Chris

Dad, Husband, Nerd

[Chris @chrisdfir]

This is why https://t.co/jAchfX13SI exists.

Trump announced today he won't sign a single bill until the SAVE Act clears the Senate. Whether you support it or oppose it, you need to understand what's in this legislation before it reshapes how Americans vote.

Share it widely.

[Chris @chrisdfir]

Your birth certificate says your maiden name. Your voter registration says your married name. Under the SAVE Act, that could be a problem. Check what you need:
https://t.co/jAchfX13SI

#thesaveact #voting #elections

[Chris @chrisdfir]

Weekend project to make it simple for Americans to know what they need in the event the SAVE Act passes.

https://t.co/d0n3EqvdU1

#thesaveact #democracy #usa

[Chris @chrisdfir]

@j_fishback @ByronDonalds This isn't the flex you think it is Fishback. Show some damn class. We don't need more idiots in Florida, stop acting like one.

[Chris @chrisdfir]

@leantaqueefa @MalwareJake @FBI @FBIDirectorKash Bitch

[Chris @chrisdfir]

"If You Fail to Plan, You Are Planning to Fail" - Benjamin Franklin

https://t.co/PRBGr9VIDg

#savethevotes #thesaveact #democracy

[Chris @chrisdfir]

@FlyTPA How would you even consider enforcing this idiotic control?

[Stephan Berger @malmoeb]

⏳ Time is crucial in Incident Response ⏳

In one incident, the victim engaged Talos IR immediately after discovering malicious activity alerts. Talos IR worked swiftly to combat additional malicious activity and prevented the execution of any encryption in the environment.

Conversely, in a second incident, the victim ignored alerts of malicious activity and did not contact Talos IR until after the ransomware binary began to execute. Talos IR was then not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption.

Full article here: https://t.co/PzQQVlke9P

[Cisco Talos Intelligence Group @TalosSecurity]

Join Cisco Talos Incident Response for an off-the-record briefing on how we tackle threats on the frontlines. Real stories, real lessons. Register now: https://t.co/pcWCf1w2Z1

[Chris @chrisdfir]

@JackRhysider Aircraft have the same encryptors and are loaded with keys for secure comm. I used to load comsec keys on MC -12s in Kandahar.

[Chris @chrisdfir]

@DFIRTraining @CyberCoat

[Chris @chrisdfir]

@CyberRaiju @svch0st @thezedwards @BlackDuckSec @spierenburg Good looking out!

[Cisco Talos Intelligence Group @TalosSecurity]

Cisco Talos Incident Response (Talos IR) recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Read the blog here: https://t.co/dwmemnADLT

[[email protected] / EDRmetry / PurpleLabs @cr0nym]

Just tested Velociraptor Linux.Forensics.ProcFD - very cool outputs include regular files, sockets, device files, and deleted files used by each process. This artifact collects metadata about open file descriptors from active processes on a Linux system.

https://t.co/1DwQCSa6u4

[Chris @chrisdfir]

@cr0nym Thanks for sharing! Glad you found value in the artifact! If you are leveraging Velo for Linux, you may like this bodyfile artifact as well.

https://t.co/zVdFuYWMsf

[Chris @chrisdfir]

The data is in! Take a look at some of the trends we have seen over the last quarter.

#dfir #blueteam #cybersecurity

[Cisco Talos Intelligence Group @TalosSecurity]

The latest quarterly trends report is out now from Talos Incident Response. Credential theft was the main goal in 25% of incidents last quarter, and new ransomware variants made their appearance - read more about the top trends here: https://t.co/z2Dhk6X0JE

[Chris @chrisdfir]

I've recently built a @velocidex #velociraptor VQL artifact to support Linux forensics. This artifact collects metadata about open file descriptors (other files, sockets, etc) from active processes on a Linux system. #dfir

https://t.co/Zl7A7xZLCr

[Cisco Talos Intelligence Group @TalosSecurity]

Talos IR just updated our advice for defending large events. Check out the newest whitepaper, which contains 13 things every organization must consider, whether you're hosting a conference, sporting event, and everything in between! https://t.co/fhJP3H79eg

[Cisco Talos Intelligence Group @TalosSecurity]

In recent investigations, Talos Incident Response has observed the BlackByte ransomware group using techniques that depart from their established tradecraft. Read the full analysis in our latest blog: https://t.co/IayCQYzQzA