Adam Swan

[Adam Swan @acalarch]

Output redirection from cmd.exe is not captured on the command line unless it is part of an argument (e.g. cmd.exe /c "whoami > out.txt").

So a SIGMA rule like this one will work 60% of the time all the time.

https://t.co/j1uY6Rzibj

[Adam Swan @acalarch]

@vysecurity This is me using a 4k screen at 225% scale lol

[Adam Swan @acalarch]

@ImposeCost You don't have the standard issue lanyard made by SKILCRAFT?

[Adam Swan @acalarch]

@ImposeCost Seems to me that paying some desperate person 10-20k for access must be cheaper (and easier?) than paying for a 0-day.

[Adam Swan @acalarch]

@ImposeCost And make sure you post 6000 times per hour like @imposecost :P

[Adam Swan @acalarch]

@kafkaesqu3 @vysecurity NIST 800-53

[Adam Swan @acalarch]

@kafkaesqu3 @vysecurity Tell that to the auditors :)

[Adam Swan @acalarch]

@kafkaesqu3 @vysecurity In theory, sure. In practice, the vast majority of organizations are understaffed and do not have the time to handle fake incidents.

[Adam Swan @acalarch]

@ImposeCost Targeting of things like critical public infrastructure (to include health infrastructure) via 'cyber weapons' (e.g. ransomware) is IMO terrorism. Those criminals should be getting free red eye flights w/ complimentary pickup.

[Adam Swan @acalarch]

@NathanMcNulty It's on my personal bingo board that the name Entra doesn't survive 2024. Probably will be MActivision Entre by November.

[Adam Swan @acalarch]

@ImposeCost @Waterpik Both methods leave crap behind. I use both.

[Adam Swan @acalarch]

@Cyb3rMonk The deployment of the SIGMA rule

[Adam Swan @acalarch]

@andriinb @cyb3rops To say that a majority of SOC Prime's content comes from the public SIGMA repo is simply fake news.

[Adam Swan @acalarch]

@nas_bench @MITREattack Remove all software from your orgs stack

[President Biden Archived @POTUS46Archive]

Let’s give public school teachers a raise.

[Adam Swan @acalarch]

@anton_chuvakin I think by the time AI is able to replace "Joe Schmo" the economy and cyber ecosystem will look completely different. Jobs that would've been killed.. will already not exist.

[Adam Swan @acalarch]

@anton_chuvakin AI is increasing the overall efficiency of cybersecurity teams which will help fill the massive talent shortage well before it "kills" specific jobs. We will be able to do more with less folks, specific jobs shouldn't be impacted so much.

[Adam Swan @acalarch]

@Antonlovesdnb I would say that it's generally bad hygiene to have the manager & MFA on the same device. More and more password managers are changing the game to "what I have and what I have" instead of what I know and what I have.