Dustin Lee

Husband, dad, intractable at times, flighty at best

[Recon InfoSec @Recon_InfoSec]

Really fun costume theme on this week's #ThursdayDefensive!

Thanks again to @rj_chap for dropping awesome insights on latest ransomware trends and mitigations - watch out for those unauth RMM tools!

Join us next week to hear from defensive pro @therealwlambert!

[Wes Lambert @therealwlambert]

🦖Day 32 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: 'Windows[.]Remediation[.]Sinkhole

Author: @mgreen27

Link: https://t.co/zqJFLiu4WH

[Wes Lambert @therealwlambert]

🦖Day 31 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: 'Linux[.]Sys[.]Services

Link: https://t.co/3deYPrOq1y

[Mark Baggett @MarkBaggett]

Don’t wait for the GIAC Exam or OnDemand. That may never happen. So far no one has signed up! This may be your only chance to take SEC673.

[Phil Plantamura @philplantamura]

Me waiting for next year's @securityonion conference and @BSidesAugusta #SOCAugusta #bsidesaugusta cc:@pmelson

[David J. Bianco @DavidJBianco]

So this just happened... Look at all those lovely #PyramidOfPain tattoos!

[Hal Pomeranz @hal_pomeranz]

Pssst, my Linux Forensics class is now four days long-- two days of new material, labs, and a capstone exercise! And, yes, the update is freely available https://t.co/ATEx5R6sjv

[Doug Burks @dougburks]

Super proud of my amazing team for all the hard work that went into this release!

[Dustin Lee @_dustinlee]

@Etrik2 Congratulations Etrik!! 🎉

[Wes Lambert @therealwlambert]

Want to leverage threat intel from @MISPProject , @alienvault OTX, @abuse_ch , MalwareBazaar and other platforms for enrichment with @securityonion? 🧅🛡️🔍

We can do this with the @elastic's (Filebeat) Threat Intel module and an enrich pipeline/policy👇:

https://t.co/vCVtloYFVv

[BSidesAugusta @BSidesAugusta]

Want to volunteer for #bsidesaugusta 2022 ? Go to https://t.co/HLS33NvaDj and click the "volunteer" link #cyber #infosec #AugustaGA #CSRA #tech #cybersecurity #LoveAugusta #DowntownAugusta #AugustaGeorgia #CyberAugusta

[Wes Lambert @therealwlambert]

With Cases, defenders can:

✅Track investigations, creating cases inside of SOC
✅Escalate events to a new or existing case
✅Add observables or attachments to a case
✅Hunt for IOCs straight from a case

In CASE you were wondering...yes, it's FREE! 🧅🛡️

[Security Onion @securityonion]

ICYMI yesterday we released #SecurityOnion 2.3.100!

This includes our new #CaseManagement interface!

#FreeAndOpen
#infosec
#infosecurity
#dfir
#ThreatHunting
#IncidentResponse
#NetworkSecurityMonitoring
#EnterpriseSecurityMonitoring

[Dustin Lee @_dustinlee]

@fletusposton Also, enabling/configuring Google Inactive Account Manager with a curated list of who to notify may be beneficial.

[Dustin Lee @_dustinlee]

@FixTheExchange 'I re-upped for this!?'

[Brandon DeVault @DeVaultSecurity]

Got quoted in my first online article - pretty cool 😁
https://t.co/EDDXoe7clH
#log4j #log4shell #pluralsight #CyberSecurity #vulnerability

[Dustin Lee @_dustinlee]

Congrats to the rest of the 'CTF 4 antz' team for such an awesome victory in the @SANSNetWars #ServicesCup competition! Back-to-back wins! @ARosenmund @mgstate1 @TerinDelta @NationalGuard @SANSInstitute

[Dustin Lee @_dustinlee]

@Grifter801 @XForceIR @xforcered They're lucky to have you, bud. Congratulations!

[Dustin Lee @_dustinlee]

@FitbitSupport think you can QA/QC the Notification portion of your Android app? Pretty sure those two in the middle are rookie mistakes.

[Wes Lambert @therealwlambert]

Had a great time presenting at the @BlueTeamCon webinar tonight about cloud logging, monitoring, and #securityonion! Thanks to everyone that tuned in! I'll soon be sending out a few tweets about some of the items/tools we discussed. TTFN. #BlueTeam #NSM #DFIR #infosec