Orig3n

Incident Response and Threat hunting

[HackNWA @HackNwa]

It's that time of year. We are pleased to bring you HackNWA Conference 2025: Sock Puppet Tycoon - Disposable Machine, Network, Server, Client and Identity;Make frens and influence ppl
Great speakers, activities, panelists, and afterparty concert in Bentonville

Get your tickets!

[Orig3n @0rig3n]

👏 Congratulations. I know being on the Blue side can be stressful! Had a fun time thinking Red team thoughts :)

[Southwest CCDC @SWCCDC]

Congratulations to the following teams for qualifying for the 2024 SWCCDC regional event:
@Baylor
@LATech
@PhilanderSmith
@SamHoustonState
@SAC_PR
@TAMU
@UTAustin
@utulsa

We look forward to seeing everyone in March!

[Orig3n @0rig3n]

@OrOneEqualsOne That’s a great logo! I’ved used 5rr for logos and once for a voice actor 🤣

[Orig3n @0rig3n]

@bettersafetynet Maybe look into Azures conditional access controls.

[Orig3n @0rig3n]

@robertgraham You might try “man iptables”

[Orig3n @0rig3n]

Woot! @OrOneEqualsOne speaking at @Sp4rkCon !!

[Orig3n @0rig3n]

Great talk by @kaoticfen at @Sp4rkCon !!!!

[Ohm-I (Oh My) @mcohmi]

Gonna be in Bentonville on April 15th attending #Sp4rkCon and then performing at a separate party later.

About to take over this whole midwest con party scene 😤

[Carrie Roberts @OrOneEqualsOne]

I'm teaching my PowerShell For InfoSec course live online for the first time on 3/2/23 and 3/3/23. It is a 2 day class for $575 from @Antisy_Training. Have you already taken the On-Demand (pre-recorded) version? What did you think? Check it out here: https://t.co/CdmV3NxTRu

[Orig3n @0rig3n]

@PeteABryan @maarten_goet Just saw the agenda yesterday, look forward to seeing your talk!

[Antisyphon Training @Antisy_Training]

The next run of PowerShell for InfoSec:What You Need to Know! w/ @OrOneEqualsOne, that be during our summit, we're honored to be supporting @cybher_dsu w/ 10% of our revenue from this class!
Class registration: https://t.co/dkMO4Dt8ku
Support this project: https://t.co/IRLIgWKeLj

[Orig3n @0rig3n]

@HackingDave More like bad ass 😂

[Orig3n @0rig3n]

@4lex Same.

[Orig3n @0rig3n]

@volodarik How many of those 1M+ didn’t finish setting up their accounts because of a valid phone number requirement?

[Orig3n @0rig3n]

@FlipperLocator Yay! I got one! Thanks

[Orig3n @0rig3n]

@DFIRmadness @breadpir8 @DebugPrivilege I think what @cyberthrunter did with RemoteIPType == “Public” might be more efficient.

[Orig3n @0rig3n]

@breadpir8 @DebugPrivilege You could add this to filter private address | where ipv4_is_private(RemoteIP) == false

[Orig3n @0rig3n]

Just learned about this cool lots-project by @mrd0x. Here is a MDE KQL #threathunting query that looks for lolbins talking to lots-project domains. https://t.co/NQ94tL8xBa

[Orig3n @0rig3n]

Thinking of different ways of #threathunting lolbins, especially ones that don’t normally communicate over the network. This is a good base query to get started in Microsoft Defender for Endpoint. #kql https://t.co/vVHNp63fP0

[Orig3n @0rig3n]

@bettersafetynet Roll out Microsoft Defender for MacOS and create detections.