Jan Andrasko

Security Professional and SOC manager at

[Matt Zorich @reprise_99]

My friends at @MicrosoftPress have given me a couple of copies of the eBook for The Definitive Guide to KQL to give away. Retweet or comment below and I will put you in the draw. To give everyone a chance, I will give it 48 hours and then draw two winners. https://t.co/ne19KZTytZ

[Ťažký týždeň @TazkyTyzden]

Ultimate compilation.

[Bad Cyber @badcybercom]

Dieselgate, but for trains - some heavyweight hardware hacking.

https://t.co/cUiuABYXks

Story about trains that broke down and analysis that discovered it was not a coincidence.

[Aura @SecurityAura]

You know why the ransomware attack goes through anyway?

Nobody look at the console.
Bad assessment of the alerts that were raised by the humans behind it.
Key impacted assets didn't have the EDR on it.
EDR was running OOTB config.

Everyone who worked ransomware IR knows it.

[blueteam0ps @blueteam0ps_]

My latest contribution to the community :) Log exports from M365 as part of adversary simulation activities. Currently there are 20 samples, but that will increase overtime. #detectionengineering #threatdetection https://t.co/iA5R4etFxN

[Jan Andrasko @JanAndrasko]

Great analogy

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

You *can* win at defense in cyber security.

Many orgs tell you that if an attacker lands on a system, or takes over a single account, that you've "failed"

That's simply not true.

If you believe you have to be perfect to win, buckle up... this is the thread for you!

1

[TryHackMe @tryhackme]

TryHackMe has just reached two million users! 🎉

📣 To celebrate two million of us, we’re giving away NEW limited-edition t-shirts and annual subscriptions. Like and retweet!

It's a huge milestone for us, and we wouldn’t be here without you!

🔗 https://t.co/F8BkTuLpGU

[Jan Andrasko @JanAndrasko]

@trizzo_sk @jhencinski https://t.co/u59zlRlMoP this is a good starter, AAD admin activity is what you are looking for

[Jan Andrasko @JanAndrasko]

@trizzo_sk @jhencinski this can be found in AzureAD logs

[Furkan @caliskanfurkan_]

Analysis on legit tools abused in human operated ransomware

https://t.co/em0w0AFKQx

[Jan Andrasko @JanAndrasko]

https://t.co/Tvhpv3GWGg

[Kostas @Kostastsale]

Today, me and @ateixei are releasing the EDR Telemetry project. This project aims to compare and evaluate the telemetry of various EDR products.

✅Introductory blog post: https://t.co/hGu2fcqSAT
✅GitHub Repo: https://t.co/0xjL53X5Mg
✅Comparison Table: https://t.co/RAP33Wf5rB

[Jan Andrasko @JanAndrasko]

Very good and detailed article about configuration of WEC/WEF

[Thorsten E. @endi24]

Use Windows Event Forwarding to help with intrusion detection https://t.co/oVcgCPG8PK

[Jan Andrasko @JanAndrasko]

Je normalne, ze mesiac po prebrati, ehm nie uplne vyladeneho SIEMu noveho zakaznika, vieme s celym SOC timom na prvy pohlad identifikovat IP adresy Windows update serverov vo false positive offensoch?

[Johan Berggren @jberggren]

PSA: Major new Timesketch release - the open source #DFIR timeline analysis platform. We have been working on redesigning and improving the user experience.

🧵Thread with screenshots:

[All The Right Movies @ATRightMovies]

THE MATRIX was released 24 years ago today. One of the most iconic and groundbreaking movies of its generation, the making of story is a fascinating one.

A THREAD
1/25

[Jan Andrasko @JanAndrasko]

@trizzo_sk @laska_kit SOC je take akvarko oddelene od zbytku bez moznosti vetrania inak ako vzduchotechnikou a tu stale ladime. Niekedy prid na kavu ;)

[Jan Andrasko @JanAndrasko]

@trizzo_sk @laska_kit Mne sa SOC analytici stazuju na zly vzduch ked este ani 800ppm nesvieti :)

[Nextron Systems @nextronsystems]

Demystifying SIGMA Log Sources

We‘re glad to announce a new contribution called log-source guides.
The idea behind it is to provide specific guides on configuring a system’s audit policies so that the system actually creates the logs needed by the rules.

https://t.co/ah5ddPixZs