Michael Ranaldo

Working in security, 5-9'ing at @preemptdev

[Michael Ranaldo @MichaelJRanaldo]

More capable than expected, less capable than required

[☠️ Brandon @__mez0__]

1/2 Over the past few weeks I've used the EMBER2024 model to try and figure out how to make implants less likely to be hit by ML. I wrote about the process here: https://t.co/9ys82E53cL

[pre.empt @preemptdev]

throwback to our first blog in 2022. still fun, relevant, and still a headache to detect - despite the meme: https://t.co/fGTTaGy1CL

[Michael Ranaldo @MichaelJRanaldo]

Watch ⁦@two06⁩ ‘s talk at ⁦@Steel_Con⁩ or your phone camera will get it

[Michael Ranaldo @MichaelJRanaldo]

@__mez0__ @Steel_Con @TrustedSec Cold beers on a hot day at a great con, what’s not to like!

[Michael Ranaldo @MichaelJRanaldo]

Another great read from Brandon on Citadel! This played huge part in our malware review

[☠️ Brandon @__mez0__]

Under-the-hood, Ember uses LightGBM to score a sample from 0 to 1. I added this functionality into Citadel so any binaries added to the framework are now summarised and scored as well as the rest of the Citadel analysis. Read it here: https://t.co/jxxbFJkMNM

[Michael Ranaldo @MichaelJRanaldo]

@__mez0__ and I spent too long dithering about but here’s our fun romp through malware and goodware inspired by EMBER2024

[pre.empt @preemptdev]

Last summer we spent some time collecting both benign and malicious applications. We picked it back up and put together a preliminary exploration of that dataset: https://t.co/KbuOMroAV9

[pre.empt @preemptdev]

Last summer we spent some time collecting both benign and malicious applications. We picked it back up and put together a preliminary exploration of that dataset: https://t.co/KbuOMroAV9

[Michael Ranaldo @MichaelJRanaldo]

Great send off for @Steel_Con 2024 with a painting session! Til next year!

[Michael Ranaldo @MichaelJRanaldo]

Great talk by @two06 , well worth a watch if you love the cereals!

[Michael Ranaldo @MichaelJRanaldo]

Great job @myexploit2600 fighting through the demo gods to deliver your talk!

[Michael Ranaldo @MichaelJRanaldo]

First time conference talk delivered!

[Michael Ranaldo @MichaelJRanaldo]

Great time talking @Steel_Con with @__mez0__ on our preliminary PE research! Thanks to everyone who attended, slides dropping soon :)

[Michael Ranaldo @MichaelJRanaldo]

@__mez0__ @Steel_Con No blockchain though was it even worth it

[Michael Ranaldo @MichaelJRanaldo]

@__mez0__ @Steel_Con So much time looking at graphs 📊

[Michael Ranaldo @MichaelJRanaldo]

@x33fcon after a lovely few days we’re heading home! Thanks for a great con and already looking forward to next year :) 🏴‍☠️🏴‍☠️🏴‍☠️

[/ˈziːf-kɒn/ @x33fcon]

Best crowd ever 🤩⛵️🏴‍☠️

[☠️ Brandon @__mez0__]

🧵 @MichaelJRanaldo and I have been accepted to talk @Steel_Con! We'll be going over our long and ongoing statistical analysis of goodware, malware, and "winware". Each category has its own and distinct features/nuances.

[Michael Ranaldo @MichaelJRanaldo]

@__mez0__ @Steel_Con Doing it for the Henderson’s!

[☠️ Brandon @__mez0__]

🧵1/2 In this blog I wanted to talk about some of the logging and modelling enhancements we've made to connect disparate tools together to produce enrichment models. Ultimately, this allows us to create objects for everyday objects (i.e. users, computers, domains, etc).

[Michael Ranaldo @MichaelJRanaldo]

@Steel_Con @__mez0__ Bots are just jealous of all the Henderson’s relish I got last year!