Rajnish

Mostly Cyber and i forgot what else.. #ADHD

[sohit mishra @sohitmishra99]

दुनिया को criticize करेंगे, खुद के खिलाफ एक शब्द नहीं सुनेंगे! Javed Sahab said this 7 years ago!

[Shashi Tharoor @ShashiTharoor]

Come on, @Ram_Guha, this is a bit much. What experience did Barack Obama, a first-term Senator from Illinois, have in world affairs when he became President of the most powerful country on earth, while it was caught up in multiple global issues? For that matter, how much international exposure did the CM of Gujarat have to manage India’s International relationships? @RahulGandhi has led a national party for a dozen years. He has extensive contacts with leaders around the world and no shortage of advisers inside and outside his party. No President or PM handles crises alone; that’s why he heads a government! I think it’s time to put this overblown controversy to rest.

[周览资源 @grgerwcwetwet]

终于找到一个能替代 Wireshark 的开源神器。

GitHub 3.7 万 Star 的 Sniffnet，把网络监控做成了普通人也能看懂的样子。

很多人打开 Wireshark 的第一反应都是：
看不懂，直接关闭。

而 Sniffnet 完全不同。

实时显示上传下载流量、连接主机、访问域名、IP 地理位置，甚至还能查看正在偷偷联网的软件。支持流量过滤、PCAP 导入导出、多网卡监控。

最关键的是界面非常舒服。

不用研究抓包规则，不用学习复杂命令，打开就能看到电脑到底在和谁通信。很多用户直接把它当成 GlassWire 的免费替代品。(Windows Central)

Windows、macOS、Linux 全平台支持，Rust 编写，占用资源极低。(GitHub)

对于经常折腾代理、NAS、Docker、服务器的人来说，这绝对属于装机必备工具。

https://t.co/pXQHkfXRzU

[Hugh Laurie @hughlaurie]

Thanks for your critique, Janet. We actually tried a couple of episodes where House (Hugh Laurie) (please put the brackets in the right place) gets it right first time, but they were only 6 minutes long. NBC weren’t happy. Then we tried some where House never gets it right and the patient dies. The audience wasn’t happy.

One could apply your trenchant analysis to other art forms: JS Bach wrote 30 Goldberg variations on the same chord structure; Frida Kahlo painted 50 portraits of herself; Henry Moore, what??

The point is, or was, variations on a theme; if all you see is hospital, medical blah blah, then it wasn’t meant for you.

Nonetheless, I look forward to your first novel!

[Bits, Bytes, and Bourbon @DecryptedTech]

Look at all of this goodness in MS Attack Surface Reduction Rules... Seriously, if you aren't using these and you have them included in your subscription you are missing a lot...

And yes, I can believe that Microsoft leadership is complete crap and ruining a good company while also knowing there are good parts available (yet often unused) in their products. They have just become hyper focused on genAI instead of building on and improving what they have leaving too much to die on the vine.

[Merill Fernando @merill]

If you want to get a head start on your career securing the Microsoft Cloud, here's a Zero Trust for AI play book.

https://t.co/mbojAgwy5W

Of course you need to secure all the pillars in Zero Trust not just AI.

[Subhash Chandra Garg @Subhashgarg1960]

India’s economy under Modi led BJP has gone worse from ‘fragile five’ to ‘vulnerable one’. No economy today is as vulnerable to growth, inflation, investment, exports, fiscal deficit shocks as India. Unhappy days ahead. Modi deforms have cost India badly. https://t.co/3sB1OwQLDu

[ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs @Cyb3rMik3]

📢 𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐭𝐡𝐞 𝐓𝐈𝐅𝐂𝐄 𝐖𝐨𝐫𝐤𝐛𝐨𝐨𝐤 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥!

Everyone who knows me knows how passionate I am about the 𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 (𝐂𝐓𝐈) discipline. Back in early 2020, just before the pandemic outbreak, I had the opportunity to travel to Luxembourg for hands-on training on the @MISPProject and later on, attend two @FIRSTdotOrg CTI events in Berlin. Since then, I’ve been fortunate to work on many CTI initiatives, especially during my tenure at Alpha Bank, where my team pioneered in this area within the FSI sector.

Over the years, the CTI discipline has significantly matured. With that evolution came frameworks, operational requirements, and the growing challenge of managing multiple intelligence feeds - many of which may not be relevant, actionable, or current enough to effectively protect an organization.

Inspired by the TIFCE framework introduced by Sergio Albea, I built the 𝐓𝐈𝐅𝐂𝐄 𝐖𝐨𝐫𝐤𝐛𝐨𝐨𝐤 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥.

🔗 https://t.co/r7vnEnJEK5

The workbook evaluates the four key pillars of the TIFCE framework:
✅ Which feeds provide unique intelligence?
✅ Which feeds are truly relevant to your environment?
✅ Which feeds correlate with confirmed malicious activity?
✅ Which feeds are fresh and actively maintained?

If you are using 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝐒𝐞𝐧𝐭𝐢𝐧𝐞𝐥 and the 𝐃𝐞𝐟𝐞𝐧𝐝𝐞𝐫 𝐗𝐃𝐑 stack together with multiple 𝐓𝐡𝐫𝐞𝐚𝐭 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞 feeds (MDTI, MISP etc), I encourage you to test the workbook and review the findings.

Feedback and contributions are always welcome - feel free to open an Issue or submit a PR with enhancements and ideas. I know already that more visuals and some tabs with more info are needed.

A huge thank you to my comrade Marios for his contributions, and to MVP brothers Sergio Albea, @BertJanCyber, and Uros Babic for their valuable preview feedback.

#MicrosoftSecurity #MicrosoftSentinel #UnifiedSecOps #ThreatIntelligence #CyberThreatIntelligence #KQL #KustoQueryLanguage

[frostb1te @frostb1ten]

For a report I've submit report to MSRC months ago, showed full remote capabilities.

MSRC closed saying it's "Local only".

I comment: "I showed a 0 click proof of concept here. Why was it closed?"

MSRC:" The assessment decision remains unchanged."

Me:"Ok but I proved remote with X PoC and you can see the video I've even attached a few months ago that shows it in action"

MSRC: " Please feel free to submit a new report with additional details."

[Florian Roth ⚡️ @cyb3rops]

I don’t know what happened between Microsoft and #NightmareEclipse behind closed doors

Maybe Nightmare Eclipse was unreasonable. Maybe Microsoft was. Maybe both.

But I think Microsoft badly misjudged this situation.

When you’re the largest software vendor on the planet, you don’t get to behave like an angry individual in an internet argument.

You have to be the adult in the room.

Deleting repositories, talking about criminal investigations and turning the whole thing into a public fight was a mistake. The damage from that goes far beyond this one researcher.

What surprised me most is how quickly people started sharing their own MSRC stories afterwards.

- Months without responses
- “Working as intended”
- Bounty disputes
- Reports that went nowhere

People don’t suddenly start telling those stories for no reason. I think Microsoft broke a lot of porcelain here.

And for what exactly?
I don’t see much upside.

[chompie @chompie1337]

Not what I said. The actual quote: “that isn’t to say there’s going to be no room for security research or ethical hacking, but a lot of the lower hanging fruit will start to go away.” Hacking experts are in a sweet spot rn where AI tech is helping us be super saiyan productive. What remains to be seen is what happens when the models become even more powerful. Anyone who disagrees may be in denial…

[Samir @SBousseaden]

Detecting #Tycoon2FA AiTM attacks across Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.

https://t.co/mSxH6m0bGB

[Bert-Jan 🛡️ @BertJanCyber]

New response script 🛡️

LocalUserResponse.ps1 helps in local account response scenarios to list, rotate, delete and stop related processes.

A blog with more details and live response integration will be published tomorrow.

https://t.co/sX6Xs8BVow

[Lenny Zeltser @lennyzeltser]

https://t.co/IjmT12bLdV

[Reads with Ravi @readswithravi]

“To be happy you must eliminate two things: The fear of a bad future and the memory of a bad past.”

— Seneca

[Seongsu Park @unpacker]

Like many others in CTI, I’ve been trying to integrate AI into my daily workflow by building custom Skills for analysis, hunting, pivoting, and attribution support.

So far, the results have been pretty impressive. In technical workflows especially, well-designed Skills noticeably improve both productivity and analytical consistency. I’ve also found them genuinely useful for attribution work by helping correlate infrastructure, malware behavior, and historical overlaps that are easy to miss manually.

Still a lot to refine, but I’m hoping to eventually organize the Skills and workflows I’ve built and share some of them with the community soon.

[anmol maini @anmolm_]

jesus fucking christ - basically any marks for the Class 12 CBSE board exams could be edited by anyone???

[Florian Roth ⚡️ @cyb3rops]

My whole argument regarding AI boils down to this:

>>> AI increases output much faster than it increases certainty <<<

Yes, it generates more code, more prototypes, more pull requests and more “solutions”.

But every generated line still needs ownership, review, testing, debugging and long-term maintenance by humans.

And I think the market currently underestimates how expensive that last part really is.

[Mysk 🇨🇦🇩🇪 @mysk_co]

On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified. Demo👇

[Matthew Green @matthew_d_green]

Here’s the post. This actually refers to a class action lawsuit filed by the law firm Quinn Emanuel. As best I can see, the allegations are pretty much the same. https://t.co/d7dFkAxieS