Jay

DFIR// Responder of Incidents// Just a human // Views are my own

[Jay @ThatDFIRDude]

Forget all the infosec courses and trainings for right now. I need a training on Excel ASAP 😂

[Jay @ThatDFIRDude]

@tgr_code @_JohnHammond Haha great job!

[Jay @ThatDFIRDude]

@0xTib3rius What time is the Hammond contest? We have a friend that’s getting first place

[Jay @ThatDFIRDude]

Stole a goons lunch money today. When I said I wanted to just see @jaysonstreet today, I didn’t know that was going to turn into a conversation and him giving me this sweet chip! Great meeting you! You made this first defcon experience even better!

[Jay @ThatDFIRDude]

@SecShoggoth You can still get the exploit to work for the creation of a new account, but anything that requires authentication, like the RCE, you need a license to finish setting up the server. At least from what I’ve seen.

[Jay @ThatDFIRDude]

@SecShoggoth This. I’m in the same boat.

[Jay @ThatDFIRDude]

@r00tbsd Excellent work. What was used to dump memory from this device? LiME?

[Jay @ThatDFIRDude]

@vxunderground Hats are always cool. Pullover hoodies are nice too.

[Jay @ThatDFIRDude]

@techxsigil Any luck with parallels? That seems to have much wider ARM support

[Jay @ThatDFIRDude]

My MacBook and VMware users. I seem to be having a hard time finding VMs for analysis that support ARM. So far, remnux doesn’t support it and Ubuntu. Anyone have any recommendations? I’d like to build a Linux VM similar to Remnux and maybe one close to Ubuntu

[Jay @ThatDFIRDude]

For any of us who aren’t Cisco IOS experts, regarding the Cisco IOS XE exploits (CVE-2023-20273 and CVE-2023-20198), what “logs” are you checking to look for suspicious commands being run? @TalosSecurity had a great write up, but I’m wondering what “logs” are reviewed.

[Jay @ThatDFIRDude]

@vxunderground Sickkkkkk. Commenting.

[Jay @ThatDFIRDude]

@reprise_99 @DebugPrivilege More so, root cause analysis. Identifying patient zero, initial access and along the way, get a good understanding of behaviors and IOCs.

[Jay @ThatDFIRDude]

For anyone that works at an MSSP in DFIR. Once you get called to investigate an incident, how do you scope the incident at scale? For example, you analyze 3 systems, identify TTPs and IOCs, how do you then scope what other systems may be impacted.

[Jay @ThatDFIRDude]

Anyone have any recommendation on a good technique or client to view both EML and MSG files? For example, a user provided the above file type, and you want to view what the email looks like, attachments, and header information. Outlook is difficult to setup without an account.

[Jay @ThatDFIRDude]

@JackRhysider @BHinfoSecurity I collect interesting stuff like this to hang in my office. Been a big fan of both BHIS and your podcast for quite a few years! What are the chances I can get you to sign this for it to be forever in my office? DMs are open @JackRhysider 😂

[Jay @ThatDFIRDude]

New blog post is up! Check it out! Straight and to the point of Sysmon and how it’s useful for incident response. #dfir #forensics #incidentresponse #ir #sysmon #microsoft #cyber #cybersecurity

https://t.co/4xPagMKm7x

[BleepingComputer @BleepinComputer]

File sharing site Anonfiles shuts down due to overwhelming abuse - @LawrenceAbrams
https://t.co/uaoW7fqTdh