Josh Madeley

a begrudgingly polite Canadian ex-pat living in Boston, finding evil at @Mandiant

[Josh Madeley @MadeleyJosh]

@cyb3rops If the TA had the privileges to install software, not sure what tool they downloaded and used really matters. Seems “troll-ey” that they picked an open-source forensic tool more than anything else.

[Josh Madeley @MadeleyJosh]

@ItsReallyNick Jesus. That pace. Well done.

[Josh Madeley @MadeleyJosh]

@BakedSec @Blackhat Looks vaguely familiar. Can’t quite place my finger on it.

[Mandiant (part of Google Cloud) @Mandiant]

UNC3944 Evolving Tactics Exposed!

Our new blog dives deep into UNC3944's recent SaaS attacks, analyzing their changing methods and goals.

Read now: https://t.co/XSkqwBtCGo

#Cybersecurity #ThreatIntelligence #UNC3944

[Ryan Tomcik @heferyzan]

Thrilled to co-present on cloud threat hunting with the IR legend @MadeleyJosh on June 13th! Tune in to hear:

☁The nuances of hunting in the cloud
☁ How to turn intel into detection/TH opportunities
☁ Case studies on recent compromises

Register now: https://t.co/vhhssUCf3b

[Josh Madeley @MadeleyJosh]

@ImposeCost xlsx2csv and csvkit

[Josh Madeley @MadeleyJosh]

@gleeda @ImposeCost This is not to say they can’t benefit from it; just my observations in practice is that they don’t use it that way. Security vendors are exempted from my observations - someone has to build detections at scale.

[Josh Madeley @MadeleyJosh]

@gleeda @ImposeCost There probably isn’t a good way. My intuition (and anecdotal experience) is that most blue teamers are not using the POC code to build detections; they are using it to test if the mitigation or patch worked until their is an official vuln scanner detection.

[Josh Madeley @MadeleyJosh]

@_Omer_GG @Big_Bad_W0lf_ @cglyer Commercial datasets like Spur attempt to identify them. They are not “great” given the high turnover, but it’s a starting point.

[Josh Madeley @MadeleyJosh]

@DeltaTangoTwo Need help? I know some people :)

[Josh Madeley @MadeleyJosh]

@derekcoulson @ImposeCost Bank fraud and loss prevention are big business. Not usually the type of crime we see.

[Josh Madeley @MadeleyJosh]

@itsfoss @srunnels

[Josh Madeley @MadeleyJosh]

@PJ47596176 @jamieantisocial Hard to explain the fingernail pain to anyone who hasn’t played.

[Josh Madeley @MadeleyJosh]

@PJ47596176 The baby swing is a great touch! I started getting my daughter to count reps!

[Josh Madeley @MadeleyJosh]

@brettshavers Maybe I am missing something, but are they saying that IP address based tracking still worked when people were incognito? Was the expectation that client side changes impact server side analytics?

[Josh Madeley @MadeleyJosh]

@ImposeCost Maple syrup should only come in a glass bottle. Zero exceptions.

[Mandiant (part of Google Cloud) @Mandiant]

Listen to the recent #DefendersAdvantage podcast with @doughsec and @MadeleyJosh sharing the trends they’ve experienced when responding to breaches in 2023.

Check out their episode here: https://t.co/0ynJh45SYW

#ThreatIntelligence

[Josh Madeley @MadeleyJosh]

Quality advertising

[CrowdStrike @CrowdStrike]

Don’t let cyber criminals ruin your #SmallBusinessSaturday

Get AI-powered, elite cybersecurity protection with CrowdStrike Falcon Go—now available on Amazon Business.

Learn more: https://t.co/igtzkdkuGK

[Josh Madeley @MadeleyJosh]

@ImposeCost Juxtaposed to a tweet about needing a mobile IV van paints the picture of a wild Friday night.

[Doug Bienstock @doughsec]

Today we launched a 🔎 scanning tool for orgs to search their Citrix netscalers for evidence of CVE-2023-3519 post-exploration. You can run this direct on the ADC or against a forensic image. With public POCs out there expect more exploitation!

https://t.co/Wiianjv8AX
#DFIR