.dzeko

whoami: IT Security Analyst - SOC - Blue Team | location: Behind the Iron Curtain | legal: All Thoughts my own

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: ServiceNow has been breached. Customers are reporting unauthorised access to their instances.

One customer states their security team reported this vulnerability to them, and they closed the case twice, saying they had already known since the 7th of April.

[Allen Braden @allen_explains]

This 2-hour Stanford lecture breaks down how models like ChatGPT and Claude are actually built, clearer than what many people in top AI roles ever get exposed to.

Save this and set aside two hours today. It might end up being the most valuable thing you learn all week.

[Aviram Jenik @aviramj]

Hot take: the cybersecurity industry is losing its institutional memory.

The OG hackers - the ones who figured this stuff out before there were playbooks - are aging out. And most of their knowledge is not being captured.

What they learned by breaking things in the 90s and early 2000s is still more relevant than half the threat intel reports being published today.

We need more stages, more mentorship, more intentional knowledge transfer. Before that generation is gone.

[Vaishnavi @_vmlops]

GOOGLE BUILT A SECRET WEAPON FOR FILE DETECTION

they ran it internally for years, gmail, drive, safe browsing, hundreds of billions of files every week

then they open sourced it

it's called magika and it exposes what files really are, not what they pretend to be

rename malware to "resume.pdf"? magika sees through it
disguise a script as an image? magika sees through it
any trick attackers use with file extensions? magika sees through all of it

ai trained on 100 million files. 200+ content types. 99% accuracy. 5ms per file

one command
`pip install magika`

the same tool protecting google's billion users is now protecting yours

https://t.co/Jr3LjmQobq

[Jamieson O'Reilly @theonejvo]

I'm a hacker and for 15 years I've worked on the offensive side - which is why this is not coming from a defensive frame of mind/opinion.

I'm watching my own community (cybersecurity) laugh at AI slop while completely missing the point.

Yeah, there will be mistakes. New vulnerabilities. That's what happens with any new tech. But security people sitting on the sidelines saying "ha ha look at that garbage" think they're being smart when they're actually getting left behind.

You can't just point fingers anymore. If you're too busy mocking AI to learn how to work with it, you'll get replaced by a sixty-dollar Anthropic subscription.

The acceleration is real. Your "sorry I'm on the spectrum" excuses won't save your job.

[Graham Helton (too much for zblock) @GrahamHelton3]

Excited to disclose my research allowing RCE in Kubernetes

It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.

Unfortunately, this will NOT be patched.

[Uriel Kosayev @UrielKosayev]

🚀 It’s official — my new book is live on Amazon:
MAoS – Malware Analysis on Steroids

This book is not like the others. It’s built on years of raw, hands-on research, reverse engineering sessions at 3 AM, and real-world incident response cases.

Inside, you’ll find full A–Z dissections of malware: loaders, persistence tricks, obfuscation layers, evasive logic, and more. It’s written for analysts, red teamers, defenders, SOC teams, and anyone who wants to think like an attacker in order to act like a defender.

This isn’t a theory book. This is malware analysis on steroids.

👉 Get your copy here: https://t.co/2SI2dw87g7

#CyberSecurity #MalwareAnalysis #ReverseEngineering #Infosec #MAoS #TrainSec #OffensiveSecurity #Malware

[Tib3rius @0xTib3rius]

Cloudflare is a huge MiTM attack.

Its honestly somewhat concerning how much damage a breach at Cloudflare could do.

[John Hammond @_JohnHammond]

A threat actor installed Huntress.

... a hysterical mistake on their part, giving us first-hand insight to their tooling, workflow & routine. Phishing infra, stealer logs, Telegram+dark web sites, AI...

Hilarious goldmine of cybercrime deets with a front row seat: https://t.co/2gLT2VNDkO

[Cookie Connoisseur @browsercookies]

How do you catch a DPRK actor you ask? Here are a few things to think about;

1. They love to use a VPN when applying for jobs. Check your HR system.

[Jack Rhysider 🏴‍☠️ @JackRhysider]

"Our network security AI tool was trained using your network. That's why it sucks."

[Greg Kutzbach, CISSP @dasgrog]

EntraID, in one diagram.

(Note, not perfectly updated. Some complexity not shown)

[Nicklas Halme @NicklasHalme]

Excellent picture from https://t.co/FRxVmtdaS6 by Michael Hildebrand

[Florian Roth ⚡️ @cyb3rops]

Ever wonder why people in 2024 still use on-prem services? It's simple: someone who generated a rogue <token> can't access your confidential files, emails, contacts, internal services, or machines from anywhere in the world
#DuckingTokens

[Stephan Berger @malmoeb]

During a recent Incident Response case, it was evident that the attacker disabled Defender on various hosts during a timeframe of a few hours.

Would you detect such behavior in your environment? Do you monitor for AV disabling and, on top of that, monitor for a threshold of systems left unprotected within a certain period?

Windows Defender creates the EventID 5001 = "Real-time protection is disabled."

https://t.co/bIlUUusb9m

[Clandestine @akaclandestine]

GitHub - a13xp0p0v/kernel-hardening-checker: A tool for checking the security hardening options of the Linux kernel https://t.co/KS3Y4qAXHn

[Fabian Bader @fabian_bader]

You are not affected by the current #CrowdStrike outage? Great, so you got time.

You use #MDE?
Then better have a look at the gradual rollout process for Microsoft Defender to avoid this in the future in your environment.

https://t.co/1yEw7JBOAE

[myexploit2600 @myexploit2600]

My notes from labbing AD Certificate Service exploitation.

There’s lots of great resources on this but I wanted to share my walkthrough on how to create a vulnerable certificate, common errors and how to exploit using either Certipy or Certify.

https://t.co/kelGFnEMCr

[Clandestine @akaclandestine]

GitHub - decalage2/awesome-security-hardening: A collection of awesome security hardening guides, tools and other resources https://t.co/o9YNeLuGWO

[Clandestine @akaclandestine]

GitHub - bluscreenofjeff/Red-Team-Infrastructure-Wiki: Wiki to collect Red Team infrastructure hardening resources https://t.co/rEyYON79Zm