Anthony Randazzo

Detection engineering @datadoghq. Interested in ☁️ threats. Prev @expelsecurity and @mandiant intel. LEGO enthusiast. Never finding good bourbon. Opinions mine.

[Anthony Randazzo @amrandazz]

We were trying to conceptualize the "current state" of cloud [native] threat detection and this is what we sorta came up with. Sharing it more broadly in case others find it useful in organizing your cloud detection & response approach 🔎

[Anthony Randazzo @amrandazz]

We've shared our analysis of the axios supply-chain compromise with full detail on the initial package to the second stage on each platform's RAT capability. This was clearly intended to compromise the developer environment. More amazing work by the team.

https://t.co/R8c2MgDnUW

[Robert Knapp @power_napz]

This is how it’s supposed to work. This is how everyone levels up while protecting more people/orgs in parallel. More vendors should seek to mimic this type of collaboration.

We’re all on the same team…unless you only look at Security as a business, but that’s another tweet :)

[Anthony Randazzo @amrandazz]

@oinstakeu You know he will for 30 seconds

[Anthony Randazzo @amrandazz]

Our Q1 Threat Roundup is out! Nice work by the team as always!

https://t.co/j7ezuotXb6

[Anthony Randazzo @amrandazz]

Great writeup on a couple new persistence mechanisms the team saw recently ultimately resulting in SES abuse for phishing.

https://t.co/CqrbBvyRUi

[Anthony Randazzo @amrandazz]

Another amazing aggregation of annual cloud security statistics from the team here at @datadoghq

https://t.co/VXvIYlMyDU

[Anthony Randazzo @amrandazz]

Great post by @JulieASparks and team on the recent happenings with Snowflake
https://t.co/da2oi88Ozf

[Nick Frichette @Frichette_n]

Today is an interesting day! I read a report about a threat actor, and for once I'm impressed! This is the first I can remember in which a TA has displayed NEW tradecraft, before researchers have shared it widely. Let's review in this 🧵
https://t.co/CA4TwJam7g

[Anthony Randazzo @amrandazz]

And if you find this interesting, we're hiring in the US but especially in EMEA!

https://t.co/NW7K9FAWxP

[Anthony Randazzo @amrandazz]

Our amazing team found some interesting new ☁️ threat actor techniques. Give it a read!

https://t.co/zBCof9PBpH

[Anthony Randazzo @amrandazz]

@daycyberwox As someone who grew up around breeding horses and stabling them, pick horses only if you like to hemorrhage money. Owning a boat might be the only more expensive hobby.

[Anthony Randazzo @amrandazz]

Exploiting Windows pods in kubernetes? ✅ More awesome work from the team here at @datadoghq

https://t.co/6unur8uhvr

[Anthony Randazzo @amrandazz]

Great write up by the team on some of the hunting pivots we're doing to find evil in AWS!

[Christophe Tafani-Dereeper @christophetd]

We've released a new post detailing a threat hunting methodology in AWS CloudTrail, as well as some findings about real attacker activity we've seen in the wild - including the most common enumeration calls

https://t.co/Ua4VdjQrgh

AWS CloudTrail Lake SQL queries included!

[Christophe Tafani-Dereeper @christophetd]

Datadog's security team has just released KubeHound, an open-source attack mapping tool for Kubernetes clusters

https://t.co/1NaHHIfznN

https://t.co/rwWQFHY4kT

Comes with 25 attack types, each one comes with step by step instructions of how to exploit it

[DAY JOHNSON⚡️ @daycyberwox]

Come join my team - you'll get to work with the cool kids @techyteachme @amrandazz, several others & yours truly :)

If you're interested in researching threats, hunting, detection engineering, cloud security and helping build our Cloud SIEM product then this role might be for you.

Happy to answer any questions.

SN: The role is for EMEA folks (see listed locations in req below)

👉🏽https://t.co/GCNbOEk17q

[Christophe Tafani-Dereeper @christophetd]

Want to simulate cloud ransomware in your AWS account?

Stratus Red Team now supports 3 attack techniques to emulate S3 ransomware!

• S3 Ransomware through individual file deletion
• S3 Ransomware through batch file deletion
• S3 Ransomware through client-side encryption

🧵

[Anthony Randazzo @amrandazz]

Very cool e2e threat emulation that the team built to test relevant #atomicredteam cloud workload techniques with a hook into Datadog platform

https://t.co/BFy7dXiwWD

[Anthony Randazzo @amrandazz]

@cyberfooty Hi! We actually just filled one of these roles in US but we may have more next year!

[Anthony Randazzo @amrandazz]

For my cloudsec folks in EU TZ, we’ve got some new reqs to continue building great security detections in our security platform! Preference for Paris, Lisbon, Madrid, and Tel Aviv office locales but can always make an exception for exceptional talent.

https://t.co/huIGkBcWjG

[Anthony Randazzo @amrandazz]

Awesome PM role responsible for all things cloud threats on our Cloud Security Management platform!

https://t.co/qL6FDbhg62