J P

Threat Detection / Incident Response in the Cloud. Livin' on the *nix command line. I've got a fever, and the only prescription is more #DFIR.

[J P @JPoForenso]

@ImposeCost But, it's specifically written as an "also" statement to, by design/definition, imply no priority.

Still trying to figure out the animosity here... hard to imagine we're not actually on the same page, given our shared tenure in the industry.

[J P @JPoForenso]

@ImposeCost Saying that posting anything on X is a priority in my life would certainly make a lot of people laugh 😀

But, to answer your question, likely for the same reason(s) you posted yours? Just guessing, though.

I apologize, I can't tell if this is hostile/rhetorical or genuine.

[J P @JPoForenso]

@usetraceix Huh? Not sure what you are asking.

[J P @JPoForenso]

If LinkedIn headlines were a tweet.

[Traceix @usetraceix]

Today I have decided that I am the best developer in the world.

Nothing you say can prevent me from thinking this.

Thank you for your attention to this matter.

[J P @JPoForenso]

Investors HATE this one trick to increasing your adoption rate...

[Justin Elze @HackingLZ]

Not unexpected

“Velociraptor incident response tool abused for remote access”

https://t.co/TXZcTE49tR

[J P @JPoForenso]

Interestingly enough, this is one big reason I went out on my own. So many people need the tenured expertise, but think it's too much $$$$. Ironically, it ends up being very similar in cost. Charge 4x a junior, but do it in .25x of the time = same cost, BUT deliver 10x value.

[solst/ICE of Astarte @IceSolst]

Why are consultants young. I’d rather consult a white haired wizard that’s lived a thousand years and only appears in the ghastly Tower when lightning hits it on a full moon (you’ll have to solve three riddles to enter). Instead I get a hungover 23 yo from coalfire.

[J P @JPoForenso]

@AngryFenixDfnd Glad to see it's still helping folks!

[J P @JPoForenso]

@DirectoryRanger This looks eerily like a paraphrased and copy/pasted version of one of my blog posts from way back in 2018 (with some typos - 1179 is not the correct Event ID). 🧐

Full version below (or just Google "Windows RDP Investigation" - it's the first result):

https://t.co/McSEaxtsQz

[J P @JPoForenso]

@georgemporter If it's the second time and it remains a largely impactful issue, I'd definitely recommend researching and implementing the variety of relatively easy mechanisms that exist to both prevent and reactively detect such situations with your account(s). Pay now or pay later (again).

[J P @JPoForenso]

#DFIR public speakers/presenters:

Is it acceptable to you, as a speaker, to receive no travel or accommodation assistance for a paid attendance speaking event?

If yes/no, please share your thoughts/experiences.

[J P @JPoForenso]

@OpenAI relies on models (vast amounts of SME) for #AI and @MsftSecIntel (i.e., Security CoPilot) relies on models (again, SME skills/experience).

Common denominator is deep/wide SME knowledge.

Where are we getting this with our current dearth of #DFIR talent/expertise? 🤔

[J P @JPoForenso]

@ramimacisabird #ProTip #DFIR TL;DR - Enable Data Events for S3 Buckets and filter the events you care about.

[J P @JPoForenso]

@hashishrajan @CloudSecPod Important clarification here.

CloudTrail Event History maintains 90 days of management events ONLY. You will NOT have any data events like you will if you create a dedicated Trail.

This is incredibly important to understand if you decide against creating a Trail.

[J P @JPoForenso]

My customized more granular IR lifecycle didn't make it in, but many other things did. 🙃

This is the result of a lot of work from smart folks passionate about creating more prescriptive and informative #DFIR guidance for folks operating in #AWS.

Feedback always welcome!

[AWS Security @AWSSecurityInfo]

💪We've updated the #AWS Security Incident Response Guide to more clearly explain what you should do before, during, and after a security event.

Below are highlights of a some of the changes and instructions on how to use the updated guide 👇 #cybersecurity #incidentresponse

[J P @JPoForenso]

@jhencinski Man, I wonder how this works out in practice.

Wondering if an effective "detection + immediate notification + response requirement" mechanism is a better balance of flexibility with security.

Just thinking out loud.

Any insights from your experience?

[J P @JPoForenso]

@cyb3rops Perhaps the most clear and overarching highlight here is that the USN Journal $J is a great mechanism for identifying system/file activity, especially for non-resident files (paired with $Secure for identifying ownership/permissions), so long as it's still in the buffer.

[J P @JPoForenso]

@binaryz0ne @professorbike @bettersafetynet If you only care about the memory (for testing), then the methodology you are using should be just fine.

Just FYI, based on your needs and what you're looking to do.

Good luck in your research/testing!

[J P @JPoForenso]

@binaryz0ne @professorbike @bettersafetynet Keep in mind by adding a drive and attaching it to the system, you are introducing modification/alteration of system artifacts, which is something we try to avoid as a best practice for response. Snapshot is the easiest mechanism to mitigate that and capture both memory and disk.

[J P @JPoForenso]

@hal_pomeranz @WWHackinFest I'll answer one 😀

(With filesystem mounted at "/mnt/X/")

$ zdump /mnt/X/etc/timezone
$ zdump /mnt/X/etc/localtime
$ cat /mnt/X/etc/timezone
$ ls -l /mnt/X/etc/localtime
$ readlink /mnt/X/etc/localtime

Did I miss any?