Jonas Plum

Forensics engineer, also @[email protected]

[Kostas @Kostastsale]

🚨EDR Telemetry website is live! 🥳

I hope this makes it even easier for folks to compare the telemetry of EDR vendors and visualize their visibility gaps 🙂

‣ Website🔗https://t.co/gc5UXmr8ih
‣ GitHub 🔗https://t.co/NNAI4K539x

**Telemetry results reflect the most recent updates from the EDR Telemetry project.

[Johan Berggren @jberggren]

🚀Introducing OpenRelik: Open-source platform for digital forensic investigations. Modular workflows, collaboration, central artifact repository and easily extendable to support new tools in a clean, easy to use interface.

https://t.co/fnkTwtsXDd

[Elbsides / [email protected] / @elbsides]

📣 Elbsides 2024 supporter and general attendee tickets will be available at 11 am CEST (speakers and sponsors will receive a separate link to book their tickets). Register here: https://t.co/PWPWWSRsWx

[Silas Cutler (p1nk) @silascutler]

Why don't @Google / @MsftSecIntel / @awscloud have public programmatic ways of reporting lost keys? #LeakyKeys have been a problem we have scaled the ability to identify faster than we have the reporting.

Last scan brought in over 3000 parsed keys for Google, @amazon , @stripe , @OpenAI. (These are also providers that have easy ways to identify their keys).

[tomchop @tomchop_]

This has been years in the making, literally. @Sebdraven and I are happy to announce the release of #Yeti 2.0 ✨ 🍰 (after we promised an EOM release at @hack_lu last month 😅)

Website: https://t.co/jFRiEUWLIu
Release: https://t.co/5Rlo6pGRWC

mini-🧵👇🏼

[Jonas Plum @jonas_plum]

@JordanMorgan10 Thanks for that example! A short idea to make the changes sync also from app to extension: https://t.co/cHX6kJ3s20

[Alex @alexanderjaeger]

🕶️🧐👀🥷🥁A new project by the Security Response team of @Google: https://t.co/fTO9MvhPBa. It fills a gap I have seen for years, asking the same questions in similar investigations across analysts who might have different background and know how. 🕶️🧐👀🥷🥁

[BSides Munich @BSidesMunich]

The first batch of the conference tickets for #BSidesMunich23 has been released. As usual, tickets are free of charge and limited in number. Be quick before the early bird tickets are gone.

Get your tickets here https://t.co/xhCQ2w4niP

[Jonas Plum @jonas_plum]

Interesting to see more standardisation of #DFIR coming up. Would prefer this to be markdown or similar but still a good list of procedures.

[CERT SocieteGenerale @CertSG]

We are happy to announce the publication of the new version of the IRMs (Incident Response Methodologies) resulting from the work of @CertSG with the collaboration of CERT @advens. Feel free to use it! https://t.co/7BOMXJuEnT
#IncidentResponse #CyberSecurity #DFIR

[Dirk-jan @_dirkjan]

Fox-IT just open sourced their enterprise forensics tooling dissect. This is a big project that some of the smartest people I know have worked on. It supports many filesystems and file formats, all as Python libraries. Docs: https://t.co/M6YAygmW3E / code: https://t.co/HKT4eYIm1a

[Jonas Plum @jonas_plum]

@sshbrnv Why use the assembly if we have the ast of the code (well except for C and asm imports)?

[Jonas Plum @jonas_plum]

@sshbrnv Thanks :) It's still quite simple but I hope the idea behind it spreads ;-)

[Joe Słowik 🌻 @jfslowik]

Am I doing this right?

[Robert Graham @robertgraham]

Old Unix: everything is a file
New Unix: everything is a file system

[Nikhith @Nikhith_]

Me: Where do I login with these creds?

Microsoft: Yes.

Here's a huge list of Microsoft's management portals.
https://t.co/xeIxZoHlNK

#redteam

[Freddy Dezeure @FDezeure]

7th EU ATT&CK Workshop on 1-2 June. https://t.co/Zwwohx3FiF. Updates from @MITREattack, launching @CycatP, exciting news from @sigma_hq and best practices presented by peers. Participation free but registration required. @circl_lu @CERTEU @MITREengenuity

[Jonas Plum @jonas_plum]

@AlexisBrignoni True, plaso supports some mobile artifacts, but they are not all included in dfvfs. I would like to see a common (public) file format for DFIR cases, but so far each vendor and most of the tools have their own formats.

[Jonas Plum @jonas_plum]

@AlexisBrignoni https://t.co/u0ybyMEFPQ comes quite close to this for $0.

[Jonas Plum @jonas_plum]

I created a Go package to read forensic disk images in the Advanced Forensics File Format (AFF4): https://t.co/IvcLDb7qQ3 #DFIR @blschatz @scudette

[Jonas Plum @jonas_plum]

@phillmoore @sansforensics For IR there is https://t.co/WakkNaws8o which structures IR techniques in the same way mitre structures attacker techniques. I started to draft something similar for forensics: