Shreyas Parikh

DFIR | Hunting | BlueTeam | Trying to be a decent human being | Mostly tweeting when feeling okay-ish 💜 | All thoughts and opinions expressed here are my own.

[Phill Moore @phillmoore]

Week 20 - 2026 #DFIR
https://t.co/kfs9q8UXfU

[Phill Moore @phillmoore]

Week 19 - 2026 #DFIR
https://t.co/Qsc7015mCP

[Phill Moore @phillmoore]

Week 13 - 2026 #DFIR

https://t.co/LHkgLwyNsi

[Phill Moore @phillmoore]

Week 09 - 2026 #DFIR
https://t.co/TbXF2eUihT

[Phill Moore @phillmoore]

Week 08 - 2026 #DFIR

https://t.co/KgpKqv6mgQ

[Simone Margaritelli @evilsocket]

OpenAI's agentic security researcher Aardvark is now Codex Security, with a new malware analysis pipeline that lets users upload samples, run automated analysis, and pull structured reports.

https://t.co/ntQee7s9aS

[DirectoryRanger @DirectoryRanger]

Entra ID Incident Response: Advanced #PowerShell Techniques #DFIR
https://t.co/2ynit4fyLz

[Terrance DeJesus @_xDeJesus]

While the Notepad++ chaos has been the headline this week, @sysdig dropped some genuinely solid threat research that deserves attention.

They walk through an AWS compromise that starts with exposed credentials in S3, pivots into Lambda, and ultimately escalates into Bedrock access. Public, end-to-end cloud intrusion research like this is still rare, so if you care about #cloudsecurity, don’t sleep on it.

If you’re looking to hunt for similar behavior, this Elastic rule is a good starting point:
https://t.co/haGU6QG7fB

Filter out CloudFormation activity and known hyperscaler ASNs (unless you have reason to believe the attacker is operating from deployed cloud infrastructure). Focus on unexpected Lambda function updates, especially those originating from odd IPs or unfamiliar assumed roles. #threatdetection

Reference: https://t.co/tFxSsiswx5

[Phill Moore @phillmoore]

Week 03 - 2026 #DFIR
https://t.co/InB36IOX58

[Shreyas Parikh @_rigv]

@InsiderPhD @skocherhan Are you changing password from windows/mac system? Because It could be possible that system could be infected with infostealer malware and that malware could be the one sending back the information to attacker.

[Shreyas Parikh @_rigv]

@fr0gger_ What are your thoughts on using Claude skills in parallel to the Claude code plugins? I think it would be beneficial here.

[Shreyas Parikh @_rigv]

@PyroTek3 You can also try @NotebookLM. It will create flow chart, a summary or video based on your likings and can be useful for concise output.

[Phill Moore @phillmoore]

Week 41 - 2025 #DFIR
https://t.co/VeV2VdkbTV

[John Hammond @_JohnHammond]

A threat actor installed Huntress.

... a hysterical mistake on their part, giving us first-hand insight to their tooling, workflow & routine. Phishing infra, stealer logs, Telegram+dark web sites, AI...

Hilarious goldmine of cybercrime deets with a front row seat: https://t.co/2gLT2VNDkO

[Dr. Anton Chuvakin @anton_chuvakin]

"Security and The 7 Deadly Sins" https://t.co/HqdPCCwU6W <- an absolutely epic piece from @philvenables

[Shreyas Parikh @_rigv]

@Gi7w0rm Hey! Congratulations for everything! You deserved it.

[Yamato Security Tools @SecurityYamato]

Sneak preview of the Hayabusa MCP server.

[Germán Fernández @1ZRR4H]

🔴 Website netextender-sonicwall[.]org downloads "NetExtender-VPN-10.3.3.msi" signed by "MOHAN ENTERPRISES (RAJASTHAN) PVT LTD" 🤔

▪ The fraudulent domain is powered by Bing and Copilot results, giving it visibility and "credibility" ❌

Previously, this campaign was delivering Bumblebee (https://t.co/ZhSvHZ3qtV) and was spotted by @TheDFIRReport leading to #AdaptixC2 and #Akira ransomware: https://t.co/fgVgSAaWln.

[+] Sample: https://t.co/z7J5trx4Jq.

/ @malwrhunterteam @k3yp0d

[Phill Moore @phillmoore]

Week 34 - 2025 #DFIR
https://t.co/HUUerBrACW

[Julian Cohen @HockeyInJune]

A security program in one tweet.