Jack

Security researcher

[Jack @malwareforme]

Getting away from Twitter. You can find me on BlueSky while I rebuild followers and figure it out:

https://t.co/bAe4wKO5gU

[Matt Zorich @reprise_99]

We are looking for some interns to join our team here at Microsoft. If you are currently studying cyber security, computer science, mathematics or anything similar and based in Ireland or Cheltenham then we would love to hear from you - https://t.co/N0ECP8eiGM

[Matt Zorich @reprise_99]

People often share full Kusto queries, which is awesome, but what about those handy one liners and tips you have picked up along the way? Here are some of my favourites, share yours below!

Extend an additional column for your local time, example +5 UTC:

| extend LocalTime = TimeGenerated +5h

Find events only on weekends, cast a variable to make it easy to read:

let Saturday = time(6.00:00:00);
let Sunday = time(0.00:00:00);
AuditLogs
| where dayofweek(TimeGenerated) in (Saturday, Sunday)

Find events during certain hours of the day:

| where hourofday(TimeGenerated) !between (4 .. 23)

Calculate the minutes (or hours or days etc) between two events:

| extend ['Minutes Between Events']=datetime_diff("minute",Timestamp1,Timestamp2)

Parse the details, including browser family and version etc of a user agent:

| extend UserAgentDetail = todynamic(parse_user_agent(UserAgent, "browser"))

Decode base64 encoded strings, useful for PowerShell:

| extend DecodedCommand = base64_decode_tostring(EncodedCommand)

Rename columns while using project:

| project LogTime=TimeGenerated, SigninLocation=Location, IP=IPAddress, Agent=UserAgent

[Matt Zorich @reprise_99]

If you're a guy in your early 20s, learn regex.

Go into debt if you have to

[Jack @malwareforme]

@SwiftOnSecurity Prisoners of Geography

[Josh Kamdjou @jkamdjou]

excited to announce @sublime_sec has raised a $60M Series B led by @IVP

@CNBC wrote about the news this morning: https://t.co/TQuFhwhkP2

@ianthiel and I are so grateful and humbled by the trust our customers and community have placed in us. we won't let you down

[William Metcalf @node5]

Enjoy punching phish? Experience writing detections for phish, using regex, Yara, etc., and looking to grow as a researcher within an experienced team? Join me and the rest of the Splunk Attack Analyzer Misfits of Detection Science. US only, fully remote https://t.co/Crr9enas1y

[الرقة تذبح بصمت @Raqqa_SL]

The great Syrian people overthrew the Assad regime.
Syria is Free
We are free

[Josh Kamdjou @jkamdjou]

🔊 Useful advice for the holiday dinner table

https://t.co/5NaMy2BhAT

[Threat Insight @threatinsight]

Proofpoint has tracked this technique since August 2024, and call it “brooxml”. Our researchers do not consider this a zero-day or vulnerability in general.

We’ve released Emerging Threats and YARA signatures at the end of this thread.

[Jack @malwareforme]

The absolute worst take ever. Just don’t end up in PCRE jail and it’s fine. Regex 4ever

[Microsoft On the Issues @MSFTIssues]

Microsoft’s Digital Crimes Unit has seized 240 fraudulent websites, disrupting a major “Phishing-as-a-Service” operation. These campaigns targeted sensitive industries like financial services, jeopardizing data, transactions, and even life savings. https://t.co/0wNWO09dP2

[Nick Carr @ItsReallyNick]

I'm told we are hiring in MSTIC: https://t.co/ltfZcQbg5n
Come for the data, stay for the data. Creative problem solvers have the most impact.
If we've worked together, I'm happy to refer you.

But...

[William Metcalf @node5]

I'll just leave this here... https://t.co/DTCblEsK7U

[Josh Kamdjou @jkamdjou]

you can deploy verifiable coverage for this with @sublime_sec (for free), here’s the detection that’s been out for over a year (h/t @zoomequipd @ajpc500): https://t.co/DeufOQqIP3

[IAM!ERICA @EricaZelic]

There is also this setting in https://t.co/VTZqU7OhTu

[Sublime Security @sublime_sec]

Announcing our latest NLU model update: BERT Large Language Model (LLM), which is better at understanding tone, intent, and context than ever before.

We’ve detailed our research in our latest blog and how it’s used to combat AI-generated attacks: https://t.co/M7vAv8uFTG

[Justin Ibarra @br0k3ns0und]

We are now developing @elastic threat hunting queries, alongside our detection rules, and openly sharing these as well! 🎉🎉

Can visually explore these with https://t.co/DYH1CkmLYN! 🔥🔥

#ThreatHunting #DetectionEngineering

[Sublime Security @sublime_sec]

We're excited to announce the release of our new Public EML Analyzer: a free, unauthenticated tool for analyzing email messages.

Upload any EML and get Sublime's analysis results along with URL sandbox and attachment previews, insights, and more: https://t.co/LCU2LK988F

[Jeremy Kirk @Jeremy_Kirk]

Microsoft has been running massive deception campaigns that flood new phishing sites with bogus credentials for bogus companies on MS tenants. When attackers log in, they deliver a torrent of fresh threat intelligence that can be used to defend: #infosec https://t.co/hFqljCGndq