Cem Gürkök

[Volexity @Volexity]

On Thursday, Feb 6, @attrc will be at @WWHackinFest to present "Effectively Detecting Modern Code Injection Techniques with Volatility 3". See the full conference agenda here: https://t.co/FrZqNbsUsk.

#dfir #memoryforensics #Volatility3 @volatility

[Ars Technica @arstechnica]

Spies hack Wi-Fi networks in far-off land to launch attack on target next door https://t.co/gwHsIYLgTW

[Volexity @Volexity]

.@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world.

https://t.co/R3aKyrjVYR

#dfir

[Steven Adair @stevenadair]

We are hiring! Come join @Volexity's Threat Detection team. This is a SOC-type role with purview across our customers to identify suspicious & malicious activity using our telemetry across network, EDR/AV, email, logs & more! Take a look! https://t.co/AJAFyOk64j

[Volexity @Volexity]

.@Volexity shares new observations following its discovery of CVE-2024-3400 + #0day exploitation of the GlobalProtect feature in Palo Alto Networks firewalls and offers guidance for detecting compromise.

More here: https://t.co/JXw0pZcE9D

#dfir #threatintel #memoryforensics

[Volexity @Volexity]

Our latest blog post details @Volexity's identification & incident response associated with the Palo Alto Networks GlobalProtect #0day vuln, assigned CVE-2024-3400, that the team found being exploited in the wild.

Read more here: https://t.co/cA7OctkRJW

#DFIR #ThreatIntel

[Steven Adair @stevenadair]

Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory https://t.co/JZIOPnavnX

[alex chantavy @alexchantavy]

cartography can be used to identify AWS privesc opportunities:

```
match(acc:AWSAccount)--(a:AWSPrincipal)--(p:AWSPolicy)--(st:AWSPolicyStatement{effect:"Allow"})
where "iam:CreatePolicyVersion" in st.action
return *
```

shows you targets that can create arbitrary policies.

[👩‍💻 Paige Bailey @DynamicWebPaige]

"We are trapped in a sequential prison. We use sequential character strings to write sequential programs to control sequential computers. No wonder concurrency remains elusive. [...]

How might we help plan our escape?"

(Ivan Sutherland, 2011)

https://t.co/3uUpiDuZ55

[Melanie Ensign @iMeluny]

The #1 indicator of a CSO/CISO’s effectiveness isn’t their technical acumen or reporting structure. It’s their ability to persuade.

That’s the job.

[Zac Siegel @zac_siegel]

Been spinning up #k8s clusters on @digitalocean with terraform to test out distributed training with https://t.co/Dd6Rclh87M

Can go from nothing to a full cluster running a workload in less than 10 minutes!

[Volexity @Volexity]

.@Volexity discovers zero-day exploit impacting all current versions of Atlassian Confluence Server and Data Center. Attackers deploy in-memory Java implant to evade detection. Read more in our latest blog post: https://t.co/aCSwnSUfj8 #DFIR #ThreatIntel #InfoSec

[volatility @volatility]

In the latest @volatility blog post, Memory Forensics R&D Illustrated: Detecting Mimikatz's Skeleton Key Attack, we walk through the #memoryforensics R&D process and develop a new #Volatility3 plugin to automatically analyze for abuse. https://t.co/TwkevZKdDB #dfir 1/2

[Brendan Gregg @brendangregg]

eBPF comes to applications: BPF Memory Cache (BMC) is an eBPF memcached accelerator. Currently for GET requests over UDP. Promising work! Thanks @Orange https://t.co/Jj3raJZb7t https://t.co/jksSWEYH5S

[Dan Price @DanPriceSeattle]

I'm still learning to be a better boss and only look "good" when compared to other CEOs because the bar is so depressingly low.

Listen to your employees, trust them, reward them. They are responsible for a company's success - not CEOs.

[👩‍💻 Paige Bailey @DynamicWebPaige]

I like the notion that burnout isn't necessarily working long hours, but rather having to give up things you love—whether that's spending time with family, reading, running, hiking, traveling, etc.

That definition also explains why lockdown is an unprecedented burnout catalyst.

[volatility @volatility]

It’s great to see @vmwarensx emphasizing the importance of #memoryforensics in virtualized environments and highlighting the @volatility Framework! #vol3 #volatility3 #dfir

[Volexity @Volexity]

.@USCERT_gov has released an Activity Alert addressing recently disclosed Microsoft Exchange vulnerabilities: https://t.co/ajRrTs3BZI This alert provides valuable information sourced from @Volexity blog + other sources. We urge all defenders to take a look! #dfir #ThreatIntel

[Volexity @Volexity]

Supply Chain compromise of #SolarWinds provides Dark Halo actor with unauthorized remote access to select targets. @Volexity has also observed this group using novel methods to bypass 2FA. New research just posted to our blog: https://t.co/qAuOPRJo1o #threatintel #dfir #infosec

[Google DeepMind @GoogleDeepMind]

In a major scientific breakthrough, the latest version of #AlphaFold has been recognised as a solution to one of biology's grand challenges - the “protein folding problem”. It was validated today at #CASP14, the biennial Critical Assessment of protein Structure Prediction (1/3)