James D

Threat Hunting | Detection Engineering | Defensive Automation (ex @Countercept, @mwrlabs)

[James D @FranticTyping]

I'm happy to announce the release of Chainsaw v2! 🥳

Chainsaw allows users to rapidly search through Windows event logs and hunt for threats using @sigma_hq detection rules, all without a SIEM!

Version 2 includes some exciting new features, info in 🧵

https://t.co/P9q69gZswA

[James D @FranticTyping]

@__invictus_ @RedTeamTactics PPID spoofing was the gift that kept giving a few years ago. Threat actors were doing it without realising it was a very high fidelity detection for most EDRs. It so rarely happens normally that it was a dead giveaway something malicious was going on

https://t.co/T5lgC7Y1zV

[James D @FranticTyping]

@thechrisharrod Congrats @thechrisharrod 💪

[James D @FranticTyping]

Slides from this talk are now available here: https://t.co/u2jvMOhK0Y

[James D @FranticTyping]

My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀

https://t.co/eWmXlsAJFO

[James D @FranticTyping]

My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀

https://t.co/eWmXlsAJFO

[James D @FranticTyping]

@AngusRedBlue @JohnHultquist @BSidesLondon I’ve got a spare one as well, let me know you still need one.

[James D @FranticTyping]

Scaling detection and response operations at Coinbase part 2 & 3:

🔍 Driving context into detection logic with machine and user profiles
🔧 Codifying automatic remediation for high-risk detections
📫 Automating alert triage with employees via Slackbot

https://t.co/vEUEWvZ6K4

[James D @FranticTyping]

The first part of my blog series on how we’ve been scaling detection and response operations at Coinbase is live!

Interested in speeding up your investigations, increasing the visibility of key data sources, and improving quality of life for analysts?

https://t.co/KxaP8KughK

[James D @FranticTyping]

Awesome to see this new feature being added to chainsaw! Great work @AlexKornitzer @56616C6F72 💪

[Artturi Lehtiö @lehtior2]

Our incident responders recently battled TheDukes/CozyBear/APT29 out of a customer environment. We also developed tooling to help investigate the timeline of the breach. We added 3 techniques for the analysis & timestamp enrichment of Shimcache entries https://t.co/uQGERBDLHY

[James D @FranticTyping]

@OMENScan @AlexKornitzer Hey @OMENScan - feel free to open an issue on GitHub and we can take a look: https://t.co/P9q69gZswA

[Mark Mager @magerbomb]

Our team at @elastic has been developing this feature for almost six years and we are excited to share our work with the security research community. Thanks to @GabrielLandau @joehowwolf and many others who have contributed to this effort over the years!

[Dray Agha @Purp1eW0lf]

Dude, you can wipe whatever WEVTXs you want 🪠

@HuntressLabs gon' find the user accounts, session times, machines, and method for your lateral movement 🕵️‍♀️

You'd be surprised what #RDP-related event logs can reveal
https://t.co/MCQNd1WXgb

[Jeffrey Goldberg 🌻 @jpgoldberg]

I have never before criticized a competitor by name on the @1Password blog.

This is an exception.

https://t.co/E2K1pdUIXj

[James D @FranticTyping]

@visibil1 @sigma_hq Hey! That requirement isn’t available within chainsaw and would need to be handled within the rule logic. If you find problematic rules you can either disable them or alter them to exclude ParentProcessName as you need. I hope that helps!

[James D @FranticTyping]

I'm happy to announce the release of Chainsaw v2! 🥳

Chainsaw allows users to rapidly search through Windows event logs and hunt for threats using @sigma_hq detection rules, all without a SIEM!

Version 2 includes some exciting new features, info in 🧵

https://t.co/P9q69gZswA

[Russ McRee @holisticinfosec]

Hunt, search, and extract Windows event log records with Chainsaw, now in #toolsmith 148. Experiments with an old #DFIR malware case, as well as APT Simulator. The saw is the law! ⁦@AlexKornitzer⁩ ⁦@FranticTyping @sigma_hq ⁦@cyb3rops⁩ ⁩ https://t.co/oeYDZKq8eH

[James D @FranticTyping]

Also, a massive shout out to @AlexKornitzer for all of his work on v2. He managed to take my “lockdown 2020 Christmas project” and turn it into a much more polished solution. ❤️

[James D @FranticTyping]

v2 highlights💡

📖 Support for event logs in XML and JSON format
🎯 Increased sigma rule logic support. More detections!
📘 Chainsaw output displays important information more clearly
🔎 Better filtering/searching options
🦖 Updated Velociraptor Plugin https://t.co/s2Rviu1dyg

[James D @FranticTyping]

@Purp1eW0lf @AlexKornitzer Ah, that's so cool to see Chainsaw being useful!😀

We've just released the beta of Chainsaw v2 which contains a lot of improvements over v1 (support for loading EVTX in JSON & XML format, better sigma detection coverage, faster execution etc). I'd love to hear your feedback!

[James D @FranticTyping]

Really cool to see this tool finally public! If you’re still viewing alert data in a jira ticket, I’d recommend checking out the approach DetectTree takes to visualise detections, it makes a massive difference.

[WithSecure™ @WithSecure]

Happy to drop this new open-source tool that connects the dots during a cyber attack to help blue teams cut down response times, avoid alert fatigue, and communicate during an incident.

More info here >> https://t.co/OZyfKBJ6ll

#cybersecurity #incidents #infosec

[Jared Atkinson @jaredcatkinson]

Check out the first post in my new blog series "On Detection: From Tactical to Functional". The first post explores how we can leverage source code to discover which API Functions an attack tool is using which serves as a base for further investigation.
https://t.co/W9SGL2VP8h