Mathias Fuchs

Something with IR and Intelligence @InfoGuardAG, Certified Instructor and author @SANSInstitute (@SANSEMEA), Former Principal IR Consultant @Mandiant

[Mathias Fuchs @mathias_fuchs]

@EvenRealities Great I bought g1 for 800€ just for it to be replaced with g2 shortly afterwards and g1 pretty much does not get any new features. Never again.

[Cooper @Ministraitor]

Today, after a long battle with cancer, we lost @FVT
His wife asked that we share the news of his passing, "His love for the community that he was in (as a curmudgeon). His joy for being involved with every thing that he & any team that he worked with. He fought to the very end."

[Mathias Fuchs @mathias_fuchs]

@evclinic Sehr cool. Könnt ihr auch mit Zero Motorrad Akkus umgehen?

[Mathias Fuchs @mathias_fuchs]

Frontier models don't just drift.
They get quietly starved of compute when the vendor needs GPUs for the next one.
That's fine for a chatbot. It's an audit problem for anything making security decisions.
https://t.co/lzLEawjFIK

[Mathias Fuchs @mathias_fuchs]

@SANSInstitute @oorozcoo You can download it here: https://t.co/NxKWQxI0bB

[Mathias Fuchs @mathias_fuchs]

@daddyislala Thank you, I hope I'll eventually have more time to be more active again.

[Mathias Fuchs @mathias_fuchs]

We built a thing.
WarroomX — AI-assisted scenario creation, synchronized observer notes, reports that don't require a ouija board to reconstruct.
Tabletop exercises that actually work. Launching Q1.
Full breakdown: https://t.co/5xnhNY4eVJ

[Mathias Fuchs @mathias_fuchs]

Most EDR tests are easy mode — Agents spawning commands, “AtomicTest-T1055.ps1.”
Your SOC spots them instantly.
GHOST changes that:
Zero footprint. Real attacker commands. Realistic process trees.
If analysts can’t tell it’s a test, you’re ready.
More: https://t.co/Pw0eDWCR3s

[Mathias Fuchs @mathias_fuchs]

🚨 Identity is now global. Are your IR skills?
Explore how breaches leverage Microsoft, Google, Apple, GitHub, and AWS—and master the practical GLIDER Framework for modern incident response.

Full guide here 👉 https://t.co/BMZZ3cI648
#CyberSecurity #IncidentResponse #GLIDER

[Mathias Fuchs @mathias_fuchs]

Attackers love RDP for sneaky lateral moves—but every pixel leaves a clue! 🕵️‍♂️ Check out my latest blog on tracking attackers through logs, bitmap caches, and clipboard trails (plus a printer tale too funny to miss). #DFIR #BlueTeam #CyberSecurity https://t.co/pmHWF6NhwP

[Mathias Fuchs @mathias_fuchs]

🗓 Logs lie. Prefetch tattles. ShimCache whispers. Timestamps dance.

Building timelines in DFIR isn’t just science—it’s chaos theory in action.

Join me in taming Chronos:
https://t.co/mf0CgrNvjs

#DFIR #IncidentResponse #CyberSecurity

[Mathias Fuchs @mathias_fuchs]

🚨 Bob from Accounting could be your biggest cyber threat. Seriously. 83% of orgs saw insider attacks last year. Tesla sabotage, Snowden leaks—your office has never felt spookier.
Read how to spot & stop these insider rogues 👉https://t.co/QycBeM4d4l #CyberSecurity #InsiderThreat

[Mathias Fuchs @mathias_fuchs]

🕵️‍♂️ How do attackers ghost past your EDR?

New blog post dives deep into evasion tricks—LOLBins, memory games, syscall magic & more.

Time to up your detection game! 👻🔍

👉 https://t.co/yi7h2NhkZN

[Mathias Fuchs @mathias_fuchs]

Tier 1 SOC Analysts: Highest responsibility, least experience, infinite alerts—what could go wrong? Plenty. Find out how automation and AI could save your analysts' sanity (and yours). ☕️🤖 #CyberSecurity #SOC #AI
https://t.co/xTxljGJuWv

[Mathias Fuchs @mathias_fuchs]

Choosing an IR partner = Picking a parachute packer. 🪂
Know your red flags 🚩, must-haves ✅, and absolute no-gos ❌ before you're in free-fall.

Dive into my latest blog 👉 https://t.co/uieVJaGQEC

#CyberSecurity #IncidentResponse #DFIR #CISO

[Mathias Fuchs @mathias_fuchs]

Last week: macOS forensics (easy!).
This week: Linux forensics (not easy at all!).
Ever wondered why Linux is tougher than Windows forensics? Scripts, logs, chaos! ☕🐧 #DFIR #Linux #CyberSecurity
https://t.co/J6gIPZ8Ucc

[Mathias Fuchs @mathias_fuchs]

Think Mac forensics is harder than Windows? Think again. 🍏
Unified logs, fewer artifacts, built-in snapshots—macOS might be easier for DFIR.
Except memory. That’s still hell. 🔥
Full deep dive for IR pros here 👉 https://t.co/wzQr4GF1pr
#DFIR #macOS #forensics #cybersecurity

[Mathias Fuchs @mathias_fuchs]

🛡️ Microsoft's new ReFS filesystem is changing the rules of digital forensics & IR. NTFS artifacts are evolving—are you ready?

Read our deep dive here: https://t.co/9HWuRGy9xA

#DFIR #ReFS #CyberSecurity #IncidentResponse #Forensics

[Mathias Fuchs @mathias_fuchs]

Even the best responders can’t work miracles in the dark. 🔍

Why visibility is everything in incident response – and what EDRs & network monitoring don't tell you.

Read the blog 👉 https://t.co/9Y9qBYkxgF
#DFIR #CyberSecurity #IncidentResponse #Velociraptor

[Mathias Fuchs @mathias_fuchs]

https://t.co/ynLvZp7mIn

[Mathias Fuchs @mathias_fuchs]

🚨 What aviation taught us about handling cyber crises ✈️
When incidents hit, it's not just tech that saves the day —it's teamwork. I just published a new article on how Crew Resource Management from aviation can level up incident response and crisis management in cybersecurity.