Craig Chamberlain

Causality engineer, fmr principal at QRadar, Elastic, Uptycs. Working on applying AI and ML to threat hunting. Organizer of openDR:

[Craig Chamberlain @randomuserid]

Usually I would be at summer camp but I have too much to do this year. So I made this agent based tooling to write long form analysis reports. Runs in a notebook or via command line.

https://t.co/ejCWOcbkMG

https://t.co/qJuCX99PMS

[Craig Chamberlain @randomuserid]

@brettshavers Interested

[Wes Lambert @therealwlambert]

Come join us online or in-person in Atlanta!
https://t.co/PRKhe76WNQ

[Craig Chamberlain @randomuserid]

[blog] Detection Lattices For Emerging Threats: “Dirty Frag”
https://t.co/lnlxQTbSKy

[Craig Chamberlain @randomuserid]

Stand back, I am about to determine the maximum ingest rate on a Jupiter farm with 128 cores and a terabyte of RAM

[Craig Chamberlain @randomuserid]

@JakeKing Thanks! This is what I am using to find detection resistant threat activity. I’m finding things none of the major products find. Will have an announcement next month

[Craig Chamberlain @randomuserid]

[blog] we just published this b/c I think it may be one of the best examples so far. This is the first real post about this project now that we can open up more;

Hunting and Detecting the Copy Fail Exploit With PROTOSTAR Detection Lattices: https://t.co/eW3uG1LtEf

[Craig Chamberlain @randomuserid]

@MalwareJake I have a feeling you’re right about their capabilities having been degraded and if so that is good news and I will take it. I’m not super concerned about external DDoS attacks in general, I think crews persisting inside networks would be my main problem. If they still have some.

[Craig Chamberlain @randomuserid]

@stephanpastis I give my name as Rock (my name apparently means a rocky outcropping in old English) I gave up a long time ago trying to make my first or last name spelled or pronounced

[Craig Chamberlain @randomuserid]

@_dirkjan

[Craig Chamberlain @randomuserid]

@HackingDave Advance team for the annexation of Canada? Or maybe Panama

[Craig Chamberlain @randomuserid]

@cyb3rops What data types are available for writing detection on? Network data I suppose but is there any host data that can be instrumented and used?

[Craig Chamberlain @randomuserid]

@HackingDave @amrittsering If you bought one of those, made to look like a clown, and brought it home, it might eventually cure your clown phobia. Might take a few months

[Craig Chamberlain @randomuserid]

@gabsmashh

[Craig Chamberlain @randomuserid]

@BBarronn @dtoxmilenko @evilsocket Next up: a client side RCE in Linux sound card drivers

[Craig Chamberlain @randomuserid]

@csoandy @securityweekly Firewall bypass..their firewall change was rejected and they realized they could get a network cabling change approved / done

[Craig Chamberlain @randomuserid]

Anyone else notice something in these numbers that is not being talked about? Ignore the candidate numbers for a moment and look again
https://t.co/WGZHfsn4qC

[Craig Chamberlain @randomuserid]

@gunsnrosesgirl3 99% of reported alien sightings now explained?

[Craig Chamberlain @randomuserid]

@HackingDave Maybe they have you on some kind of VIP list of persons needing special or extraordinary fraud protection. Can you make contact with their security team or CSO