Jeff Beley

Incident response and incident response accessories @Accenture. Opinions are my own. DNS aficionado. grep/sed/awk connoisseur.

[Jeff Beley @jbeley]

We're hiring DFIR/CTI investigators and analysts for Accenture's customer facing incident response.

Senior DFIR investigator : https://t.co/M64V1QUxoY
IR focused CTI lead: https://t.co/8nnZC8Hc7D
IR focused CTI analyst: https://t.co/Dr68wDxUsf

#dfir #hiring #cti

[SwiftOnSecurity @SwiftOnSecurity]

Security Prayer:

Lord of Cyber,
Grant me the serenity to log the things I cannot control,
Courage to control the things I have staffing for,
And the wisdom to know the difference.

[Ransomware News @RansomwareNews]

Group: lockbit3
Approx. Time: 00:44 19/12/24
Title: https://t.co/XyqTdvlzGi

[DC940 @DCG940]

Join us Monday, November 18 at Graffiti Pasta in Denton, TX! @TechEmiiily will be presenting “EMS and IR Professionals Have a Lot More in Common Than Just a Bunch of Acronyms.”
@Dallas_Hackers @DC214DFW @ntxcsg @PhillipWylie

https://t.co/R5PMgLqfOg

[Jeff Beley @jbeley]

@Golgothus I'm working on open sourcing my analyst vm. Works on virtualbox, VMware workstation, esx, and potentially others. Taylor Swift background optional.

[Jeff Beley @jbeley]

@GuyThompson_ We built a Windows binary for maximum compatibility (can collect on ancient machines that can't run PowerShell). Everything is in an encrypted aff4 container and parsed out into glorious JSON.

[Jeff Beley @jbeley]

@thalles @TechEmiiily

[Justin Elze @HackingLZ]

@ImposeCost

[0DAYALLDAY @0Dayallday]

@BSidesDFW was awesome! The staff and volunteers really stepped up. My workshop/training class wouldn't have been possible without help from the volunteers! The badges were awesome, and I'm eagerly waiting to see all of @hon1nbo's photos

[BSidesDFW @BSidesDFW]

Just two more weeks until #BSidesDFW2024.
Pre-Resgistration is open.
3 speaker tracks
multiple workshops
1 hackathon
locks to pick
badges to solder
N connections to be made

[Today In Infosec @todayininfosec]

1990: Clifford Stoll's book "The Cuckoo's Egg" was turned into an episode of NOVA entitled "The KGB, the Computer, and Me". To avoid spoiling it, let's say it's a story of how he tracked down a hacker who broke into his employer's computer. Watch for free! https://t.co/FZSRWwX6Lt

[Bud Kennedy / #ReadLocal @BudKennedy]

Hive Bakery in Flower Mound posts that it received harassment, "tons of hateful messages and phone calls ... hateful rhetoric" after baking Tim Walz cookies. But they sold out: "Looks like being liberal in Flower Mound ain't so bad after all." https://t.co/fypc1zAbkD

[Aura @SecurityAura]

I'm going to say it once more for the people in the back.

Detecting stuff running from:

C:\Users\Public
or the root of
C:\ProgramData

will save you from SO. MANY. INCIDENTS

The one detection rule I can live by.
The first thing I hunt for in any environment.
It. Always. Works.

[National Crime Agency (NCA) @NCA_UK]

A teenager has been arrested by the NCA, as part of the investigation into a cyber security incident affecting Transport for London (TfL).

FULL STORY ➡️ https://t.co/TFbZdJ3FDO

[DFIR Training @DFIRTraining]

Remember what your goal is in DFIR.

[Yamato Security Tools @SecurityYamato]

We just released Hayabusa 2.17.0 and Takajo 2.6.0 at Taiwan's greatest security conference: HITCON!
Hayabusa has support for the new Sigma V2 modifiers and many various enhancements. Takajo has a new HTML summary report feature!
https://t.co/sidlwTPxEi
https://t.co/K8Vv0QH2Jf

[Foo Fighters @foofighters]

Let us be clear.

[SwiftOnSecurity @SwiftOnSecurity]

Everyone who has worked Incident Response in real companies

[Jeff Beley @jbeley]

@SwiftOnSecurity Are you saying that "haters gonna hate hate hate"

[Jeff Beley @jbeley]

@HackingLZ Iodine is fun (unless you're allergic to shellfish /s)

https://t.co/pHWGYUafR1