Jos

Freelancer | Incident Response enthousiast 👈

[Jos @DfirJos]

@reprise_99 :)

[Jos @DfirJos]

Did already someone build a ipv6 address range to cidr list converter in Kusto?

For ipv4 there is this brilliant function: https://t.co/pRKhrKVk8A But for ipv6 it's not there.

[inversecos @inversecos]

APT Emulation Labs: NOW LIVE 🎉

Solve incidents emulating APT29, APT10 and other threat groups.

$45 per month access to ALL labs:
👀 150+ hours of lab content
👀 Disk forensics + ELK logs
👀 Hints, questions and point system
👀 7 days free trial

Labs are created & designed by industry peers:
@ZephrFish @svch0st @ippsec @DebugPrivilege @HuskyHacksMK @inversecos

Each lab comes
with scoping notes, Windows VM with forensic tools, network diagrams, disk forensics, ELK access and was created from our collective experience working in the field.

👇ACCESS THE LABS HERE 👇
https://t.co/raaUSztKtT

[Jos @DfirJos]

What are some good DFIR blogs that I should add to my RSS reader? #IncidentResponse #DFIR

[Jos @DfirJos]

I just finished a blog that provides two new practical examples on how responders can detect adversary behaviour with the incident response and digital forensics tool Velociraptor. #Velocidex #DFIR #IncidentResponse #Velociraptor

https://t.co/C2bMGkiQ7N

[Xavier Mertens @[email protected] 🇧🇪 @xme]

Most of the time, this works for me! 🫣

[Nicolas Krassas @Dinosn]

Chimera: Automated DLL Sideloading Tool With EDR Evasion Capabilities https://t.co/B1597zXv4n

[Jos @DfirJos]

@UID_ Lifegoals!

[Jos @DfirJos]

What is the craziest persistency technique you've seen an adversary use to ensure their malware survives a reboot? #incidentresponse #malwarepersistance #dfir #malware

[Jeffrey Appel | Microsoft MVP @JeffreyAppel7]

The MDE blog series is updated with new content. Added more content for attack disruption, MDE settings management, Defender for Cloud Apps, Tamper protections for exclusions, and more common mistakes around MDE in part 10.

Link: https://t.co/Wrsh5u5WQ8

#MDE

[Jos @DfirJos]

As a responder, do you trust the EDR isolation feature for containing a host?

Always check if DNS is also blocked. Because if that still works, the adversary can still operate the system if the malware communication (C2) is tunneled over DNS. Trust but verify ✅

#dfir #ir

[John Hammond @_JohnHammond]

Live demonstration rapid digital forensics & incident response -- with the CREATOR of Velociraptor @scudette & researcher @mgreen27! Absolute treat to get together with these incredible practitioners. Pro knowledge for free!! (This is the 1st of 2 videos) https://t.co/Aek4qhG2vs

[Jos @DfirJos]

Great to see that this awesome open-source incident response case management tool is continuously improving👌 Would definitely recommend other responders to check it out if you haven't already.

https://t.co/VcLbmT2WJp #DFIRIRIS #incidentresponse

[DFIR-IRIS @dfir_iris]

🚀 Excited to announce IRIS v2.3.0 is here! 🥳 Fresh off the press with:

🤝 Collaborative edition in notes
🔎 Case peer-reviews
🚨 Alerts resolution status
🔔 New webhook module
👀 Enhanced overview & dashboard
🎨 Redesigned UI and more!

https://t.co/Pb6ycm5TLp

[DFIR-IRIS @dfir_iris]

🚀 Excited to announce IRIS v2.3.0 is here! 🥳 Fresh off the press with:

🤝 Collaborative edition in notes
🔎 Case peer-reviews
🚨 Alerts resolution status
🔔 New webhook module
👀 Enhanced overview & dashboard
🎨 Redesigned UI and more!

https://t.co/Pb6ycm5TLp

[Jos @DfirJos]

@burning_pm @SecurityAura Will try it out!

[Aura @SecurityAura]

That script works and it works really well! 🙂

You should definitely use it if you deal with Carbon Black Cloud for SOC or IR purposes!

[Jos @DfirJos]

@techspence Yeah every engagement. We use Velociraptor to run PowerShell commands on endpoints, for example to execute remediation tasks.

[Jos @DfirJos]

@SecurityAura Thanks, if you have any feedback let me know!

[Jos @DfirJos]

@trk_rdy Having the ability to query all endpoints as in more cases then not there isn’t any telemetry available due to the client not having an edr.