Brent Murphy

detection engineering @sentinelone | former @todylsecurity @elastic @endgameinc | oscp | cissp | news @blueteamsec1

[Justin Ibarra @br0k3ns0und]

Was chatting with @brent_murphy about detection engineering practices at S1 and it was awesome to hear that they leverage these resources:

⭐️ Axioms of Security and Rule-Based Capabilities

and the

⭐️ Zen of Security Rules

🔗 in 🧵 ��

[Brent Murphy @brent_murphy]

@br0k3ns0und Love those resources!

[SentinelOne @SentinelOne]

🔥 🟣 Purple AI is here and now generally available! To learn more about the industry’s leading AI security analyst, watch the video below.

👉 Ready to transform your security operations? Get a demo: https://t.co/oycBlmEiFL

[Justin Ibarra @br0k3ns0und]

I have been working on a pretty extensive detection engineering series for a while now. I wanted to start sharing some tidbits in the mean time.

Axioms of Security and Rule-Based Capabilities

https://t.co/yiJ4DkMnTD

I use these as a basis of truth for many things #DetectionEngineering

[Brent Murphy @brent_murphy]

Hope this helps!

[Brent Murphy @brent_murphy]

So, you are looking for the #AnyDesk potential compromised signing certificate but do not have the serial number details of the processes in your EDR? What can you do? Well, for #Elastic, follow the thread.

[Brent Murphy @brent_murphy]

At this point, you can create the rule and provide relevant details to affected parties without a lot of noise if you were instead to just by just look at signer subject names in a given time frame.

[Brent Murphy @brent_murphy]

@theITMagician @techspence Todyl

[Brent Murphy @brent_murphy]

@HackingLZ If your vendor taps into the Threat-Intelligence ETW provider, you can grab some of those lower-level API calls and alert on them.

[Brent Murphy @brent_murphy]

@bettersafetynet @todylprotection

[Brent Murphy @brent_murphy]

Check out Part 2 of our blog on #XWorm v4.0 where we break down the .NET Loader https://t.co/g6ZLzMblXG

[Brent Murphy @brent_murphy]

We recently uncovered an attack leveraging the most recent version of #XWorm malware. Check out our blog covering the multiple layers of file #obfuscation and our analysis on how to decode. #DetectionEngineering #FileDeobfuscation #Cybersecurity #Todyl https://t.co/VJJisTzf09

[Brent Murphy @brent_murphy]

@424f424f @ippsec *ML node

[Brent Murphy @brent_murphy]

@424f424f @ippsec Yes with the cloud trial you can do the same. You can even add an additional ML if you want to play with the machine learning jobs.

[Brent Murphy @brent_murphy]

Some external indicators from @GreyNoiseIO as well https://t.co/cpZMisNGIU

[Brent Murphy @brent_murphy]

Tracking the #MOVEit Critical vulnerability, here's a few additional Hunt queries to look for. https://t.co/MEIoJwDEc4

Also, shoutout to @_JohnHammond for his thread and research - https://t.co/Q6ZmVfTx6W

[John Hammond @_JohnHammond]

Okay I'm down a rabbit hole but I'm wracking my brain on this, desperately wanting to figure out how the #MOVEit exploit comes together.

We've got in the known IIS logs a procedure (coming disjointly from different IPs) that hits up
- moveitisapi.dll
- guestaccess.aspx
etc

[Brent Murphy @brent_murphy]

@thewebvy @_JohnHammond thanks, didn't see that one!