Steven Erwin (@StevenErwin) header
Steven Erwin (@StevenErwin) profile picture

Steven Erwin

@StevenErwin

I DFIR things, tweet things, I drink things, I secure things, and I learn things. All tweets are my thoughts and not associated with my employer

 Northwest Indiana
Joined July 2008
  • Tweets2.8K
  • Following653
  • Followers394
Watching an closed piracy.com card get hit with random charges today wasn’t on my bingo card but here we are.
62
Best part of the Verizon outage is all the outage checker/maps are also busted… Everything is fine. This is fine.
1
294
Got to see @rootsecdev drops all sorts of Azure goodness at @BlueTeamCon
Image from Steven Erwin (@StevenErwin)
1
1
40
5,608
FedEx is the worst. Package in schrödinger limbo. Somehow will be delivered today but also hasn’t had any tracking movement since given to FedEx. 45 min of menu routing to get to a human to lmk they’ll look into it and in 7 days reach out if I don’t have it….
1
2
122
Let’s go Purdue! #BTFU #BoilerUp
114
Amazon.. what are we doing. “2 day prime delivery” does not mean you had it off to my local USPS and shrug your shoulders….
2
1
165
Come work with the team and myself!
Tyler Hudak (@SecShoggoth) profile pictureTyler Hudak@SecShoggoth8 Mar 2024
We are looking for an Incident Response Consultant at TrustedSec! You know you want to apply! trustedsec.com/about-us/care… #job #DFIR
3
168
Finally spinning off all my internet of shit devices into their own wireless network and vlan/ip space. Let’s see what breaks.
1
3
164
Created this for a talk and it’s too good not to share… incident response and M365 is painful.
Image from Steven Erwin (@StevenErwin)
3
16
1
78
5,359
If you’re out that way come say hi!
TrustedSec (@TrustedSec) profile pictureTrustedSec
@TrustedSec19 Oct 2023
Senior Security Consultant @StevenErwin will be giving a talk on Oct. 21 at @ColumbusIssa's Threat Level Midnight conference. His talk "Using Incident Response to Make a Better Blue Team" will take place at 11:40am. Check it out if you'll be there! hubs.la/Q025-j_b0
Image from TrustedSec (@TrustedSec)
1
7
1,322
Image from Steven Erwin (@StevenErwin)
1
120
Probably cheaper for Cisco to buy Splunk then it was to actually pay their Splunk renewal
1
121
Social engineering is more art than science
vx-underground (@vxunderground) profile picturevx-underground
@vxunderground13 Sep 2023
All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk. A company valued at $33,900,000,000 was defeated by a 10-minute conversation.
1
1
335
Just watched a package that shipped from 8 hours away (16 hours round trip fro those playing at home) take 5 days to get to me, and it's still not here...
1
2
195
After years of joking about using obscure UTC plus half hour time zones; I have one on a incident. Happy to admit it took more time doing time correction/validation then it did identifying the attack.
2
98
Been migrating MFA apps… not nearly as painful as initially thought
1
78
Great research by the one and only @SecShoggoth give it a read and protect yourself
TrustedSec (@TrustedSec) profile pictureTrustedSec
@TrustedSec1 Jun 2023
🚨Critical vulnerability has been discovered in MOVEit Transfer, a widely used secure file transfer system. 🚨 The TrustedSec IR team has this technical analysis and post-exploitation investigation. No CVE/CVS score available yet. Updates to follow. hubs.la/Q01R-4Yp0
1
9
246
Made it to #thotcon hoping to see anyone here!
2
124
Starting to question why the RSS folder is even in outlook
Image from Steven Erwin (@StevenErwin)
1
2
404
A fantastic write up worth the read
The DFIR Report (@TheDFIRReport) profile pictureThe DFIR Report
@TheDFIRReport3 Apr 2023
Malicious ISO File Leads to Domain Wide Ransomware ➡️Initial Access: IcedID ISO ➡️Credentials: DCsync ➡️PrivEsc: ZeroLogon ➡️Lateral: RDP, SMB/Remote Service, WMI ➡️C2: IcedID, Cobalt Strike, Anydesk ➡️Exfil: Rclone to Mega ➡️Impact: Quantum Ransomware thedfirreport.com/2023/04/03…
Malicious ISO File Leads to Domain Wide Ransomware - The DFIR Report

Malicious ISO File Leads to Domain Wide Ransomware - The DFIR Report

IcedID continues to deliver malspam emails to facilitate a compromise. This case covers the activity from a campaign in late September of 2022. Post exploitation activities detail some familiar and...

thedfirreport.com
163
Load more