Scott Lynch

Senior Engineer @SecurityOnion | Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own

[Todd P. @toddatlarge]

Hanging out at the best BSides in the country.

@BSidesAugusta

[Adam @infosecatom]

The @MarkBaggett 🐍

[Jeff Murri @InfoSec208]

If you’re attending @BSidesAugusta looks @attrc ‘s talk is going to be excellent as well as the one by @dougburks pimpin his SO-CRATES tool. If you see him give him a Bill & Ted “Excellent!!!”

[Doug Burks @dougburks]

Super excited for @BSidesAugusta today!

Hope to see you at my talk at 3PM on SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

[Doug Burks @dougburks]

Josh Brower is presenting “Sigma Correlations: Everything, Everywhere, All Within 5 Minutes” at Security Onion Conference @securityonion

[Shodan @shodanhq]

Chart showing the number of Internet-facing PHP services over time: https://t.co/HOXhmwXgOF

[Doug Burks @dougburks]

Matt Gracie is kicking off this year’s Security Onion Conference with a review of what we’ve been up to the last year! @securityonion

[Doug Burks @dougburks]

Bryant Treacle presenting “Defending OT/ICS Environments with Security Onion” at Security Onion Conference @securityonion

[Nasreddine Bencherchali @nas_bench]

We just released a new Splunk ESCU version 6.9.1 with initial coverage for PHP2Shell - Grab the update today https://t.co/HP0RzuWKjc

Check out the dedicated analytic story for more details - https://t.co/E7fhGqcFJV

Big shoutout to Onur Mustafa Erdogan @raven_tait @SnekCharmerr for making this happen

[Stephan Berger @malmoeb]

New Field Note: Reconstructing an Attacker’s Workflow

During a recent incident, we recovered several PowerShell scripts an attacker left behind. They revealed a surprisingly practical post-exploitation toolkit:

- File-based command execution
- Credential harvesting through Windows authentication prompts
- Active Directory reconnaissance and remote WMI access testing
- SMB share discovery and permission checks

Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network

Link: https://t.co/MHNqD5U98D

[Scott Lynch @packetengineer]

@dougburks @securityonion Thanks for the opportunity to talk and ba a prt of this great team!! @dougburks @securityonion

[Florian Roth ⚡️ @cyb3rops]

"High Fidelity Detection Mechanism for #php2shell (CVE-2026-109618 and CVE-2026-109619)" by @SLCyberSec

Blog
https://t.co/JcTDvXsECk

Scanner
https://t.co/ti5h2VYT7p

#PHP

[Mehmet Ergene @Cyb3rMonk]

Most PHP runs on Linux, and MDE doesn't provide *VersionInfo* identifiers for processes running on Linux.

"Rather than broadly hunting...", the query below focuses on almost nothing but high-fidelity engagement. 🤡

(I can't reply to him as he blocked me)

[Doug Burks @dougburks]

Thanks for all the interest in SO-CRATES!

It is now over 3 million downloads!

[Black Hills Information Security @BHinfoSecurity]

New week, new things to learn! Kick off Monday with Talkin’ About [Infosec] News, get into containers and AI sandboxing with Jay Beale on Wednesday, then swing by Thursday’s BHIS Webcast to say hi. See you there!

https://t.co/FBXAC3Nknl

[Doug Burks @dougburks]

The perfect laptop doesn't exis-

oh yes it does!

@FrameworkPuter + OhMyDebn

[Doug Burks @dougburks]

What’s your perfect laptop?

I'll start:

@FrameworkPuter 13 Pro + Linux Mint + OhMyDebn + AI

Why this combo works:

• Build quality that feels premium
• Powerful CPU but stays quiet under normal use
• Keyboard and trackpad that just feel right
• Beautiful screen
• Hardware switches that kill the webcam and mic
• Modular ports (including 10G Ethernet)

Linux because a closed-source OS is still like buying a car with the hood welded shut.

And because the hood isn't welded shut, AI can help you customize your Linux distro, troubleshoot issues, and build the exact tools you need!

There are no good excuses left.

You can actually have your perfect laptop!

[Doug Burks @dougburks]

Linux, refined. 🐧

OhMyDebn 4.11.0 turns your Debian-based distro into a polished Cinnamon desktop: optional tiling, 23 themes, and AI coding agents one keypress away.

In this release: 32 fixes, 7 app updates.

Which distro would you put it on? #Linux

[Doug Burks @dougburks]

Linux, refined. 🐧

OhMyDebn 4.10.0 turns your Debian-based distro into a polished Cinnamon desktop: automatic tiling, 23 themes, and AI coding agents one keypress away.

New: Raspberry Pi OS on regular PCs, 12 fixes, 10 app updates.

Which distro would you put it on? #Linux

[Chris Sanders 🔎 🧠 @chrissanders88]

Investigation Scenario 🔎

While reviewing the ESXi hostd.log, an analyst spots a network file connection referencing a known VM disk, but at an unexpected path different from where it typically runs from:

/vmfs/volumes/BackupDS/temp/Finance01.vmdk

The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC