Neil Cor

[Neil Cor @TrappedSheep]

@atc_project @MITREattack @TheHive_Project Excellent product. Thank you

[Atomic Threat Coverage @atc_project]

RE&CT framework released!

A knowledge base of actionable Incident Response techniques, based on @MITREattack philosophy.
Mapping to ATT&CK / AMITT, export to @TheHive_Project templates, visualization in the Navigator, and more!

https://t.co/RTHfhqCgi1

#incidentresponse #dfir

[Florian Roth ⚡️ @cyb3rops]

I almost missed to celebrate my 10,000th handwritten YARA rule 🎉

I'm not very proud of the early ones. But being ashamed of old rules (or code) that you wrote months or years ago means that you've improved and that is definitely a good thing, isn't it? 🖖

[ATT&CK @MITREattack]

In case you didn't catch it, we updated the ATT&CK Design and Philosophy paper last week. Details on sub-techniques, what ATT&CK coverage means, and a few more useful tidbits were added! https://t.co/EPE6rjYvDY

[Neil Cor @TrappedSheep]

@MITREattack @stromcoffee

[Atomic Threat Coverage @atc_project]

Kudos to @MITREattack for mentioning our project together with @Cyb3rWard0g's @HunterPlaybook in their new CTI training!

Check it out: https://t.co/Q3Uig0lHyZ

#dfir #cti

[Neil Cor @TrappedSheep]

@1lung_nick @AnfieldWatch @samalder01 Thats is quality

[Neil Cor @TrappedSheep]

@1lung_nick @LfckevO Cant think of a better way to win it

[Anton @Antonlovesdnb]

A lot of mud slinging on InfoSec twitter lately; I wanted to flip the script a bit and highlight the blogs, tools, talks etc that I keep coming back to on a regular basis, both as a defender and general InfoSec professional. Thread..

[Florian Roth ⚡️ @cyb3rops]

Sigma2Attack
generates #MITRE ATT&CK navigator heat maps from a set of #sigma rules
by @christophetd

Pull Request - already merged into master
https://t.co/X5lUQFI47D

ATT&CK Navigator
https://t.co/0cwq8gH6CX

[Florian Roth ⚡️ @cyb3rops]

We put a lot of effort in the creation of anomaly detection rules for our scanner

Example:
1. Report mentions adversary exfiltrating ntds.dit in RAR archive
2. Create such an archive
3. Open in hex editor
4. Write YARA rule

I'll put this one in the signature-base repo for LOKI

[Neil Cor @TrappedSheep]

@MISPProject @FIRSTdotOrg @circl_lu @C3_Luxembourg Thanks. I will keep an eye out for any future conferences or training.

[Craig Chamberlain @randomuserid]

Added 63 threat hunting searches for Windows events. New total is 152 Windows searches & rules. And 35 for Linux (more to come)
https://t.co/w8J73zwK69

[NCSC UK @NCSC]

Lets make peace with pasting passwords...
https://t.co/llQuha05Ch

[Neil Cor @TrappedSheep]

@chaoaretasty @troyhunt @haveibeenpwned Fair one. Its hard to differentiate ignorance from sarcasm on this media at times.

[James Corden @JKCorden]

Oh my god. This is just sensational. Please watch and retweet.

[Neil Cor @TrappedSheep]

Be interested to read your thoughts on this @tanium https://t.co/9ERgpvd6HZ

[Florian Roth ⚡️ @cyb3rops]

Stringless YARA Rules
> a guide to build faster YARA rules by @InQuest
https://t.co/4cnFzDB1Of

The most common performance sin:
$h = "MZ"
condition: $h at 0 ...

Also see my YARA Performance Guidelines
https://t.co/nsZkgTTxLk