Izy

Learning to break, working to secure.

[Lukas Klein | @rantasec.bsky.social @RantaSec]

Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths

https://t.co/HPh2xiiCzl

[Izy @IzySec]

@ImposeCost @ConnorSecurity fire

[Andrew Thompson @ImposeCost]

Catch @IzySec's recent podcast discussing Rogue Remote Desktop Protocol: https://t.co/sJHJB3MBDk

[Mandiant (part of Google Cloud) @Mandiant]

Signed .rdp files are being used to trick users.

GTIG observed a novel #phishing campaign targeting European government and military organizations, and has attributed it to a suspected Russia-nexus #espionage actor tracked as UNC5837.

Read the details: https://t.co/XimKgMIPuQ

[Steve YARA Synapse Miller @stvemillertime]

1) I didn't know .RDP config files could be signed
2) RDP RemoteApps are crazy
3) I always appreciate a Fuzzy Snuggly Duck

https://t.co/rlyNNxfHFW

[Steve YARA Synapse Miller @stvemillertime]

Neat blog on RDP tradecraft, includes examples, practical recommendations on hardening, detection ideas etc.

[Izy @IzySec]

Having convertible detection content is great, no doubt. What I think is underrated is blueteam-focused tradecraft intel. Red teams share it all the time, we should too.
A threat group recently showed creativity with a known technique. Here's how it worked
https://t.co/PME7Iu0kWX

[Izy @IzySec]

@ImposeCost For Azure trainings, I've heard good things about
https://t.co/QVlr4mzz7E
https://t.co/dnY0KoOjzV
https://t.co/BeiHBfxNSW
I've not personally taken any myself.

For AWS, I have taken and can recommend the course from the AWS IR team themsleves
https://t.co/Sy4Zb2Py9R

[Izy @IzySec]

Some solid work done by the team! Give them a read :)

[Jared Wilson @JWilsonSecurity]

🌶️ Active Fortinet Zero-Day Exploitation ITW 🌶️
https://t.co/ZfFG0D2676

#zeroday #fortinet #inthewild

[ACE Responder @ACEResponder]

Windows audit policies, the events they enable and the relative volume of events they generate

#ThreatHunting #DFIR

[Izy @IzySec]

A sister team of mine is hiring. They do hard core detection engineering. You will be analyzing things you won't see elsewhere and writing a variety of content to detect it. Super technical role alongside some great folk.

[John Connor @ConnorSecurity]

I'm excited to announce that I'm hiring two Detection Engineers for the Mandiant Detection Engineering Team! Come build detections at a global scale for cutting edge threats on an amazing team.

Apply here https://t.co/ZPcLU982kP

#DetectionEngineering #Mandiant #Detection

[Izy @IzySec]

@ImposeCost COUNTER STRIIIKEE

[Izy @IzySec]

@ImposeCost I hear it's great :D

[SEKTOR7 Institute @SEKTOR7net]

Wondering what telemetry an EDR collects?

Wonder no more! @Kostastsale and @ateixei run an EDR Telemetry Project, covering all major EDRs:

"The main goal of the EDR Telemetry project is to encourage EDR vendors to be more transparent about the telemetry they provide".

Blog: https://t.co/VOEt9dDQVl
Table: https://t.co/8uYv4jFrRj
Github: https://t.co/NLwwXzBEHb

#redteam #blueteam #telemetry

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Small experiment today, inspired by @kaganisildak, using RCON protocol, as used by e.g. CS 1.6 as a C2 channel for the lulz

[Izy @IzySec]

@ImposeCost I liked the Psychology of Money by Morgan Housel.

[Izy @IzySec]

@_RastaMouse Your content doesn't need marketing, Daniel!

[Riccardo @dottor_morte]

It's a bittersweet moment, but our series of "Attacking an EDR" has come to an end! Me and @Her0_IT hope that you had as much fun reading it as we had writing it.

https://t.co/2hWelV4oHT

[Izy @IzySec]

Woooo, legoooo!

[Jared Atkinson @jaredcatkinson]

I've just released the next edition of the On Detection series. I investigate why detection rules based on Process Creation are often brittle or easily bypassed. I also provide a framework for discerning when it is appropriate and when it isn't.
https://t.co/opAcnNfIMl