@blu3_team

Defender, enthusiast, finder of bad things. Opinions are my own and not those of my employer.

[@blu3_team @blu3_team]

Another method of C2 detection using Splunk with rare domain and PC counts.

https://t.co/dGTkNmRPFp

[@blu3_team @blu3_team]

@IAPonomarenko What is the black stuff on the eggs? Almost looks like Caviar. Never tried that.

[@blu3_team @blu3_team]

@HackingDave Try a steamerpot

[@blu3_team @blu3_team]

@SwiftOnSecurity Exactly right. I have complaints about not enough coverage, too many false positives, and increased risk of tuning all at the same time. If you want perfect security you can't be in this field.

[@blu3_team @blu3_team]

@mtaibbi We planned it all out and nothing went to plan. A wonderful journey, love and pain. That may have been the best of me, we'll see.

[@blu3_team @blu3_team]

@NataliaAntonova You look wonderful, confident, and ready to take on the world. I can't understand why someone wouldn't start with that.

[@blu3_team @blu3_team]

@EricaZelic You're doing great, hang in there.

[@blu3_team @blu3_team]

@HackingDave I have a son that has surpassed me in several ways. You are doing a good job, we can only hope our children are better than we are.

[@blu3_team @blu3_team]

IOCs are backward looking indicators. They have their place but don't bet the farm on them. Behavioral TTPs age out much more slowly.

[@blu3_team @blu3_team]

@floesen_ Event log of death, nice

[@blu3_team @blu3_team]

@PyroTek3 My condolences Sean, these things are tough.

[@blu3_team @blu3_team]

@ateixei It solves a lot of problems

[@blu3_team @blu3_team]

@malcomvetter @ImposeCost I think the only sig we have without filters is "process call create"

[@blu3_team @blu3_team]

@malcomvetter @ImposeCost Not sure I agree, signature feeds are commodity but generally not modifiable. To be used they need to be reviewed, filtered for your organization, and put into local prod detection. Basically, writing your own from a template of existing sigs at the least.

[@blu3_team @blu3_team]

@wdormann Will, you are the Rocky Balboa chasing after these things, you never stop. Respect.

[@blu3_team @blu3_team]

@Pete1250Pete @Saturnax1 @USNavy @CovertShores @TayfunOzberk @FORONAVAL @SubBrief @TheSubHunter1 @USN_Submariner @wachteldean54LV @BobKoonce @KnappJW @LGoessing The 16 inch had a huge boom and heat blast that shocked the senses. The 5 inch was sharper and louder, especially below decks, impossible to sleep during firing exercises. They tricked a reporter one time to stand nearthe the ciws during firing, I don't think he got a good shot.

[@blu3_team @blu3_team]

@Saturnax1 @USNavy @CovertShores @TayfunOzberk @FORONAVAL @SubBrief @TheSubHunter1 @USN_Submariner @wachteldean54LV @BobKoonce @KnappJW @LGoessing Last crew of the battleship decommissioned February 1991, picture is up on my wall. Great ship, great crew, lots of history. Thanks for sharing.

[@blu3_team @blu3_team]

@cyb3rops Reg save Sam isn't an fp but there might be a legit reason for running it. Just have to find that out. I don't use filters on that sig.

[@blu3_team @blu3_team]

@TRowePrice @SenWarren, how much money does @TRowePrice have tied up in estate accts bcs they won't provide standard forms? Easy fix trowe, create the ira beneficiary disclaimer form.

[@blu3_team @blu3_team]

@TRowePrice Zero help there. Trowe asks for specific text for ira Benificiary disclaimer text but will not provide the form, medallion holders won't stamp diy forms which is trowe guidance. No way to escalate, @TRowePrice keeps the money. How many customers are trapped like this?

[@blu3_team @blu3_team]

@ateixei It can be abused like this https://t.co/hEZmCCgkZy