Josh Buck-Rogers

Security Engineer, Interested in DevOps, crap at woodwork.

Views are my own and all that jazz.

[Josh Buck-Rogers @_coeus]

@based_hardware 👍

[Omi AI @omidotme]

Introducing Friend. Watch the demo.

[Josh Buck-Rogers @_coeus]

@binaryz0ne On a budget end - currently running an elite desk 800g3 & truenas. Under £100 from the chassis, then cost of drives

[Will @BushidoToken]

I am excited to introduce a new comprehensive CTI training repository - find it here:

https://t.co/RWK4BVjiM7

#CTI #threatintel #training

[Kostas @Kostastsale]

Check out this awesome report by Sophos on Chinese APT threat actors. There is much to learn from this technical breakdown; it's not your ordinary threat actor.

Reading this report, you will notice that they used tools like impacket for lateral movement, which provides an opportunity for detection.

➡️Interesting use of Living-Off-the-Land binaries that I personally haven't seen before - instsrv.exe and srvany.exe.
➡️Multiple defense evasion methods to hide their tracks and evade detection, including a clever way to read DNS traffic and block AV/EDR-related domains. (but still uses impacket 🤷‍♂️🤦‍♂️)
➡️Interesting choice of data being staged for exfiltration.

Overall, this prolonged intrusion had everything, and the authors did an incredible job of laying out all the details for the rest of the community. 🙏👏

Check it out here 🔗: https://t.co/1ZieUUd6w2

[Josh Buck-Rogers @_coeus]

Awesome end to the evening at #emfcamp

[Cado @CadoSecurity]

Cado Security is honored to be named in the Gartner® Emerging Tech: Emergence Cycle for Cloud Security as a Sample Vendor for Cloud Forensics

Download a free copy of the report here: https://t.co/fZDMD2nPTM

[Gerald Auger, Ph.D. @Gerald_Auger]

@eric_capuano made a great beginner lab to learn Prefetch Analysis for #DFIR work.

I made a simple walkthrough video showing you how to setup the lab and get started, so no need to feel overwhelmed.

Get in there and start learning!

https://t.co/7t1tQHxNG3

[Alkoholfreiday @Alkoholfreiday]

Here we go!!!! #Freiday #giveaway once again!!!!
Simply repost for your chance to #win!!!
Winner announced at 5pm(ish) today - GOOD LUCK!!!

[Whitney Champion 🍪🚀 bluesky @whit.zip @shortxstack]

ATTN NERDS 🤓

this week we released our new @limacharlieio plaso extension! 🔥

it will take a forensic artifact from an endpoint, or a zip of artifacts (like a KAPE triage from the @velocidex extension) and make a timeline of the data that can be imported into @TimesketchProj

[Traceix @usetraceix]

@jonathandata1 Who are you?

[Josh Buck-Rogers @_coeus]

@James_M_South 3 body problem on Netflix!

[Mark Karayan @Mgkarayan]

In 2014, @JohnHultquist named a Russian hacking group "Sandworm".

Today, Mandiant graduates it to APT44 & reveals the online persona they created, CyberArmyofRussia, disrupted U.S. and Polish water utilities, as well as a dam in France.

Full report: https://t.co/VnECP2GGgz

[Warhammer Official @warhammer]

@Idk721252 Since the first of the Ten Thousand were created, there have always been female Custodians.

[Josh Buck-Rogers @_coeus]

@svch0st Keen to try out the icedid case!

[Zach @svch0st]

🎁 Today I'm giving away 3 of our DFIR Labs! 🎁

To enter:
✅Follow me
✅RT & Like this post
✅Reply with which case you'd like to take

The winners will be selected in 24 hours. #Giveaway

[Josh Buck-Rogers @_coeus]

@tazwake I'd lean benign true positive, but I accept that it's not the most ideal detection.

As a detection engineer I'd be looking to tweak the detection somewhat to reduce this from firing in this scenario.

[Josh Buck-Rogers @_coeus]

@James_M_South Absolutely terrible take from him. Keep up the grand work - you're absolutely smashing it!

[PentesterLab @PentesterLab]

We would like to welcome our new team member: Jia Tan!

Jia will work on a set of challenges for our "Supply Chain" badge!!

[Andy Gill @ZephrFish]

Very interesting thread by @thegrugq