Jaysus

Detection Engineer & False Positive Aficionado 🦸‍♂️🇨🇦

[Jaysus @JayInfoSec]

@josefchen My mom's cooking blows this away.

[Katie Paxton-Fear @InsiderPhD]

A lot of people ask me what they need to learn to keep up in AIxHacking: Right now you need to learn how to turn the monotonous part of your methodology into a repeatable agent, after that it’s scale and harness. Then it’s building skepticism into that system externally from you.

[Jaysus @JayInfoSec]

@SBousseaden For Elastic, I set up a CICD ingesting all Sigma LOLRMM rules convert to TOML as building block rules > with higher order rule for "first time observed LOLRMM rule"

Am i doing this right 😅

[Dr. Anton Chuvakin @anton_chuvakin]

You may joke and say we woefully undermarket stuff (and we do), but our team build this thing: https://t.co/2kUS3QhBLA

[SANS Cyber Defense 🧢 @SANSDefense]

Hot take:
AI in the SOC is most useful when it’s… boring.

🧵

[ATT&CK @MITREattack]

ATT&CK v19 is live! We've split Defense Evasion into Stealth and Defense Impairment, introduced Sub-Techniques to ICS ATT&CK, Detection Strategies to Mobile, and added some AI and Social Engineering to Enterprise. Check out all the details in our blog post https://t.co/XHzwGHZuNX

[Jaysus @JayInfoSec]

we dont hate rich people nearly enough

[Jaysus @JayInfoSec]

@jlabernathy "cloud kill data centers"

hahahahahahahaha

[solst/ICE of Astarte @IceSolst]

Would any security team benefit from having a Certified Scrum Master ®

[Jaysus @JayInfoSec]

consulting in infosec is not meant to produce outcomes. you are just entertaining the circus while the clowns are hiding behind their empty suits.

[Jaysus @JayInfoSec]

I am so sick of companies posting "Remote" opportunities on @LinkedIn and then when you read the fine print it says "3 days in office mandatory" - why is there not a hybrid filter yet ????

[WhiskeyHacker @whiskeyhacker]

I spent my normal whiskey/cigar break thinking and reading and counting how many configuration "switches" are available when you are a firm like Stryker.

36,000 to 45,000 config settings

And that's before you count the permutations.

You think a spreadsheet and a quarterly review covers it?

[eleven red pandas @bytecodevm]

Research shows how Palo Alto Cortex XDR predefined BIOC behavioral rules can be decrypted and analyzed. By understanding rule logic and built-in exceptions, attackers can adapt techniques to evade detection and bypass behavioral protections.
https://t.co/I7ihgU1sDs

[WhiskeyHacker @whiskeyhacker]

Taken from the Stryker Handala / Intune Detection Pack v2

"Check PIM role settings for Global Administrator, Intune Administrator, and Cloud Device Administrator. If you see only the "Require Azure MFA" checkbox and no Authentication Context configured, you have the same gap that enabled the Stryker wipe. Configure Authentication Context with FIDO2 or certificate-based auth today.

Enable Intune Multi-Admin Approval for wipe, retire, and delete actions. Tenant Administration > Multi Admin Approval. Under 10 minutes. No additional licensing required.

Deploy Rule 13 (bulk wipe threshold alert). Five wipes in 15 minutes from a single identity fires the alert. Wire it to a Logic App that calls revokeSignInSessions on the triggering account via Microsoft Graph.
"

link to Detection Pack v2 blog and direct download.

Please share so others can lock down their InTune environments please

https://t.co/nLhS49kxut

[Zach Bovaird @bovaird_zach]

The 3 AI SOCs I’ve demoed with this month all give me serious cause for concern.

Traditional ML in a SIEM with UEBA should probably be leveraged before AI solutions.

Following that, SOAR with AI sprinkled in where necessary, then more advanced AI measures.

Also, security architecture evals for our own deployments has proven more difficult than I expected.

Like Gall said in the 70s: complex systems are never built. They evolve from simpler ones.

[one dozen rats at a keyboard @PanasonicDX4500]

they were right to take cigarette ads off tv, I would’ve smoked a pack a day if I saw this when I was 14

[Sahil @sahill_og]

Every AI Company : We're replacing your job with AI

Me who already replaced my job with AI :

[solst/ICE of Astarte @IceSolst]

There’s an astronomical skill gap between good security people, and the rest. There’s no mid. Accounts you see posting their research here are absolutely cracked, it’s not the norm.

When you go out and talk to security folks that don’t go to conferences, don’t read up on research, you realize- holy shit. They have no fucking clue. The majority of the cybersecurity work force is absolutely incompetent.

It’s partly why vendors can come up with inane bullshit as marketing material and it works on many CISOs.

If you’re reading this, you’re most likely 1000x the skill level of the average person. Like I cannot emphasize enough how low the bar is when the sample size is the entire industry.

[COSSACKGUNDI @cossackgundi]

How it feels right now

[dev @zivdotcat]

POV: Claude watching ChatGPT take hours to eliminate Ayatollah Khamenei.

meanwhile Claude smoked Maduro in just 15 minutes