Scott Lynch

Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own

[Bilawal Sidhu @bilawalsidhu]

Gosh I love the OSINT community. This project throws every plane flying overhead onto your ceiling in near real time – decoded from a cheap radio, w/ live stars and the ISS behind it. Falling asleep under a live map of the sky. h/t @CameronPaczek

[Security Onion @securityonion]

On this day in 2009 the very first release of Security Onion hit the Internet. A lot has changed since then, but it's still the best free and open solution to help you peel back the layers of your network and see what's really happening.

[Doug Burks @dougburks]

On this day in 2009, I released the very first version of @SecurityOnion!

We've come a long way in 17 years, but the best is yet to come!

[rtl-sdr.com @rtlsdrblog]

RTL-SDR Now Runs on iPad M-Series Devices Directly via USB Without Jailbreak https://t.co/dCIk2bv7Cx

[Lenny Zeltser @lennyzeltser]

A decoy fires only when someone accesses a resource no legitimate user would touch. Plant tripwires across network, identity, data, and AI agent configs to create asymmetry in your security architecture.

https://t.co/mqWcwtOVzG

[Dr. Anton Chuvakin @anton_chuvakin]

This is fun: "nano is a lightweight SIEM in Rust on ClickHouse, with a piped query language, a real detection lifecycle, and AI that does actual investigation work." https://t.co/tTEbVxPGwt

[Samir @SBousseaden]

new detection for cloud metadata credentials using the network_traffic integration captures process, cmdline, url and user_agent and easy to setup via fleet (few clicks), example of a match on the malicious tanstack npm script:

https://t.co/VVVDnEJ28y

https://t.co/HqPJcemqtY

[Security Onion @securityonion]

Good morning Charm City! If you're at #AFCEATechnet, come to booth 3242 to see the legendary Michael Stokes and learn about using Security Onion to peel back the layers of your network.

[Renzon @r3nzsec]

Just shipped IRFlow Timeline v1.0.6. Spent the Eid holidays finalizing a few new features I’ve been dying to get into the tool since the last release.

What's new:

Sigma Detection
Run Sigma rules directly on raw EVTX folders using the bundled Hayabusa engine (thank you @yamatosecurity) or on imported timelines and EvtxECmd output via an in-app JS engine.

RDP Bitmap Cache Recovery
Extract and reconstruct bitmap tiles from Windows bcache*.bmc / cache????.bin artifacts. Useful for recovering screenshots of what a threat actor actually saw during an RDP session.

150+ Module Refactor
The app was previously a monolithic ~20,000-line codebase (a single App.jsx + parser.js). It's now decomposed into ~150 focused modules across the renderer and main process. Built for scale.

Give it a try and let me know what you think. Always open to feedback from the field. These features were built to test the latest Claude 4.8 with ultracode -xhigh + workflows, backed by Codex 5.5 + Cursor composer 2.5 side by side for lightweight tasks such as updating docs.

[Security Onion @securityonion]

It's time for O's, Bohs, and SO -- Security Onion Solutions is coming to Baltimore! Looking forward to seeing all our friends at #AFCEATechnet in Charm City this week, come see us at booth 3242 to find out how we can help you peel back the layers of your network and make the bad guys cry.

[Security Onion @securityonion]

Security Onion 3.1.0 Hotfix 20260528 Now Available!

We've released a hotfix to Security Onion 3.1.0 to address issues for deployments with Heavy Nodes or custom Logstash pipelines - please check out this blog post for more information.

https://t.co/aukTDkTIxK

[Immanuel @immanuel_vibe]

eBPF is kinda insane and nobody talks about it enough

Netflix uses it to trace flow logs across their whole fleet without tcpdump eating the CPU.
Cloudflare drops millions of malicious packets per second with XDP, before the kernel even bothers building an skb.
that's the trick btw: XDP runs at the driver layer, so you reject junk traffic before the network stack wastes a single cycle on it.

Google GKE dataplane v2 is built on Cilium/eBPF, and Google wrote about pushing it to 65,000-node clusters, which is frankly a stupid-big number.
Netflix found a noisy-neighbor disk latency bug in prod that classic tools just couldn't see, because the latency was hiding between syscall and disk.

practical tip most people miss: you don't need to write raw BPF bytecode like it's 2016.
grab bpftrace, write a one-liner, get histograms of syscall latency in 10 seconds.
and boom, you can see your prod read sizes live. no recompiles, no restarts, no downtime.

the wild part is it's basically a tiny VM running sandboxed inside the kernel and the verifier won't even let you crash the thing.
observability without the observer effect, finally.

btw, I am building pktz - https://t.co/nqmL5d7beH - eBPF-powered network traffic monitor, per process, per connection, live.

#ebpf #networking #cilium #devops #k8s #kubernetes #sre #cloud

[Security Onion @securityonion]

Our printed documentation book has been updated for Security Onion 3.1 and is available from Amazon now!

For those who don't know, we offer a softcover copy of our documentation for the current version of Security Onion via Amazon. All proceeds go to the Rural Technology Fund, and the book comes with a 20% off discount code for our on-demand training and the Security Onion Certified Professsional (SOCP) certification exam.

[Doug Burks @dougburks]

🚀 OhMyDebn 3.8.2 is out!

Debonair Debian + Cinnamon desktop just got even better for power users:
• OhMyPCAP → 4.0.0
• Opencode → 1.15.11
• aether → 4.22.0
• cliamp → 1.54.0
• Man pages now beautifully colorized

Stability. Beauty. Power. AI + Containers ready.

Who’s upgrading today?

Drop a🔥if you’re running OhMyDebn!

#OhMyDebn #Debian #Linux #Cinnamon #PowerUser

Thanks to @opencode and @iamdothash for the updated components!

[Florian Roth ⚡️ @cyb3rops]

I spent the last weeks building LLM benchmarks for a very specific reason:

We want to use AI in RuneAI to help with THOR finding triage, and I needed a better baseline for model selection than generic LLM leaderboards.

Security-event triage is its own thing.

A model can be great at coding, reasoning or vulnerability writeups and still be a bad fit for deciding whether a messy endpoint finding should be suppressed, reviewed or escalated.

In real deployments this will likely happen inside agentic workflows with tools, memory, context handling and feedback loops. But before testing the whole system, I wanted a clean baseline:

How does the model behave when it only gets the enriched finding itself?

Blog post with the reasoning and methodology:
https://t.co/KQPOPDWP1B

Interactive benchmark results:
https://t.co/pvVhTBJsz0

Repo:
https://t.co/Fw3uW9nu2a

Maybe useful for others building SOC / security-event triage benchmarks.

[Doug Burks @dougburks]

🚀 OhMyPCAP 4.0.0 is HERE!

The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.

New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matches

All the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).

Ideal for malware analysis, incident response, threat hunting, forensics & teaching.

Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)

#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis

@Suricata_IDS @lennyzeltser @chrissanders88 @sansforensics @TomLawrenceTech

[DHH @dhh]

I used to dream of having a fully operational system installed in 15 minutes. Then the goal became 5 minutes. Now the goal is 1 minute. We're getting close!

[Doug Burks @dougburks]

Chris is doing really important work with @RuralTechFund. Check it out!

[Brian in Pittsburgh @arekfurt]

👇👇
"The industry's answer... has been detection. But detection is also the control that sustains the business model. Prevention, done well, is quiet. And quiet doesn't sell at RSA."

[Florian Roth ⚡️ @cyb3rops]

A friend told me something in a beer garden in Germany about 12 years ago:

“Florian, don’t overthink whether this specific service is exploitable. The stuff is broken. Plan accordingly.”

He meant software.

Most software looks stable because it runs under normal conditions. Look closer and you find memory leaks, parser bugs, unhandled input, bad defaults, forgotten modules, weird edge cases.

Now we have better fuzzing, better automation, AI-assisted auditing, variant hunting, more exploit dev, more eyes on everything.

So yes, patching matters.
But in a world where every kind of internet-facing software keeps producing fresh RCEs, you also need the boring stuff:

1. Reduce the attack surface
- expose fewer services
- disable unused modules, plugins and features
- don’t publish admin interfaces unless they really need to be reachable

2. Limit the blast radius
- run services with least privilege
- isolate internet-facing systems
- avoid shared accounts and credentials

3. Build visibility and control
- collect useful logs
- monitor weird errors, crashes and “should never happen” events
- keep enough data to investigate later
- run regular compromise assessments

Assume exposed software is brittle.
The stuff is broken. Plan accordingly.