Kostas

I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦

[Kostas @Kostastsale]

@iamlukethedev @NousResearch Imagine how good this will be when the new iOS version drops with Apple intelligence and the context that you can get from messages when you ask Siri about the specific topic of a conversation that you had with Hermes! 🔥

[Kostas @Kostastsale]

Organization should, of course, validate and build on top of their security tools and default configurations, but I very much blame those vendors' marketing and the fact that they are desperate to sell, promising the moon.

[spencer @techspence]

Too many organizations rely too much on out of the box configurations of their security tools. It’s especially evident with EDR.

There are few tools that are truly set it and forget it.

If you don’t create any custom alerts and you don’t review your existing alerts for effectiveness and completeness, you’re leaving room for attackers.

[MagicSword @magicswordio]

Episode 3 | EDR Telemetry https://t.co/VAFFff23TI

[Kostas @Kostastsale]

@_josehelps It was fun! Thanks for the invite 🙂

[MagicSword @magicswordio]

Today we're back live with @Kostastsale to talk EDR Telemetry.

Join us here: https://t.co/dEQPr051YT

📅 Every Friday | 2PM EST

[Kostas @Kostastsale]

@Tr3s0r I would expect nothing less from a psychotic narcissist. Maybe we should learn more from the French and bring out the guillotines.

[Kostas @Kostastsale]

Meta’s management delivering the snacks to their team caught on camera

[Polymarket @Polymarket]

JUST IN: Meta’s CTO says morale is near “the worst it’s ever been” — leadership will offer increased snack budgets to lift spirits.

[MagicSword @magicswordio]

Two LOLRMM entries worth calling out this week.

🆕 Remotely, open-source, self-hostable, full remote access capability. The kind of tool that flies under the radar precisely because it doesn't look like malware. Now documented in LOLRMM.

🆕 NetSupport Manager, still showing up in intrusion reports and malware delivery chains. Entry now enriched with richer artifact coverage including remcmdstub.exe, the remote command component defenders should be hunting for.

Thanks https://t.co/wWrhqNmhP2 and @Kostastsale for the contributions. 🫡

https://t.co/hPJH92BuWz
https://t.co/3E2g9gylVE

[The Haag™ @M_haggis]

Last week we loaded RMM tools and vulnerable drivers live.

Today we're bringing in @Kostastsale from the EDR Telemetry Project to talk about what defenders can actually expect security products to see, alert on, and miss.

Looking forward to this one.

Check out the EDR Telemetry project here https://t.co/2BPXgZ2I3G

[Kostas @Kostastsale]

@vxunderground It'll pay dividends during winter

[Kostas @Kostastsale]

@statictear That's right. I couldn't find the appropriate meme for it 😂

[Kostas @Kostastsale]

We consolidated the EDR Telemetry methodology into a single page.

No more digging through scores, eligibility, contribute, and blog posts to piece together how we evaluate telemetry. Evidence standards, status taxonomy, direct vs inferred rules, the vendor-assisted workflow, and the 75% governance threshold are all in one place now.

Live at https://t.co/55CY2VFBjv

[Kostas @Kostastsale]

@ghostlead247 @Cyberknow20 I found grok 4.3 is terrible at agentic coding. It cannot follow instructions with very inconsistent tool calls.

[Kostas @Kostastsale]

Seeing feedback like this makes us push even harder to provide value and unique intrusions for our members!
Our new cloud intrusions take a ton of time to put together and include choose-your-path style questions and a learning module. Same with all of our other intrusion labs💪

[Threat Hunting Labs @ThruntingLabs]

Feedback like this is exactly why we keep pushing Threat Hunting Labs beyond the usual endpoint-only path.

Windows investigations still matter, and we have real cases covering the classic enterprise attack chains.

But most training platforms have been serving the same Windows intrusion for years.

You finish one, then the next one feels like the same case with a new title.

Modern analysts need more than that.

They need cloud intrusions, Linux activity, identity abuse, SaaS evidence, exposed services, and hybrid environments.

That is the range we want Threat Hunting Labs to give them.

[Kostas @Kostastsale]

I really like seeing posts like this. It’s great to see this kind of recognition from CEOs towards their teams.

Good results don’t just happen on their own and definitely don’t come from marketing. They come from engineers fixing gaps, product teams prioritizing the right things, field teams bringing real feedback, and customers pushing for better visibility.

When that work shows up in the results, it deserves to be highlighted, and we are happy to do do that.

The EDR Telemetry Project is not here to point out what is bad and bash vendors. We highlight the good, too. The difference is that we do it independently, with an open methodology, and with information that is actually useful to the people using these products.

Not just C-suite reports, magic quadrants, or high-level summaries that do not help much when you are trying to investigate an incident or hunt through the logs. This is the kind of evaluation Gartner will never come remotely close to doing.

We offer open results, open methodology, and practical value for practitioners.

Hard work pays off, and we’re glad to see teams getting the recognition they deserve 💙

[Kostas @Kostastsale]

@ghostlead247 @Cyberknow20 What do you use it for?

[Kostas @Kostastsale]

Business email compromise is among the most costly attacks for companies. In this case, we look at a Microsoft 365 intrusion where a mailbox was compromised.

This case provides logs that are rarely available on training platforms, since the data contains real-world noise and traces of malicious infrastructure.

• Sign-in logs
• Microsoft 365 audit logs
• Exchange message trace
• mail events
• Graph activity
• mailbox audit evidence

Available now in THL 👇

[Threat Hunting Labs @ThruntingLabs]

📢 𝗡𝗲𝘄 𝗰𝗹𝗼𝘂𝗱 𝗶𝗻𝘁𝗿𝘂𝘀𝗶𝗼𝗻 𝗷𝘂𝘀𝘁 𝗹𝗮𝗻𝗱𝗲𝗱, 𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝘁𝗼 𝗮 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗘𝗺𝗮𝗶𝗹 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲 (𝗕𝗘𝗖)

We responded to a business email compromise and preserved the telemetry for hands-on investigation.

The case spans Entra sign-ins, Microsoft 365 audit logs, Exchange audit activity, Graph activity, mailbox access evidence, alert records, and message trace.

We are releasing the same intrusion across three disciplines:

- Threat Hunting: follow the access patterns, cloud activity, and investigation pivots.
- Incident Response: reconstruct the timeline, scope the compromise, and determine what the evidence proves.
- Detection Engineering: turn the observed behavior into practical detection logic.

One intrusion. Three ways to work the evidence.

https://t.co/U3Qdb9iz9F

Available now on Threat Hunting Labs for Pro subscribers.

[Threat Hunting Labs @ThruntingLabs]

📢 𝗡𝗲𝘄 𝗰𝗹𝗼𝘂𝗱 𝗶𝗻𝘁𝗿𝘂𝘀𝗶𝗼𝗻 𝗷𝘂𝘀𝘁 𝗹𝗮𝗻𝗱𝗲𝗱, 𝗿𝗲𝗹𝗮𝘁𝗲𝗱 𝘁𝗼 𝗮 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗘𝗺𝗮𝗶𝗹 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲 (𝗕𝗘𝗖)

We responded to a business email compromise and preserved the telemetry for hands-on investigation.

The case spans Entra sign-ins, Microsoft 365 audit logs, Exchange audit activity, Graph activity, mailbox access evidence, alert records, and message trace.

We are releasing the same intrusion across three disciplines:

- Threat Hunting: follow the access patterns, cloud activity, and investigation pivots.
- Incident Response: reconstruct the timeline, scope the compromise, and determine what the evidence proves.
- Detection Engineering: turn the observed behavior into practical detection logic.

One intrusion. Three ways to work the evidence.

https://t.co/U3Qdb9iz9F

Available now on Threat Hunting Labs for Pro subscribers.

[Kostas @Kostastsale]

Security teams trying to influence the project after being invited 3 weeks too late