Ray Pugh III

[CYBR.SEC.Events @CybrSecEvents]

Catch Hiranya Mir from @expel_io at HOU.SEC.CON 2022! https://t.co/UMoAI1tJ1w

[Jon Hencinski @jhencinski]

#SOC caught attacker in #GCP when they issued API call to CreateServiceAccountKey via SDK from odd IP.

This triggered alert w/:
- IP enrichment
- Historical context for user/API

Team scoped & fixed.

Initial access? Exposed cred.

More details ⬇️
https://t.co/d4owJCBtZ1

[Max Rogers @MaxRogers5]

We'll look back in 10 years and credit the modern operations center to @jhencinski. If you lead a Security Operations Center - listen to his appearance on the @SecHubb/@SANSInstitute podcast:
https://t.co/kwWHNb9r0a

[Jon Hencinski @jhencinski]

Our first @expel_io annual report is here!

It includes data and insights on:
- BEC (public enemy #1)
- Pre-ransomware activity
- Supply chain attacks
- Cryptojacking

Our goal: translate the security events we’re detecting into strategy for your org.

https://t.co/3jKhmtQssH

[Expel @ExpelSecurity]

Great eXpeltations 2022 has arrived!

Help your org manage risk with data and insights on the biggest #infosec threats, how to handle 'em, and what you can expect in the year ahead. Download it today at https://t.co/7Dy4i5wDxD. #MDR #SOC #ransomware #cryptojacking #phishing #BEC

[Expel @ExpelSecurity]

#JobAlert: thrive working w/ others? Love destroying dreams of attackers? Dig working with a variety of tech at the intersection of detection & response automation and weaving it all together?

We're #nowhiring a Sr. Detection & Response Engineer: https://t.co/rKroNEg5CF #hiring

[Jon Hencinski @jhencinski]

au·to·di·dact: a self-taught person

Teach yourself infosec!

The guide below from my friend @wifi_ve intends to provide a basic (and generally, free) set of resources for getting started with learning computer security.

https://t.co/8jjM1Ypzcc

[Jon Hencinski @jhencinski]

Anyone have a good experience with a managed vuln management (MVM) provider? If so, who did you use and what did you love about the service?

Also interested in folks that may have had bad MVM experiences. What didn't you get that you were hoping for?

[Jon Hencinski @jhencinski]

Quick 🧵of some of the insights and actions we're sharing with our customers based on Q2 '21 incident data.

TL;DR:
- #BEC in O365 is a huge problem. MFA everywhere, disable legacy protocols.
- We’re 👀 more ransomware attacks. Reduce/control the self-install attack surface.

[Jon Hencinski @jhencinski]

MS Defender for Identity helped us spot #redteam at a customer this week.

Lead: Suspected Kerberos SPN exposure

This was ~20 hours before we had any significant activity from an EDR integration.

Good example of the importance of being able to extend beyond EDR.

[Jon Hencinski @jhencinski]

.@gdead laying down that 🔥🔥🔥auto-tune 🎤🎤🎤 @expel_io company all-hands right now. Yes, this is actually happening.

[Tyler Fornes @tfornez]

The Global Response Team at @expel_io is hiring! If you’re a passionate incident responder or looking to blend in some blue to your red team skills — we’d love to talk to you!

👇Senior D&R Analyst role details:👇
https://t.co/QtFkQy2SMu

[Jon Hencinski @jhencinski]

Stopping REvil before ransom is great, but not why I joined @expel_io

I wanted to translate security events into strategy at scale

No, I don't want to keep sending incidents for <threat>

Instead, any incident is an op to help a customer improve

It's rewarding to 👀 progress:

[Expel @ExpelSecurity]

🎣 Expel for #Phishing 🎣

Your one-stop-shop for suspicious email investigations, featuring:
📜 Detailed findings reports
⚕️ Recommendations & remediation actions
📊 Easy-to-understand metrics & trends

Give the gift of 🕑 back to your #secops team: https://t.co/sZPZIaT1Ec #MDR

[Expel @ExpelSecurity]

"If you’re not using data to spot too much cognitive loading – or finding ways to free up mental capacity – that’s a recipe ripe for burnout 😭."

Tips and insights from @jhencinski & the @expel_io #SOC on metrics/techniques to protect against volatility: https://t.co/5ogCXJFFci

[Jon Hencinski @jhencinski]

If you have a #SOC #QC program be super transparent about the trend.

We wrote a #Slack bot that sends the #QC trend to the team each day. We talk about it. We plan. We adjust.

QC legend:
- 🔴 failed
- 🟢 passed
- ⚫ missed

Visualize. Review. Plan. Improve. Repeat.

[Jon Hencinski @jhencinski]

Come chat with me and the @expel_io team about threat detection and response in #AWS today at 11:00 AM EDT.

Format: Ask us anything! Bring questions. It'll be a conversation.

Sign-up: https://t.co/ez1u0w1AR3

[Anthony Randazzo @amrandazz]

Caveat: This is what we've found useful in our journey to better detect and respond in AWS and might not work for everyone. And yes, I did steal @jhencinski's effective tweet style 😀

Hope this is helpful!

[Tyler Fornes @tfornez]

Love the team, love the culture we built, love the work we are doing. Stoked for what's next 🙌🙌🙌

https://t.co/JG3l53e0lS