Djinn

Just another cyber security addict | Incident Responder that thinks like an attacker! | CEH, OSCP, SEC599

[Rasta Mouse @_RastaMouse]

We're excited for this release, there's some seriously cool stuff!

[Djinn @DataJinn]

Lowering rewards due to AI making it easier 🤯

[Google VRP (Google Bug Hunters) @GoogleVRP]

📣📢 Calling all Android and Chrome bug hunters 🧑‍💻🔎!

We're updating our Android & Chrome VRP programs to ensure we can continue to reward the most challenging and impactful vulnerabilities researchers find in our products. For details, 👇

https://t.co/hyZzEIampk

[Djinn @DataJinn]

@Cyb3rMonk Sometimes all it takes is just one hit in your detections to make the difference.

[Djinn @DataJinn]

@Cyb3rMonk Cool, I do agree the OOTB p2 detections are "lacking", curious how you build it. I don't think most companies take the p2 license for these detections but for p2 conditional access engine

[Cobalt Strike @_CobaltStrike]

Never been happier to have a mouse in the house. 🐭
@_RastaMouse of @_ZeroPointSec has officially joined @Fortra! The mind behind Red Team Ops, one of the most respected training courses in offensive security, is now building what's next with us.
Details: https://t.co/cITQF1t9nL

[Djinn @DataJinn]

@Cyb3rMonk Don't forget to blame AI...

[Djinn @DataJinn]

@Cyb3rMonk I keep meeting more and more people with these concerns; while I don't burn my chip on the thought 🤔

[mRr3b00t @UK_Daniel_Card]

security
1. you can't secure something if you don't understand how it works (to a reasonable degree)
2. people like setting rules not following them
3. people like rules for others but not for themselves
4. securing infra is more difficult if it's not been deployed in a 'reasonably safe' state to start with.
5. securing something in use is much harder than doing it in a lab
6. data is like oil, it gets everywhere
7. most security is about good organisation, most people don't like admin work so they tend to not like being organised
8. you can't control everything, you have to understand that 100% security isn't a real thing
9. monitoring costs money and hopefully you never really need to use it
10. if someone is doing response they need authority to take action otherwise you are just watching a car crash and saying: oh dear

[Djinn @DataJinn]

@MarcOverIP Bruh, what the?

[Florian Roth ⚡️ @cyb3rops]

Yea, no

[Mehmet Ergene @Cyb3rMonk]

AI Slop of the week 🫡

Make sure you monitor engagement farmers.

#CyberSecurityAwareness
#CyberSecurity

[Mehmet Ergene @Cyb3rMonk]

🚨 Detect Potential Lateral Movement via ODBC Driver Install over DCOM using Windows Installer Custom Action

The aforementioned registry key is not monitored by MDE, so I developed an alternative detection method based on the simulated attack.

You can copy the query form the ALT text.
#ThreatHunting #DetectionEngineering #KQL

[Dr. Nestori Syynimaa @DrAzureAD]

One of the best sessions I've seen for years! A deep-dive to Entra architecture, high availability, etc. 🤯 Must see for all Entra enthusiasts!

[Print3M @Print3M_]

DLL Sideloading for Initial Access – Red Team Operator's Guide 🔥 (new article)

https://t.co/rXWXasjEQs

- finding software to backdoor
- finding DLL and function to backdoor
- legit software backdooring
- OPSEC considerations

#redteam #infosec #malware #security

[Smukx.E @5mukx]

Reverse engineering undocumented Windows Kernel features to work with the EDR

https://t.co/vGyYzuB9H3

[Djinn @DataJinn]

@Cyb3rMonk Curious what your theory is that may be wrong?My first thought; other certs are getting better and creating a name for themselves -- if competition is upping there game, sans may feel the need for discounts

[Robbe Van den Daele @RobbeVdDaele]

🔎 Detect Direct Send phishing emails

Below you can find a query that can help you find phishing emails being send using #Microsoft Exchange Direct Send.

#Kusto #KQL #DefenderXDR #MicrosoftSentinel

https://t.co/ipCczYheIZ

[Thomas Naunheim @Thomas_Live]

How to hunt sign-ins that bypass #ConditionalAccess 🔐 in #MicrosoftEntra?
💡 Outstanding research by @_dirkjan & @fabian_bader: They published their analysis with identified bypasses of first-party apps and combinations of API and resource combos. 👉 https://t.co/UxMpzYrzje

[Djinn @DataJinn]

@WesSec_ @BertJanCyber Ty tyuuyý okyrre