Joe Moles

Professional SOC Monkey and herder of cats @redcanaryco, gamer, volunteer firefighter, blah blah wavy hands things and stuff

Opinions are from some monkey

[Red Canary, a Zscaler company @redcanary]

One of the things that makes Blue Mockingbird so interesting is the way it uses the COR_PROFILER environment variable to achieve persistence: https://t.co/8ocDsQ5OUD

[Red Canary, a Zscaler company @redcanary]

We're monitoring a threat we've dubbed "Blue Mockingbird" that is deploying Monero cryptocurrency-mining payloads on Windows machines at multiple organizations. https://t.co/EIkLEu1LuJ

[Red Canary, a Zscaler company @redcanary]

Invoke-AtomicRedTeam started as a framework for executing atomic tests. Now it's much more than that, so we spun it out as its own open source project. Here are some key new features: https://t.co/9jEjTb54T3

[Joe Moles @FlyingMonkey127]

Checkout this great event! https://t.co/KRNLJUahLj

[Joe Moles @FlyingMonkey127]

@subTee Great family party game, I have the base with a couple expansions ;)

[Red Canary, a Zscaler company @redcanary]

Our VP of #securityoperations @FlyingMonkey127 and Twitter #CISO @mikeconvertino will host a conversation over beers and appetizers at Optimism Brewing Company in Seattle on September 19. Register to join us! https://t.co/Bi2RhFtPBq

[Red Canary, a Zscaler company @redcanary]

Join @FlyingMonkey127 and Twitter #CISO @mikeconvertino at Optimism Brewing Company in Seattle on September 19 for a technical discussion on how you can use @MITREattack to improve your #security program: https://t.co/UrGwkKS2G2

[Red Canary, a Zscaler company @redcanary]

The Local Security Authority Subsystem Service (lsass.exe) doesn’t typically spawn other services, so it was particularly suspicious when we recently observed it launching rundll32.exe. https://t.co/6q7ZRYJvel

[Joe Moles @FlyingMonkey127]

@J0hnnyXm4s @CircleCityCon @InfoSecSam Amazing biscuits and gravy and solid burgers

[Tim MalcomVetter @malcomvetter]

@christruncer @kwm @redcanaryco #AchievementUnlocked

[Red Canary, a Zscaler company @redcanary]

Any security team that's working to adopt @MITREattack should consider these four free and compatible tools: https://t.co/2iJ3AKu9Zd

[Tony Lambert @ForensicITGuy]

A good tipoff to Trickbot activity is the use of PowerShell to manipulate Windows Defender. 90% of the times we saw this command in the last 30 days the parent process was malicious:

"powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true"

[Red Canary, a Zscaler company @redcanary]

.@ForensicITGuy recommends some hunts that will help you uncover Rocke-related #cryptojacking activity in your environment. https://t.co/zMByQ7nsfl

[Red Canary, a Zscaler company @redcanary]

As a longtime @CarbonBlack_Inc partner, we're excited to be among the first MDR vendors to deploy CB ThreatHunter to customers: https://t.co/gzpSX0DT2g

[Red Canary, a Zscaler company @redcanary]

JUST RELEASED: Our 2019 Threat Detection Report offers detection strategies for the most prevalent @MITREattack techniques: https://t.co/bZo6jvWKyX

[Joe Moles @FlyingMonkey127]

@rockyd @redcanaryco If you ever want to chat about what we have done, lessons learned, or just compare notes, hit me up with a DM. Building teams and people is a favorite topic of mine.

[Red Canary, a Zscaler company @redcanary]

OSX/Shlayer infections are widespread, and the macOS #malware delivers a couple #adware strains with varying persistence mechanisms that make the threat difficult to mitigate. Here's our guidance: https://t.co/6u5uKe1NGT

[Red Canary, a Zscaler company @redcanary]

What do you do when your adversary uses an ISO disc image file to introduce a malicious binary into your environment? https://t.co/tP2Tj787hF

[SANS Institute @SANSInstitute]

Keisha Levan of @redcanaryco will demonstrate how to optimize team resources, allowing time for more fulfilling and proactive work.

#SANSBlueTeam Summit agenda: https://t.co/8v9sebGjFV

[Red Canary, a Zscaler company @redcanary]

#Security tools—no matter how costly—have limitations. The trick is to compensate for these with controls that reduce the impact of blind spots. @ForensicITGuy on detecting threats with limited data: https://t.co/XBgXSNNXcV