Kurtis Armour

My words are my own and do not necessarily represent those of my employer.

[Kurtis Armour @S3Ns3]

@TheEldon You know what they say about the 30 under 30....

[Kurtis Armour @S3Ns3]

@obilodeau @NorthSec_io I'm not making NSec this year but hope to see you at RSA!

[Christopher Peacock @SecurePeacock]

Reminder: "Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications."
https://t.co/KjBQAYS1To

[Kurtis Armour @S3Ns3]

@SeanBlenkhorn @JimmyVo Legend

[eSentire @eSentire]

In our latest #TRUPositive, our TRU team discovered a #SolarMarker infection delivered through poisoned search engine results.

The SolarMarker installer file was manipulated to look like a manager evaluation form.

Learn more about SolarMarker here ⬇️ https://t.co/eFBoE7IFA7

[NorthSec @NorthSec_io]

#nsec19 talk: @S3Ns3 & Jacob Grant – Threat hunting in the cloud https://t.co/XoLmkJVj1N

[Cody Thomas @its_a_feature_]

Stealing Tickets from MacOS: How Kirby traverses Heimdal's Bifrost to cross from Darwin to Windows Kerberos Authentication.

Blog: https://t.co/ObimHYqFQ4

Tool: https://t.co/JWtkh49Uyk

[Nick Carr @ItsReallyNick]

🤙💰 Mahalo FIN7: https://t.co/5UEZFiB9un
• On several on-going investigations we saw #FIN7 trying to retool 🏄🏼
• Used DLL search order hijacking of a legit POS management utility with a signed backdoor (0 detections on VirusTotal)
• Hunting for #BOOSTWRITE and #RDFSNIFFER 💳

[Bobby Filar @filar]

About to give my talk at #VB2019 on using ML and graph theory to identify malicious process chains in event data. Slides here:

https://t.co/M2bUZxikQu

[Vincent Yiu @vysecurity]

OK, best payload initiation vectors. Eg. DOC Macro, Excel Macro, HTA, VBS, JS, SLK, What else...?

[monoxgas @monoxgas]

Want to see us steal @proofpoint 's email scoring model? Need to know what words to use in a phishing link? Or how to classify a sandbox with an ANN? Check out our talk, slides and code below :) Also included are our thoughts on the future of attack graph theory.

[Kurtis Armour @S3Ns3]

@obilodeau @BSIdesStJohns Beauty pics

[Botconf @Botconf]

First notifications to speakers for #Botconf2019 were sent today ... we will start publishing our selection tomorrow and open early bird registrations before Sunday ... Stay tuned !

[Kurtis Armour @S3Ns3]

@cobsalad22 and I are on a speaker tour this fall. If you want to learn about active threat detection within cloud service providers check us out at these conferences! Come see a technical presentation without any vendor pitching!
CyberCityConf - October 1st
Sector - October 9th

[Kurtis Armour @S3Ns3]

@MasarahClouston Sector!!! For sure

[Ryan Cobb @cobbr_io]

I’m very excited to share that Covenant v0.3 is out today! Includes a brand new web-based interface. Blog below with details 🙂

[blog] Covenant: The Usability Update
https://t.co/ShVvMHDm3r

[Ryan Cobb @cobbr_io]

New update for SharpSploit just landed in master! Huge shoutout to @TheRealWover, @den_n1s, and @_RastaMouse for adding awesome new GPO enumeration functions, persistence functions, and Dynamic Invocation for calling unmanaged code w/o P/Invoke.
https://t.co/hZc0cjG5tc

[Matt Hand @matterpreter]

Dropping 8 new C# tools I’ve been working on for a little while. Really enjoyed writing these and I plan to continue adding to the repo. https://t.co/ZHDnBntuuL

[Kerry Bailey @kbailey]

What a great day at @eSentire! A brand new HQ for our family. So much pride in the air. Love being in @citywaterloo.