Patterson Cake

Husband, Father, Cybersecurity Professional...My opinions are my wife's.

[RedacteCON @redactecon]

Thank you for supporting the CON ~ Black Hills Infosec! @BHinfoSecurity https://t.co/S0TaH0Px3d

[RedacteCON @redactecon]

RedacteCON - Registration and CFP are live! Western Colorado's ONLY Cybersecurity CON (9/19/2026 - Colorado Mesa University): https://t.co/Hu87DVRbX4

[Antisyphon Training @Antisy_Training]

Your AV just flagged PowerShell running on an endpoint.

Totally normal... or is it?

That's the LOLBins problem. Learn to tell the difference with hands-on endpoint threat hunting from Patterson Cake.

Threat Hunting on the Edge · June 19
🔗 https://t.co/Kmz62G0tpe

[Antisyphon Training @Antisy_Training]

Ready to level up your SOC skills? Join us at the Antisyphon Training SOC Summit on March 25!

Kick things off with “Needle Hunting: An Endpoint Investigation Cheat Sheet” with Patterson Cake.

https://t.co/j0X6Dfz2aP

[Antisyphon Training @Antisy_Training]

Our SOC Summit is coming up in March and if you've been itching to learn more about the blue team then come check out over 10+ talks guiding you through the world of Security Operations Centers.

Learn more and join us here: https://t.co/Y9CwDiKA7N

[Patterson Cake @SecureCake]

Want to test/learn/train AI for Incident Response? Need some test data and documented backstory, with IOC cheat sheets? Check it! https://t.co/96wOLEhbzt

[Black Hills Information Security @BHinfoSecurity]

🚨 It’s back! 🚨

The INFOSEC SURVIVAL GUIDE has returned!

Read our FREE Orange Book: Incident Response below or at the link here -- https://t.co/tjjri1e2MY

In the United States?

Get a physical copy shipped to you for FREE -- https://t.co/wDtQkFOIZC

If you loved our Yellow and Green book or it's your first time hearing about our survival guides — now’s your chance. If you didn’t… you already know why this one’s worth grabbing. 🟧💥

[Patterson Cake @SecureCake]

In case you missed it! https://t.co/Rp7By8rkNN

[Black Hills Information Security @BHinfoSecurity]

"When performing Windows endpoint investigations, with a typical average of 200K-500K event log entries per host, we can use Hayabusa to reduce and prioritize our event analysis."
Read more: https://t.co/i1fcB0VB9l

Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1)
by: @securecake
Published: 9/17/2025

[Black Hills Information Security @BHinfoSecurity]

"In part 1, we used Hayabusa to reduce/refine Windows Event Logs from a single endpoint [...] But what if we need to wrangle Windows Event Logs for more than one system?"
Read more: https://t.co/Hz2kmaQBDV

Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2)
by: Patterson Cake
Published: 10/01/2025

[Patterson Cake @SecureCake]

Howdy, friends! Just FYI - I've updated my "Rapid Endpoint Investigations" workflow for the latest version of Velociraptor, as there were some significant changes/updates: https://t.co/WJiyVe5kRP

[Black Hills Information Security @BHinfoSecurity]

**NEW** BHIS | Blog
When investigating a security event on a Windows endpoint, what is your favorite Windows Event ID?

Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2)
by: @securecake
Published: 10/01/2025
Learn more: https://t.co/OFoUsTQfac

[Black Hills Information Security @BHinfoSecurity]

"Although Direct Send is not new, we have seen a recent surge in threat actors abusing it..."
Read more: https://t.co/4rqbE7ayTi

Stop Spoofing Yourself! Disabling M365 Direct Send
by: @securecake
Published: 8/20/2025

[Black Hills Information Security @BHinfoSecurity]

"[...] we’ll discuss how Hayabusa and [...] (SOF-ELK) can help us wrangle EVTX files (Windows Event Log files) for maximum effect during a Windows endpoint investigation!"
Read more: https://t.co/i1fcB0VB9l

Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1)
by: @securecake
Published: 9/17/2025

[Patterson Cake @SecureCake]

@SecurityTrybe Shallow Fake

[Black Hills Information Security @BHinfoSecurity]

Hey folks!

Join us for a free one-hour training session with Antisyphon instructors and AI security researchers Derek Banks and Brian Fehrman on attacking and defending AI systems.

Wednesday, June 4th - 12:00 PM EDT

Register: https://t.co/BYwykBZuh0

[Black Hills Information Security @BHinfoSecurity]

What could an attacker do with access to your AI assistant?

Bronwen Aker joined us for a free one-hour Black Hills Information Security webcast to give us some on security lessons!

We got a hands-on look at how Microsoft Copilot works in business settings, as Bronwen showed how it accesses data and helps with tasks like drafting emails or finding files, which can be useful or risky depending on permissions and context!

Watch it for FREE here - https://t.co/ovfRpKuELv

[Black Hills Information Security @BHinfoSecurity]

You’ve received a “true positive” security alert for a Windows or Linux endpoint. This is not a drill! Your environment is under attack! This is war and you need to take rapid, decisive steps to determine:

Has the endpoint been compromised?
Have other systems been impacted?
What actions should come next?

Patterson Cake will take you through live demonstrations & hands-on labs to help you get through similar IR scenarios with confidence in our next Pay-What-You-Can Workshop: Rapid Endpoint Investigations, live THIS FRIDAY, June 6th.

Register here: https://t.co/ogbXbduYEm

[Patterson Cake @SecureCake]

Had a hard time finding a succinct, detect/respond write-up for SentinelOne Singularity syntax, cheat sheet and queries...so started creating one (definitely WIP!): https://t.co/YvNX0p5A6w

[Patterson Cake @SecureCake]

@levi_reuss Thank you very much, Levi!