Ankit Bose

[Kr$na @krishdotdev]

Good bye Claude Max, i’m not gonna waste a penny on you anymore.

[SpecterOps @SpecterOps]

Stop asking LLMs to “find vulns.” Start using them to understand code.

@Sw4mp_f0x walks through using Claude Code as a force multiplier in app assessments - faster analysis, fewer false positives, better outcomes.

Check it out: https://t.co/BpMnOGBMv7

[Ryan @Haus3c]

Today I'm happy to announce my newest and most ambitious project - the Azure Threat Research Matrix (ATRM). A similar look to MITRE ATT&CK Enterprise, but the ATRM will cover AzureAD and Azure resource TTPs. Official blog post: https://t.co/zbdHcyKIxH (1/2)

[Wonder of Science @wonderofscience]

A breathtaking eagle's-eye view soaring through snow covered peaks.

Credit: Justin Labattu

[Paul Masek @[email protected] @paul_masek]

#DetectionEngineering #ThreatHunting Huge List O' Resources Incoming \/ \/ \/

SIEM Rulesets (all open and free):
@MITREcorp CAR - https://t.co/mwC8TUqCf6
@splunk - https://t.co/9l4l1kKeCz
@elastic - https://t.co/rLmqeBioHF
@sigma_hq - https://t.co/HRwWX9dr4I

👇🧵

[Chris Sanders 🔎 🧠 @chrissanders88]

One of the bigger initial barriers for newer analysts to break through is understanding exactly where investigative work happens. Much of it happens in the web browser and search engine rather than the SIEM or command line. 1/

[Jack Rhysider 🏴‍☠️ @JackRhysider]

20 lessons learned in my 10 years working as network security engineer. My job was to configure and manage firewalls for customers.

🧵👇

[ɯɹoʇsuoı @ionstorm]

You have Multiple SIEM's, which data model did you choose and why? Every vendor has their own Data model, Splunk CIM, Microsoft ASIM, Elastic ECS, Google UDM, ArcSight CEF, QRadar LEEF, Cloud Information Model (CIM).
Anyone else see a problem here?

[Ankit Bose @ionbasket]

Oh man 😂😂

[Kostas @Kostastsale]

I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅

If you're in #infosec and you feel a little down this week, this video is for you💙

[Eric Capuano - Bsky: @eric.zip @eric_capuano]

👀

https://t.co/0HfmqAWjGu

[Mehmet Ergene @Cyb3rMonk]

New files are being signed with the stolen #NVIDIA certificate. #Lapsus
You can search for the files signed with the stolen cert using the below query in #MDE:
DeviceFileCertificateInfo
| where CertificateSerialNumber == "43BB437D609866286DD839E1D00309F5"
#ThreatHunting #dfir

[Florian Roth ⚡️ @cyb3rops]

That escalated quickly #Lapsus
#Nvidia #LeakedCertificate

Mimikatz
https://t.co/TrY6vL2mEE

KDU
https://t.co/RDf6bnuArk

[Justin Elze @HackingLZ]

Other day I asked for large repos of detection rules here is the running list of responses.

Elastic - https://t.co/OwVwhHU3nZ
Sigma - https://t.co/LygEgGSBeB
Chronicle - https://t.co/4QqDyzJCWC
Splunk - https://t.co/csHzWFCpLE
Falcon Force -https://t.co/9cOd5elj3U

[Picard Tips @PicardTips]

Picard management tip: If you succeed too much and become cocky, recognize it, admit it, and stop it.

[Chris Sanders 🔎 🧠 @chrissanders88]

The most common action an analyst will take is performing a search. Usually in a tool like Security Onion, Splunk, Kibana, and so on. The second most common action an analyst will take is pivoting. That term gets used a lot, but what exactly does it mean? 1/

[haroon meer @haroonmeer]

It would be awesome if Facebook released an official statement thats wildly simplistic:

“Sorry, the disk was full. Arthur deleted some old photos and it looks ok again”

[guccitroll @guccitroII]

rly @opensea
is ur api broken or

[@[email protected] @Nick_Craver]

"How did testing and deployment go?"

[Blue Team Labs Online @BlueLabsOnline]

💰GIVEAWAY!💰 From forensics to hunting, incident response to security ops, are you ready for our labs?

🥇= 6 Months PRO
🥈= 3 Months PRO
🥉= 1 Month PRO

1)👋 Follow Us
2)🔄 Retweet This
3)📢 Winners Announced @ Launch

#dfir #blueteam #soc #infosec #cybersecurity #labs