SANSforensisco

My enthusiasm into the Cyber Security drove me to take 4 SANS training in less than 6 months, out of pocket.

[SANSforensisco @Cyber7acus]

@sec_soup Only principals can get to that level ;)

[Jake Williams @MalwareJake]

End to end encryption doesn't matter when the adversary (or the government, or the vendor) is already on the endpoint...

[Samir @SBousseaden]

interesting #maldoc (statistics,05.21.doc) using ShellBrowserWindow to launch HTA -> rundll32.exe

66bcee752c3f91bd1d40ad87aeec6c1d0e575e0c77c9a68bb252bb28e4ab4b9e

[SANSforensisco @Cyber7acus]

@NicoleBeckwith @defcon OSINT word is nicer than stalking :)

[Charlie Bromberg « Shutdown » @_nwodtuhs]

Active Directory ACEs abuse mindmap

[Chad Tilbury @chadtilbury]

One of several great presentations by @c_APT_ure. Lots of hunting wisdom in this one!

[SANSforensisco @Cyber7acus]

@SportsCheetah I think they lack sleeping, that's why they can't focus when they park and you get this result!

[Jake Williams @MalwareJake]

If you aren't being challenged and learning new skills at your job, you should probably move.

Cybersecurity is changing every day. If you're an expert practitioner today, but stop updating your skills, you'll be a has-been (as a practitioner) in a few short years.

[Chad Tilbury @chadtilbury]

Guide to Named Pipes and Hunting for Cobalt Strike Pipes by @svch0st https://t.co/lFbXW3N3pu << Some great examples and regexes in this post

[Chad Tilbury @chadtilbury]

It really is this simple. Either you audit your environment with BloodHound or someone else will do it for you. @_wald0 has written some excellent how-to guides:

BloodHound versus Ransomware: A Defender’s Guide” https://t.co/H2yUxbCxfP

[SANSforensisco @Cyber7acus]

@iamevltwin Can't wait for the poster :)

[SANSforensisco @Cyber7acus]

@hmeguid بدور عليه بس مش عارف راح فين، كان فى فترة ٢٠١٠ غالبا، او انا كنت بحلم؟�� :)

[Chad Tilbury @chadtilbury]

A great collection of reverse engineering and memory forensics research from my friend Takahiro Haruyama.

[SANSforensisco @Cyber7acus]

@chrissanders88 @mattnotmax I will purchase it then in the next couple weeks :)

[SANSforensisco @Cyber7acus]

When you watch nutrition videos and they repeat Insulin Response but your brain gets it as Incident Response 🤦‍♂️

[Chad Tilbury @chadtilbury]

Scanning for passwords in description fields in AD (PowerShell) https://t.co/MDniUCclIX >> Sadly, lazy admin actions bring down a significant number of networks. Admins need more security training in general. Just hope your #pentest team finds this before a real adversary does!

[Dmitri Alperovitch @DAlperovitch]

We don't have a ransomware problem. We have a Russia problem.

That's it. That's the tweet