Bryan Lee

Former Unit 42. Terrible namer of things. All views are my own.

[Bryan Lee @obiwanblee]

Come listen to @scottsimkin and I chat about all things XDR!

[CrowdStrike @CrowdStrike]

Take a break and listen in as our CrowdStrike experts explain the benefits of #XDR and how organizations of all sizes can benefit from it.

🎙: https://t.co/TQMZO2RQNb

[@mikko @mikko]

Congrats everyone, we did it.

https://t.co/QhKl9ltsrL

[Down the Security Rabbithole Podcast @DtSR_Podcast]

T-minus 30 minutes'ish from one of the BIGGEST shows #DtSR has ever had....seriously.
@anton_chuvakin @obiwanblee and a few others you'll have to join to hear.
https://t.co/KGIiL98des

@ExtraHop @CrowdStrike @CloudSecPodcast @Wh1t3Rabbit @JardineSoftware

[Down the Security Rabbithole Podcast @DtSR_Podcast]

#DtSR Episode 519 features a veritable who's who from @CrowdStrike Fal.Con '22 in Las Vegas the past week.
If you missed it, now you don't have to miss everything... listen in here the direction our industry is going.

https://t.co/EpMGCaG4Rn

@NickWLowe @obiwanblee

[CrowdStrike @CrowdStrike]

ICYMI: Listen in with @scottsimkin and @obiwanblee to figure out why they're talking "garbage" and "SOC in a Box" and whether you're already XDR'ing. https://t.co/RAY2V4ERbY

[Down the Security Rabbithole Podcast @DtSR_Podcast]

This is going to be absolutely EPIC, Episode 521 on 10/11/22 at 1pm Eastern will stream LIVE dissecting #XDR and hype vs reality

https://t.co/KGIiL98des

Tell everyone you know. Sign up, be there.

@Wh1t3Rabbit @JardineSoftware @anton_chuvakin @obiwanblee @ExtraHop @CrowdStrike

[Joe Słowik 🌻 @jfslowik]

This is how vulns, exploits, malware, and threat actors get named

[Kris McConkey @smoothimpact]

I love it when the very thing an actor does to avoid being tracked becomes the signal in the noise.

[Unit 42 @Unit42_Intel]

Unit 42 analyzes and suggests mitigations for two threats that have been targeting Ukrainian organizations. https://t.co/0VnPjx5cda

[Katie Nickels @likethecoins]

Bad news: Conti is reportedly exploiting #log4j2.
Good news: Detection along their whole attack chain should still apply. https://t.co/HzqBIe4aX5

[Robert Falc @r0bf4lc]

Actors exploit Zoho ServiceDesk CVE-2021-44077 to install a variant of the #Godzilla #webshell in the form of a Tomcat filter.

https://t.co/Yyq9tc4tmM

[Katie Nickels @likethecoins]

Katie Blankenship of @CrowdStrike gives a kind shout-out to @Unit42_Intel for their work on Thanos. I love when researchers give credit to others' excellent work! @r0bf4lc https://t.co/dbPxWaLrd8 #CYBERWARCON

[Robert Falc @r0bf4lc]

@NinjaOperator Check out ‘behavior:”https://t.co/aFw55VVaty”’ on VT

[Bryan Lee @obiwanblee]

Fantastic research by @r0bf4lc @noottrak and Pete Renals!

[Robert Falc @r0bf4lc]

Actors exploit CVE-2021-40539, install Godzilla webshell and NGLite that uses a decentralized network for C2. Later, #KdcSponge (sorry) used to steal passwords from Kerberos auth attempts. KdcSponge was a fun one to analyze for sure!

https://t.co/dUS4puaV4l

[Bryan Lee @obiwanblee]

@SeraphimDomain @RecordedFuture

[Angel Hun @SeraphimDomain]

@RecordedFuture this is BEYOND irresponsible https://t.co/dpzUqxl1XV

[Bryan Lee @obiwanblee]

@anthonykasza

[Bryan Lee @obiwanblee]

@tlansec @3dRailForensics @Mandiant