Blake

Threat Hunter for Rapid7. Opinions are my own.

[Blake @bmcder02]

@AndrewCGower Hey Andrew! Are there any plans for changeable font sizes? With my eyes, I really struggle reading the professions tab and quest bar without it taking up the whole screen. Especially on the steam deck. Thanks!

[Blake @bmcder02]

If you're hunting for vulnerable XZ instances in Velociraptor:
- For Linux, run the Packages artifact and add `WHERE package =~ "xz"` to the default notebook.
- For MacOS, list the directory `/opt/homebrew/Cellar/xz/5.6.*` for instances where users have to update/upgrade brew.

[Blake @bmcder02]

Forgot to mention this will only work on v0.7.1 onwards, due to the updated ETW library.

[Blake @bmcder02]

Did you know you can use the ETW provider "Microsoft-Windows-DotNETRuntimeRundown" to get a list of loaded .NET Assemblies/Modules/Namespaces?

This can be particularly useful for finding malicious DotNet which has been loaded reflectively, using Assembly.Load().

[Blake @bmcder02]

I've just added a Velociraptor Artifact to query this ETW provider, you can grab it here: https://t.co/6LvBJhGCgO

[Nasreddine Bencherchali @nas_bench]

It's physically impossible to keep up with the research being released nowadays. Basically life becomes a mix of FOMO, Imposter Syndrome and eventual burnout😭

What's the solution you might ask? Welp it turns out, no one is actually keeping up with everything. 😂Everyone is working on their thing, so keep doing yours.

[Florian Roth ⚡️ @cyb3rops]

Hi SIEM vendors,

I've noticed you're using Sigma rules from the community GitHub in your products and calling them "Built-In", but you're not giving credit to the authors. It's a simple thing to do and really important for respecting the open-source community's efforts and the Detection Rule License (DRL).

Please start crediting the authors and respect the DRL.

[Blake @bmcder02]

Have you played around with @velocidex 0.7.1-rc1? With some great features like #sigma integration, I'm excited for the future of Detection Engineering in Velociraptor. Try it out now! 😁

https://t.co/5qsP8NPO7g

[Blake @bmcder02]

@Astrokerrie

[Wes Lambert @therealwlambert]

While there are many great articles that discuss logs to be sent to a SIEM, many don't mention filtering on the endpoint during investigations. This is an area in which @velocidex excels. 🦖🚀 #FastForensicsBeforeFullSendIt #LogManagementMusts #SaveTheSIEM #SplunkCostBoss

[Blake @bmcder02]

If you missed VeloCon23, all talks are available on YouTube and the website.

https://t.co/XGNrUHnqzB

#dfir #cybersecurity #rapid7

[Blake @bmcder02]

@power_napz Leaked audio of me during an incident.

[Blake @bmcder02]

Excited to be speaking at an @ACSnewsfeed event this Tuesday in the #riverina . Great opportunity for local businesses to come ask any Cyber Security incident response questions!
https://t.co/gHvvwRKp93

[Blake @bmcder02]

@reprise_99 Real Word users use it on Server Core. GUI is so lame, omg.

[Blake @bmcder02]

Hi X, it's been a while.
I'm excited to announce that I've joined the @rapid7 @velocidex team, focusing on the open-source build. We've got some exciting things in the works, and can't wait to share them with this amazing community.

[Blake @bmcder02]

@AlanJ_KA7 If I could, I'd join you. I feel like we would look great in matching merch.

[Blake @bmcder02]

@runasand A similar thing happened to my partner. When we got access again, we had to change the email address and phone number to something completely different so they wouldn't be able to use the same logon information to try and reset it.
I hope you get access again soon!

[Blake @bmcder02]

@cyb3rops Building bespoke techniques into your own c2 can be amazing for detection engineering so I can understand the courses. But I'm also of the opinion that offensive tools shouldn't be shared on github, even with the "only for educational purposes" in the readme. 🙄

[Blake @bmcder02]

@nikksterDotTech Create a way for it to slowly transition through all the different themes every 20 minutes. Not only will it allow you to use all your themes, but it'll also provide a great opportunity to gaslight your visitors into wondering if the site was this colour before.