Your AV just flagged PowerShell running on an endpoint.
Totally normal... or is it?
That's the LOLBins problem. Learn to tell the difference with hands-on endpoint threat hunting from Patterson Cake.
Threat Hunting on the Edge · June 19
🔗 https://t.co/Kmz62G0tpe
Ready to level up your SOC skills? Join us at the Antisyphon Training SOC Summit on March 25!
Kick things off with “Needle Hunting: An Endpoint Investigation Cheat Sheet” with Patterson Cake.
https://t.co/j0X6Dfz2aP
Our SOC Summit is coming up in March and if you've been itching to learn more about the blue team then come check out over 10+ talks guiding you through the world of Security Operations Centers.
Learn more and join us here: https://t.co/Y9CwDiKA7N
Want to test/learn/train AI for Incident Response? Need some test data and documented backstory, with IOC cheat sheets? Check it! https://t.co/96wOLEhbzt
🚨 It’s back! 🚨
The INFOSEC SURVIVAL GUIDE has returned!
Read our FREE Orange Book: Incident Response below or at the link here -- https://t.co/tjjri1e2MY
In the United States?
Get a physical copy shipped to you for FREE -- https://t.co/wDtQkFOIZC
If you loved our Yellow and Green book or it's your first time hearing about our survival guides — now’s your chance. If you didn’t… you already know why this one’s worth grabbing. 🟧💥
"When performing Windows endpoint investigations, with a typical average of 200K-500K event log entries per host, we can use Hayabusa to reduce and prioritize our event analysis."
Read more: https://t.co/i1fcB0VB9l
Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1)
by: @securecake
Published: 9/17/2025
"In part 1, we used Hayabusa to reduce/refine Windows Event Logs from a single endpoint [...] But what if we need to wrangle Windows Event Logs for more than one system?"
Read more: https://t.co/Hz2kmaQBDV
Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2)
by: Patterson Cake
Published: 10/01/2025
Howdy, friends! Just FYI - I've updated my "Rapid Endpoint Investigations" workflow for the latest version of Velociraptor, as there were some significant changes/updates: https://t.co/WJiyVe5kRP
**NEW** BHIS | Blog
When investigating a security event on a Windows endpoint, what is your favorite Windows Event ID?
Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2)
by: @securecake
Published: 10/01/2025
Learn more: https://t.co/OFoUsTQfac
"Although Direct Send is not new, we have seen a recent surge in threat actors abusing it..."
Read more: https://t.co/4rqbE7ayTi
Stop Spoofing Yourself! Disabling M365 Direct Send
by: @securecake
Published: 8/20/2025
"[...] we’ll discuss how Hayabusa and [...] (SOF-ELK) can help us wrangle EVTX files (Windows Event Log files) for maximum effect during a Windows endpoint investigation!"
Read more: https://t.co/i1fcB0VB9l
Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1)
by: @securecake
Published: 9/17/2025
Hey folks!
Join us for a free one-hour training session with Antisyphon instructors and AI security researchers Derek Banks and Brian Fehrman on attacking and defending AI systems.
Wednesday, June 4th - 12:00 PM EDT
Register: https://t.co/BYwykBZuh0
What could an attacker do with access to your AI assistant?
Bronwen Aker joined us for a free one-hour Black Hills Information Security webcast to give us some on security lessons!
We got a hands-on look at how Microsoft Copilot works in business settings, as Bronwen showed how it accesses data and helps with tasks like drafting emails or finding files, which can be useful or risky depending on permissions and context!
Watch it for FREE here - https://t.co/ovfRpKuELv
You’ve received a “true positive” security alert for a Windows or Linux endpoint. This is not a drill! Your environment is under attack! This is war and you need to take rapid, decisive steps to determine:
Has the endpoint been compromised?
Have other systems been impacted?
What actions should come next?
Patterson Cake will take you through live demonstrations & hands-on labs to help you get through similar IR scenarios with confidence in our next Pay-What-You-Can Workshop: Rapid Endpoint Investigations, live THIS FRIDAY, June 6th.
Register here: https://t.co/ogbXbduYEm
Had a hard time finding a succinct, detect/respond write-up for SentinelOne Singularity syntax, cheat sheet and queries...so started creating one (definitely WIP!): https://t.co/YvNX0p5A6w