Brandon Baxter

[Amitai Cohen @AmitaiCo]

Here are the main ways that vulnerable #OpenSSL instances *might* manifest in-the-wild (we will update this diagram to be more precise once the CVE details have been published). Credit to @ncsc_nl for the appropriately Halloween-themed logo.

[Brandon Baxter @CyberScimitar]

@mvelazco @splunk Congratulations Mauricio!

[Brandon Baxter @CyberScimitar]

@jcfarris Congrats!

[Jared Atkinson @jaredcatkinson]

In 2019 I heard threat hunting described in so many ways it became hard to pin down what the concept is. What three words would you choose to describe your view of threat hunting?

[GCHQ @GCHQ]

Ever wanted to encrypt messages with Enigma and decode them with the Bombe?

Give our new features in #CyberChef a try!

➡️ https://t.co/OxLcQQbePa

[Brandon Baxter @CyberScimitar]

Nice work Chris!

[Chris Farris (@[email protected]) @jcfarris]

Creating an AWS Security Account https://t.co/UQaL0JqjNJ

[Marta Gómez @Mrs_DarkDonado]

🎉 Check out my latest post in the @wazuh blog: "Monitoring AWS environments with Wazuh"!

https://t.co/ZwvKLa9BAc

[Florian Roth ⚡️ @cyb3rops]

https://t.co/pLWbdNp9V5
an online translator for search queries on log data
> uses #Sigma as intermediate language
#Splunk #ArcSight #Kibana #ElasticSearch #QRadar #Graylog #Logpoint
by @SOC_Prime
https://t.co/yRHvTNdea4

[Chad Tilbury @chadtilbury]

Volatility Plugin for Detecting Cobalt Strike Beacon from @jpcert_en https://t.co/vsttVzmWD5

[Keith @kwm]

Spot on. To elaborate a bit:

1) Know what you're protecting (data).

2) Know how #1 can be accessed (systems, via identities).

3) Know the observable events associated with #2.

4) Build and/or buy in an order that makes sense to obtain #3.

5) Detect, respond, improve. https://t.co/uxxtVeefNt

[Dan Kaminsky @dakami]

In case you don't already know, the BigCo's (Amazon. MS, GOOG, Apple come to mind) have some *redonkulous* security talent, dealing with offensive and defensive techniques *way, way different* than research in the public sphere. https://t.co/uSYfxUAYxe

[Matt Jezorek @MattJezorek]

We have 25 positions to fill in the Amazon #SOC. I want it done in the next 3 months. Multiple locations, not remote. Security Devs, System folks, Detection folks, and more. Entry to Principal #infosecjobs

[Johannes Bader @viql]

I just published a blog post on a new word-list-based domain generation algorithm of the Nymaim malware: https://t.co/z7v4a7VBBX . The algorithm has already been included in the DGArchive https://t.co/z6x7QZdTq5. #nymaim #dga.

[pfSense® Project @pfsense]

DNS over TLS with pfSense https://t.co/qc6GTpL7dg

[Conrad Longmore @ConradLongmore]

@demonslay335 Normally I find that informing site owners elicits one of the following responses:

[@mikko @mikko]

Leader of the Carbanak online crime gang arrested in Spain. One of their methods was to hack ATMs to dispense all of its cash at a pre-determined time (also known as 'jackpotting'). https://t.co/kalFHwGUZG

[Rasta Mouse @_RastaMouse]

Basic overview of Persistence

https://t.co/ty4edqSlVN

[Andreas Sfakianakis / @[email protected] @asfakian]

Hijacking the Admin/Jump Servers of Domain Admins: Get Admin on the jump server -> Get SYSTEM -> Run tscon.exe as SYSTEM -> "if you run tscon.exe as the SYSTEM user, you can connect to any session without a password"
https://t.co/vdySfvOZZC thanks @PyroTek3 #adsecurity #DFIR

[Chris Sanders 🔎 🧠 @chrissanders88]

A teacher I know in Toccoa, GA is looking for someone in tech to come speak to her 2nd graders on career day March 30th. Anyone interested? It’s pretty close to Knoxville, Asheville, and Greenville.

Great opportunity to do something positive in a rural community!

[Ted Demopoulos @teddemop]

Creating a Cybersecure Home #Ouch! #SecurityAwareness https://t.co/4RXTkw70M4