Chima.Obim

Security Architect | Cloud Security | I Ensure the Security of Digital Systems’ Data, Network & Communication | i Run @UcytechConsult|ExBanker|ExWarrior

[Chima.Obim @iAm_ChimaUC]

#CyberSecurity

[Chima.Obim @iAm_ChimaUC]

@Chime_Fave This is actually why I don’t like dreads
I automatically see people with dreads as dirty (it may or may not be true) but mehnnn idi dirty biko

[Akwa Ibom 1st Son @ukocarter]

Peter Obi outlines his ideas for every region im Nigeria.

[Chima.Obim @iAm_ChimaUC]

@OHlimitedd @davido Just like your name - truth matters

[Chima.Obim @iAm_ChimaUC]

@BashirAhmaad @davido You got schooled!!!!

[Chima.Obim @iAm_ChimaUC]

@zhurg_ @TheHaleemah @ms_payshee Ooouch that hurts like crazy

[Chima.Obim @iAm_ChimaUC]

@_DebbieOA Na so I been dey fire down till get to Adeola odeku esp when i go to the office on weekends

[Chima.Obim @iAm_ChimaUC]

@the_popemichael @Tocen1010 Na those ones deserve to be kidnapped abi?
What the delegates no gree go nko?

[Chima.Obim @iAm_ChimaUC]

@BADMANGADAn6 @PoliceNG_CRU @abiapolice_NG @TunjiDisu1 @CspIniedu @tony_placid If we tackle this power-intimidation mindset and consistently enforce discipline and sanctions (like we’re starting to see now), real change will come.

[Chima.Obim @iAm_ChimaUC]

@BADMANGADAn6 @PoliceNG_CRU @abiapolice_NG @TunjiDisu1 @CspIniedu @tony_placid Once many Nigerians get into positions of power, the default mode is intimidation and abuse. Add the lack of real discipline, punishment, and proper judicial prosecution, and you see why some officers still misbehave.

[Ridgeline Cyber @RidgelineCyber]

The audit log query that most SOCs have never run:

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in (
"Consent to application",
"User registered security info",
"Admin registered security info",
"Register device")
| summarize Count = count()
by OperationName, bin(TimeGenerated, 1d)
| render timechart

This shows the daily volume of the three most common persistence operations in your Entra ID tenant. MFA registrations, OAuth consent grants, and device registrations — exactly what an attacker does in the first 30 minutes after compromising an identity.

Run it now. Save the baseline.

When the next identity compromise alert fires, you’ll instantly see whether today’s activity is normal… or 4× the daily average.
Without this baseline, every investigation starts with “Is this normal?”
With it, you start with “This is anomalous — let’s move.”

[Ridgeline Cyber @RidgelineCyber]

The detection rule that catches most BEC persistence (most still miss this one):

OfficeActivity
| where TimeGenerated > ago(1h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules", "Set-Mailbox")
| extend Parsed = parse_json(Parameters)
| mv-expand Parsed
| extend ParamName = tostring(https://t.co/NoT29gDyYJ), ParamValue = tostring(Parsed.Value)
| where ParamName in ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress", "DeleteMessage", "MarkAsRead", "MoveToFolder", "Name")
| summarize
RuleActions = make_set(ParamName),
ForwardDest = make_set(iff(ParamName in ("ForwardTo", " RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress"), ParamValue, "")),
RuleName = max( iff(ParamName == "Name", ParamValue, "") ),
ClientIP = max(ClientIP)
by TimeGenerated, UserId, Operation
| where RuleActions has_any ("ForwardTo", "RedirectTo", "ForwardAsAttachmentTo", "ForwardingSmtpAddress")
and (RuleActions has_any ("DeleteMessage", "MarkAsRead", "MoveToFolder") or array_length(ForwardDest) > 0)
// Optional: add your internal domains filter here to eliminate noise
// | where not(ForwardDest has_any ("@example.com", "@yourdomain.com", ...))
| project TimeGenerated, UserId, Operation, RuleName, ForwardDest, RuleActions, ClientIP
| order by TimeGenerated desc

Deploy this as a Sentinel analytics rule.
Run every 15 minutes. Alert on every hit.

This catches end-user inbox rules that forward to external addresses + hide/delete messages — the #1 BEC persistence trick.
(Pro tip: add your internal domains to kill false positives.)

This single rule would have caught the persistence mechanism in the majority of BEC cases we investigated last year.
There are other ways to address this, but the focus is on detection

[Chima.Obim @iAm_ChimaUC]

@triiadxx One thing I don’t understand is why people do this? Like you have an assigned seat why on earth would you take someone else’s seat and be forming agidi? Make it make sense!

[Tom Dörr @tom_doerr]

67 hands-on cybersecurity projects plus certifications

https://t.co/xu93Q5bOoU

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT

most teams building on azure figure out threat detection the hard way

trial and error, custom KQL, dashboards built from nothing, playbooks written by hand

nobody told them it was already done

the sentinel github repo has:

▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources

the hard part was already done

https://t.co/VHbH2pIRRe

[Name cannot be blank @hackSultan]

If you’re vibecoding anything, paste the prompt below In your prompt box and let your agent do a security sweep.

[
You are a senior security engineer and red-team specialist tasked with performing a comprehensive, adversarial security audit of the following codebase, system design, or application.

Your goal is to identify all possible security vulnerabilities, including common, uncommon, and novel attack vectors. Assume the system will be deployed in a hostile environment with motivated attackers.

---

AUDIT SCOPE

Analyze the system across all layers, including:

- Frontend (UI, client logic, browser storage)
- Backend (APIs, business logic, services)
- Authentication and authorization flows
- Database interactions and storage
- Infrastructure and deployment assumptions
- Third-party integrations and dependencies

---
CORE OBJECTIVES

1. Identify critical, high, medium, and low severity vulnerabilities
2. Detect logic flaws, not just known patterns
3. Surface chained attack paths (multi-step exploits)
4. Highlight unknown or unconventional weaknesses
5. Assume attacker creativity beyond standard checklists

---
THREAT MODELING

- Define possible attacker profiles (anonymous user, authenticated user, insider, API consumer)
- Identify entry points and trust boundaries
- Map out sensitive assets (data, tokens, permissions, secrets)

---

VULNERABILITY ANALYSIS

Check for (but do NOT limit yourself to):

### Authentication & Authorization
- Broken auth, weak session management
- Privilege escalation (vertical and horizontal)
- Insecure password reset flows
- Token leakage or reuse

### Input Handling
- Injection attacks (SQL, NoSQL, OS command, template injection)
- XSS (stored, reflected, DOM-based)
- CSRF vulnerabilities
- File upload exploits

### Data Security
- Sensitive data exposure
- Weak encryption or misuse of cryptography
- Hardcoded secrets or keys
- Insecure storage (localStorage, cookies, logs)

### API & Backend Logic
- Broken object-level authorization (IDOR/BOLA)
- Mass assignment vulnerabilities
- Rate limiting issues / brute force risks
- Business logic abuse (race conditions, double spending, bypassing checks)

### Infrastructure & Configuration
- Misconfigured headers (CORS, CSP, HSTS)
- Open ports, debug endpoints, admin panels
- Environment variable leaks
- Cloud/storage misconfigurations

### Dependencies & Supply Chain
- Vulnerable packages
- Unsafe imports or execution
- Malicious dependency risks

---
ADVANCED / UNKNOWN THREATS

Actively attempt to discover:

- Non-obvious logic flaws unique to this system
- Feature abuse scenarios
- State desynchronization issues
- Cache poisoning
- Replay attacks
- Timing attacks
- Multi-step exploit chains combining low-severity issues
- Any behavior that “shouldn’t be possible” but is

---
ADVERSARIAL TESTING MINDSET

- Think like an attacker trying to break assumptions
- Attempt to bypass validations and safeguards
- Manipulate edge cases and unexpected inputs
- Explore how different components interact under stress

--
OUTPUT FORMAT

Provide findings in this structure:

### 1. Vulnerability Summary
- Total issues by severity

### 2. Detailed Findings
For each vulnerability:
- Title
- Severity (Critical / High / Medium / Low)
- Affected component
- Description
- Exploitation scenario (step-by-step)
- Impact
- Recommended fix

### 3. Attack Chains
- Show how multiple minor issues could be combined into a major exploit

### 4. Secure Design Recommendations
- Architectural improvements
- Safer patterns and best practices

---
IMPORTANT INSTRUCTIONS

- Do NOT assume the code is safe
- Do NOT skip analysis due to missing context, infer risks where needed
- Be exhaustive and paranoid in your review
- If unsure, flag it as a potential risk and explain why

]

[Tom Dörr @tom_doerr]

Open-source cybersecurity skills library for AI agents

https://t.co/e4iY76zKIO