsoft.com/en-us/def…
Hacker Hurricane left for BlueSky retweeted
I've lost count of how many times I've pushed @HackerHurricane's Logging Cheat Sheets over the years. I just can't recommend them enough! If you haven't checked them out yet, do yourself a favor and take a gander:
malwarearchaeology.com/cheat…
Hacker Hurricane left for BlueSky retweeted
Shoutout to @raj_ashwin for giving a great talk at @RH_ISAC today! One of the resources he referenced was @HackerHurricane's great auditing cheat sheets. malwarearchaeology.com/cheat…
Learn how @KCCorp's Ashwin Rajendra's approach to proactive remediation and how to protect from external threats and vendor malware incidents to your infrastructure. This is now a 30 min session and at 12 PM ET. #RHISACSummit #Protectasone
Hacker Hurricane left for BlueSky retweeted
Here is a quick reference I compiled with every Advanced Audit Policy mapped to the Windows EventID. Feel free to share! docs.google.com/spreadsheets…
Hacker Hurricane left for BlueSky retweeted
@mattifestation for being super humble while blowing my mind with your research
@gentilkiwi for one of the most famous tools while learning C
@mysmartlogon great ad research and PingCastle
@HackerHurricane great defense and IR resources
@SadProcessor PowerShell and cypher wizard
Hacker Hurricane left for BlueSky retweeted
Thank you for sharing. It's definitely something to be aware of.
For anyone interested in knowing which event ids to start with, I would start with @HackerHurricane cheat sheet
malwarearchaeology.com/cheat…
Hacker Hurricane left for BlueSky retweeted
Loved your talk today! The subtitles were really helpful too ;)
Hacker Hurricane left for BlueSky retweeted
As day one comes to a close a big shout out to all the speakers today!
@TheBeerFarmers, @safesecs, @cy_ninja, @KeirSnelling, @aitezazmohsin, @HackerHurricane, @samhogy, @ChaniSimms.
Hacker Hurricane left for BlueSky retweeted
Live now: @HackerHurricane: You need a PROcess to check your running processes and modules. The bad guys, and red teams are coming after them!
Viewing options: bsidesnewcastle.org/
Hacker Hurricane left for BlueSky retweeted
I’ve just uploaded a new release of the ThreatHunting app for Splunk.
splunkbase.splunk.com/app/43…
This release has some new features, speed improvements and several bug fixes. Working on some big new feature additions.
#threathunting
#dfir #sysmon #splunk
Hacker Hurricane left for BlueSky retweeted
I’ve added CI/CD to my #Sysmon repo using Azure Pipelines.
It’ll check whether it merges correctly and will load on Sysmon to make sure there is no misconfiguratio, then commit the new config.
This way it stays up to date and error free.
github.com/olafhartong/sysmo…
Blog soon :)
Hacker Hurricane left for BlueSky retweeted
#AzureSentinel-ATT&CK v.1.4.2 released. It's automation reloaded! Remember all the pain setting up whitelisting functions to get the #ThreatHunting workbook going? The time wasted setting up the #Sysmon parser? That's gone... #ARMtemplate deployment time!
github.com/BlueTeamLabs/sent…
Hacker Hurricane left for BlueSky retweeted
Thank YOU for sharing your time and experience!
Thank you @BSidesSATX for putting together a very well organized event full of smart, friendly and helpful volunteers. Fantastic experience aa a speaker! 💜
Hacker Hurricane left for BlueSky retweeted
With the @MITREattack Sub techniques out it was time to retag all my #Sysmon modules.
I’ve updated the repo github.com/olafhartong/sysmo…
I’ll also go through it later to tag some more untagged rules and update it with more detections #DFIR #ThreatHunting