Ryan Alban

@Secureworks & @Dell #employee | Opinions expressed are my own. | Likes and Retweets are not endorsements.

[Ryan Alban @ralban]

@sherrod_im Bonus points for adding an acoustic coupler... How cool would it be to be on a Teams meeting and say, "Excuse me for a moment." go back, put it on a coupler, "OK, let's continue...." with no explanation

[Dr. Nestori Syynimaa @DrAzureAD]

Abusing #AzureAD / #EntraID Domain Services part 2 from @Secureworks is out now: Dumping NTHashes from Microsoft Entra ID

[Secureworks @Secureworks]

Secureworks has discovered that stored Microsoft Entra ID NTHashes can be recovered and decrypted & then used in pass-the-hash attacks. Read our latest Threat Analysis to discover how this happens & how to detect it.
https://t.co/pzHW3hIlBA
#azure #cybersecurity

[Ryan Alban @ralban]

@DrAzureAD @Secureworks That is a motley crew! Best of luck in the new role. I have no doubt you'll have a massive impact securing EntraID for all of us (#azureAD_4eva)

[Joosua Santasalo @SantasaloJoosua]

Our research at Secureworks about smuggling malicious apps into EntraID tenants while spoofing verified publisher status is now public. Microsoft implemented a fix so this is now mitigated. If you’d like to know all the details read the research here https://t.co/u0DpEeqpQY

[Joosua Santasalo @SantasaloJoosua]

⁦@DrAzureAD⁩ delivering the goods !

[W. Clay Moody @wclaymoody]

Alex is a great leader in our CTU and I know this will be a great presentation. https://t.co/BK1fcnlTSK

[W. Clay Moody @wclaymoody]

Are you ready to dive into the wild west of hacking #AzureAD identities? Join @DrAzureAD of Secureworks at the @WWHackinFest event and gain valuable insights into how Azure AD works and how to protect your organization. https://t.co/UgTdLT7nYD

[Dr. Nestori Syynimaa @DrAzureAD]

In this @MSFTBlueHat talk I'll share some "by design" war stories from me and fellow researchers. The cases demonstrate a scale of different outcomes of "by design" rulings. The purpose is to foster dialogue between @msftsecresponse and researchers to keep us all protected!
👉 https://t.co/802w1AK1vH

[Secureworks @Secureworks]

It's time for capture the flag! 🏃‍♀️🚩The contest went live today! Check your email for that link.

You can still register for the #TISummit23 to participate, test your skills and win up to $500! https://t.co/TGngmhNRgY

📆 October 4 | Virtual 💻
#cybersecurity #IncidentResponse

[Secureworks @Secureworks]

It's almost time for this year's capture the flag! 🏃‍♀️🚩

Register for this #TISummit23 activity and test your skills! 10 winners with prizes from $50 to $500 up for grabs!

📆 October 4 | Virtual 💻
Learn More: https://t.co/tPWfvzsBLZ

#CyberUnmasked #CTF @ireteeh @sallyeaves

[Ryan Alban @ralban]

@inversecos Congrats on the talk being accepted! Great topic. I hope I get to see a recording of it one day. Great job on rb podcast!

[Ryan Alban @ralban]

@SantasaloJoosua 😂, touché

[Ryan Alban @ralban]

@bettersafetynet Full disclosure, I work for @Secureworks. We offer MDR on our XDR: https://t.co/E6FFsKLayE
We consume raw telemetry from leading EDRs (Cb, S1, Cs, MS-D4E) + our own agent; Big 3 PaaS, Many SaaS; all the syslog. 1yr+ retention (hunt/comply), case mgmt, SOAR, TI, chat w/SOC & more

[Jake Williams @MalwareJake]

PSA: there is no AI-based tool that can "just stop ransomware" (or any other cyber intrusion for that matter). If such technology existed, wouldn't threat actors be using it? And why wouldn't they use it to bypass your blocking tool?

Thanks for coming to my TED talk...

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

Sometimes I *hate* this biz

Potential client called

Them: Hey, we have spikes in events that happen... sometimes we have a 4x over normal load.
Me: yeah, that can happen
T: so SIEM vendor wants us to 4x our capacity
M: Ugh. You might not need to go that route...

1

[vx-underground @vxunderground]

Ransomware, but instead of exfiltrating data and extorting your organization, the payload makes you use Confluence and Jira for 6 months

[Ryan Alban @ralban]

@CD_R0M_ Every Marylander after seeing your tweet... 😜

[Ryan Alban @ralban]

@robertgraham @SwiftOnSecurity I see this phenomenon in guitars too. Guitars are visual art, amazing craftsmanship, advancements of engineering, and... musical instruments. A $500 guitar can play and sound way better than a $5,000 guitar. Diminishing returns in the next $1 spent (for non art collectors).