DFIR Notes

design, build, teach threat-informed information security programs and techniques. Also: retweets of interesting classes, tools, research. They/them

[DFIR Notes @DfirNotes]

@dfirnotes is (we're) mostly:
Information Security Leader & Educator | Twitter, Github: @dfirnotes
BBSTi, CISSP, GIAC**0x0c, GSE**2, ITIL, LPI, MAD CTI
Blog at https://t.co/WTp7sUaWtH
DMs open for #CyberMentoringMonday or other questions.
Be excellent to each other!

[Tim Misiak @timmisiak]

(1/n)
WinDbg finally released outside the store, and no more "Preview"!

Ecstatic to see my old team hit this milestone! It's come so far since @aluhrs13 and I started the "WinDbgNext" project so many years ago.

https://t.co/PtOcgTxQ3C

[Katie Nickels @likethecoins]

For $20 a month, you get access to a bunch of knowledge from smart people like @ForensicITGuy on topics from malware analysis to network forensics to EXCEL ❤️, and much more. This isn't sponsored, I just think it's awesome they're making such useful content so accessible!

[tlansec @tlansec]

Domain fronting is hands-down the weirdest thing. I think a lot of blue team (including myself) would have heard the term over the years without looking into it. 1/4

[Jonny Johnson @JonnyJohnson_]

@Cyb3rMonk I think it depends on what you want the EDR.

Personally, I have never looked at an EDR as a source for detection but a source of telemetry. I see vendors say they detect "x", but I have always used that as one of my detections for a given operation versus the sole detection.

[. @T3chnical1]

Anyone who wants a mentor, to give back to the community, or to just share resources should definitely check out #CyberMentoringMonday loads of amazing people and info in the tag!!

[VirusTotal @virustotal]

Introducing VT4Splunk, our official App for @splunk https://t.co/bVLsnWnr9k by @thetravelr

[Russ McRee @holisticinfosec]

Reminded by ⁦@jaredcatkinson⁩ what an invaluable project Security Datasets is: OSS initiative that contributes malicious & benign datasets from different platforms to expedite data analysis & threat research. ⁦@Cyb3rWard0g⁩ ⁦@Cyb3rPandaH⁩ https://t.co/lYCDtx6qkj

[Florian Roth ⚡️ @cyb3rops]

Our Sigma rule extension for @code got a major update by my team member @paulhagertheo

It allows lookups of similar and related rules & uses a new web service to do that

it's still new & only superficially tested - feedback & bug reports are welcome

https://t.co/qwN2owJCrI

[The Diana Initiative @DianaInitiative]

Our call for sponsors is open!

Our prospectus is now up at https://t.co/KLJKldRglC

Your support will help us do even more amazing things this year. Great opportunity to connect & support #womenInTech #diversity in #infosec
#LeadTheChange #TDI2023

[Applied Network Defense @NetworkDefense]

"The labs were fun and interesting. The feedback is fast and insightful...I'm not used to that much interaction with an instructor in an asynchronous course!" - Rob

[Applied Network Defense @NetworkDefense]

"If you pay attention and give Investigation Theory its due, you will come out the other side a much better analyst for having taken it."

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

@netresec @GuhnooPlusLinux That said, the way meterpreter does TLS is strange, so you can do detection on how it behaves.

However, again... this is defaults, you can change the TLS behavior in your payload options and advanced options.

[Victor Petrov @VictorPPetrov]

well, Balkan Cyberia finally has a cover and it is marching robotically towards its publication on the 13th June with @mitpress! It has spies & cyborgs, not just apparatchiks - and will be open access but if you want a copy, there will be a discount code!

https://t.co/0yTi1FdbMo

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

IMO, BYOD is *the most expensive* cost savings measure ever.

[TCM Security @TCMSecurity]

We often get asked how to land a job in cybersecurity.

In today's video, Heath discusses the importance of community and giving back as one of the important steps to getting a job in cybersecurity.

https://t.co/7ozr8667Mz

[hasherezade @hasherezade]

New release: #PEbear 0.6.5: https://t.co/AsAbJGR9nb - several new features, fixes and improvements - check it out!

[Jamie Levy🦉 @gleeda]

I'll be giving a talk next week over my journey into #DFIR and give some tips to help others find their way into this space!

#memoryforensics #malware #infosec #infosecurity

[P!bbl3 @TechEmiiily]

Assert dominance in your ticket queue by submitting all technical details necessary with screenshot of Hello Kitty terminal.

[OpenSecurityTraining2 @OpenSecTraining]

Happy 1st anniversary to @NonprofitCyber!

[SLEUTHCON @SLEUTHCON]

#SLEUTHCON provides cybersecurity newcomers & professionals the opportunity to learn from industry experts in easy-to-follow 30 min talks. Join us online or in Arlington, VA on 5/12! Register today at https://t.co/k217bE6gS0. #cybercrime #infosec #cyberattacks #CTI #ransomware