Sascha

Blue turned Red turned Purple Teamer. Head in the clouds. Detection Engineering, DFIR, Deception. Ex-SANS Instructor.
@[email protected]

[Sascha @Cyb3rB3ar]

Currently giving Mastodon a try and might stay there permanently should Twitter deteriorate too much. You can find me on https://t.co/shAKZEf4gu under my usual handle: https://t.co/BLhc1KmyWz

[BSidesFrankfurt @BSidesFRA]

BREAKING! Save the date!

Workshops at BSidesFrankfurt on Thu, August 28, 2025.

First come, first serve. Details soon - block your calendar Thu+Fri!

[BSidesFrankfurt @BSidesFRA]

A new talk from BSidesFrankfurt 2024 is now live on YouTube!

Zero Trust - Attack and Defend by Aaron Jewitt
Aaron shows how Elastic built advanced automation into their SIEM to reliably detect novel attacks in a Zero Trust environment - without overwhelming analysts with false positives. Learn how to automate alerts for suspicious API token or key use from outside your environment and get practical insight into defending modern infrastructures.

Watch now: https://t.co/Wc6JCrcQL2

Don't forget to subscribe to our channel for more cutting-edge cybersecurity content!

#BSidesFrankfurt #CyberSecurity #ZeroTrust #SIEM #ThreatDetection #ITSecurity #Infosec

[Mehmet Ergene @Cyb3rMonk]

🚨 FREE unlimited lab access to "Introduction to KQL for Security Analysis" course!

Thrilled to announce that my Intro to KQL for Security Analysis lab environment is now completely free with no time restrictions!

https://t.co/UYgtcKnwOr

#KQL #Kusto #ThreatHunting #Infosec

[DEATHCon @DEATHCon2026]

Locations:
Kuala Lumpur, Tacoma, San Diego, Austin, Orlando, Montreal, Córdoba Argentina, Edinburgh, Amsterdam, Oslo, and Bonn

Where will you go to find friends in DEATH?

[BSidesFrankfurt @BSidesFRA]

We are excited to announce that ticket sales will begin today! Take advantage of our limited early bird discount and secure your spot now!

[BSidesFrankfurt @BSidesFRA]

Exciting News! The date and location for the next BSidesFrankfurt are officially set! Mark your calendars:

Friday, August 29, 2025, at Campus Westend, Goethe University.

Stay tuned for ticket sales and further updates. In the meantime, revisit past recordings and help spread the word!

We’re also looking for sponsors - a great opportunity to support the cybersecurity community and gain valuable exposure. If you're interested, reach out to us!

Recordings (updated monthly): https://t.co/EZYr5XjFtX

[St0pp3r @_st0pp3r_]

One of many out there, I know, but I finally got some time to arrange my bookmarks into an awesome list for #detectionengineers.

The repo automatically generates a bookmarks file that you can import.

If you have other good resources let me know.

https://t.co/iQsvhUiIsU

[Olaf Hartong @olafhartong]

Detection Engineering is sometimes hard, and may fail. Still a lot of things can be learned by the process. In this blog I cover a lot. I had a detection, currently it's broken but MS is on it :D

https://t.co/MZxhChxt0b

[KQLCafe @KqlCafe]

Missed KustoCon 2024? 🧠✨ All 6 expert-led sessions are now on-demand! 🎥 Dive into top KQL insights and enhance your skills.

📺 Watch: https://t.co/2kgPzOCGRX
🌐 More: https://t.co/fDqdLF85OB
#KustoCon #KQL #MicrosoftDefender

[Bert-Jan 🛡️ @BertJanCyber]

The Big Yellow Taxi #KQL query discussed in #KustoCon is published.

https://t.co/f65hJYHVS9

For XDR only users based on CloudAppEvents and AADSignInEventsBeta. For Sentinel users also based on OfficeActivity and SigninLogs.

Happy hunting! 🏹

[Mehmet Ergene @Cyb3rMonk]

🚨 New Offering!

For those who already know KQL fundamentals and are ready to take their skills to the next level into threat hunting and detection engineering:

https://t.co/TG5W1U76wX

#ThreatHunting #DetectionEngineering #Kusto #KQL #DFIR

[Ru Campbell @rucam365]

New video: frequently seen Defender Antivirus/Defender for Endpoint mistakes

There are probably 100 pointers for what to avoid or think about. Here's 5 to start.

Is there interest in longer form content on well architected MDAV/MDE?

Watch: https://t.co/5xZalBPmf9

[💻 Sherrod @sherrod_im]

lol. InfoSec and threat intel right there baby. We are a highly elite cadre of terminally online nerds.

[Timo Steffens @Timo_Steffens]

Das @BSI_Bund zur Rolle von KI bei Cyber-Angriffen:
Grundlegend neue Angriffstechniken wurden nicht beobachtet, nur Einzelschritte der Angriffskette werden effizienter. Erfolgreiche Angriffe erfordern weitere Schritte, die noch nicht KI-unterstützt sind
https://t.co/fgs4TTpADG

[Elastic Security Labs @elasticseclabs]

Detection engineering is complicated, but this new 5 tier maturity model from @stryker0x, @_xDeJesus, and @SBousseaden provides guidance for security teams: https://t.co/xR1inbZml5

#ElasticSecurityLabs #detectionengineering #maturitymodel

[NVISO Labs @NVISO_Labs]

New blog post!

Title: Validate your Windows Audit Policy Configuration with KQL
| By Stamatis Chatzimangou

Link: https://t.co/8gzltQsFPV

#AuditPolicy #Azure #KQL #KUSTO #Sentinel #SIEM #SOC #Windows

[Justin Elze @HackingLZ]

Definitely agree that the future looks like for detections and detection engineering.

https://t.co/Bo68NJTfwa

[BSidesFrankfurt @BSidesFRA]

There will be a small lock picking table, mostly for kids and beginners at #bsidesfra

Our sets are very easy to pick, but feel free to bring your own lock or pick set if you want a challenge :)

[Jake Williams @MalwareJake]

It's 2024. Get with the program and stop taking risks pretending you can secure BYOD. You can't.

[Sascha @Cyb3rB3ar]

Secure Access Expert - IAM, PAM, PKI (w/m/d): https://t.co/Zu494VgauU

IT Security Senior Consultant (In-house) (w/m/d): https://t.co/nafDZRmWDV

#hiring #jobs (2/2)

[Sascha @Cyb3rB3ar]

Wir suchen 4 neue Mitarbeiter (w/m/d) um unser Security Operations Team der Delos Cloud GmbH zu verstärken - bei Fragen gerne anschreiben :)

Cyber Defense Expert - SOC & Incident Response: https://t.co/mCuMuyIB7p

Expert SOC Engineer: https://t.co/wxSY30STiX

#hiring #jobs (1/2)