DFIR Dude

DFIR, IDS, Malware, ...

[DFIR Dude @dfirdude]

@fedpolCH Anstatt dem NCSC melden besser dem Telefonieprovider auf den Sack gehen, weil sie das Spoofing nicht in den Griff kriegen (wollen/können)...

[DFIR Dude @dfirdude]

@PyroTek3 Switzerland

[DFIR Dude @dfirdude]

@fedpolCH Das ist ein Betrugsversuch, aber sicher nicht Phishing. Auf eurer Homepage habt ihr's richtig beschrieben.

[Stephen Sims @Steph3nSims]

I’m going to randomly pick 3 people who retweet this to receive a copy of the book. I’ll tweet out the winners tomorrow. I’ll also be giving away two more copies later this week complements of @RayRedacted! …and maybe a couple more next week just for university students

[DFIR Dude @dfirdude]

@0xc0ffee Der Apfel fällt nicht weit vom Stamm :-D

[DFIR Dude @dfirdude]

@0xtf definitely, yes

[DFIR Dude @dfirdude]

@0xc0ffee shaorma!

[Spamhaus @spamhaus]

It's been precisely 1 month since we last saw activity from #Emotet. Is someone enjoying a long summer vacation, because we are not aware of any co-ordinated take down? #botnet #threatintel

[DFIR Dude @dfirdude]

@c_APT_ure @remid0c @rafi0t @MISPProject if you configure a proxy in splunk (which hast to be reasonably actual), it works OOTB with external MISP instances.

[DFIR Dude @dfirdude]

@ShionaS_Sans Will there be more FOR578 in Europe in 2019 (apart from London in Feb)?

[Peter Czanik @PCzanik]

Last week I gave a talk at #SuriCon2018 about collecting and processing @Suricata_IDS logs using @syslog_ng.

Many of you asked for my #configuration #examples. You can now read a shortened version of my talk together with configs and explanations at:

https://t.co/ygBnidjuRA

[DFIR Dude @dfirdude]

@PCzanik very cool, thanks for sharing! logstash will soon be replaced on my boxes, I guess

[Eric Leblond @Regiteric]

My personal advice, if you panic when reading syslog-ng conf, just look at the one from rsyslog and go back to syslog-ng with a smile :P #badregit

[Suricata IDS/IPS @Suricata_IDS]

#Suricata 4.1 is out with default Rust support, adding SMB, DHCP, TLS 1.3 and many more protocol additions and improvements.

Some other additions: compressed pcap logging, community flow id, new compact DNS EVE format, filestore v2.

Check: https://t.co/gyaO8FODhf #ids #ips

[Amit Serper @0xAmit]

I've never met a single person that enjoys working in an open space office. There are a lot of people (myself included) with mad ADHD who simply can't function in an open space environment. Why do employers keep insisting on having offices without rooms?

[DFIR Dude @dfirdude]

@xme usually the latter, but also depends on context and $delay

[DFIR Dude @dfirdude]

@surveynuts you're being abused for phishing: https://surveynuts[.]com/surveys/take?id=175510&c=2082952697RVND

[The Zeek Network Security Monitor @Zeekurity]

Read more about the renaming: https://t.co/MadmqLzjZm

[DFIR Dude @dfirdude]

@virusbay_io Shirt and stickers arrived yesterday \o/ Thank you!