Jason Ostrom

Instructor and Author @SANSInstitute | Blue & Red Team | GoLang & Terraform| Builder of things | Husband & Father | #NHL #NFL | @[email protected]

[Jason Ostrom @securitypuck]

I’m super pumped to release v1.0 of my free Azure security tool (PurpleCloud) in the hopes that it will be useful to the InfoSec community evolving the so called “Purple Teaming” in the cloud!

Website: https://t.co/73mO8ahcQ4

[SANS Offensive Operations @SANSOffensive]

📣 Registration is OPEN for Hack & Defend Summit!

Join @Steph3nSim & @SecHubb on Oct 28-29 in Austin, TX, when Red & Blue unite to learn from each other, build better strategies, & create stronger defenses against real-world threats.

➡️ Learn More: https://t.co/lGc3a54n2x

[Jason Ostrom @securitypuck]

@fabian_bader @derdanu @fabian_bader Nice tool. Here is my cli tool GH:
https://t.co/IAwGmfPx67

[Jason Ostrom @securitypuck]

@fabian_bader @derdanu Very nice little web app tool. FYI, I coded a golang binary cli tool that hits the same Azure IP ranges endpoint. Good for a detection engineering enrichment for performant lookups at scale, single IP address, or large list. Supports multiple cloud providers and services.

[Jason Ostrom @securitypuck]

@fabian_bader @derdanu Github: https://t.co/IAwGmfPx67

[Jason Ostrom @securitypuck]

@mosesrenegade @fabian_bader Very interesting little tool. Edge already gathers all Azure IP ranges from the same endpoint. It's just a CLI tool for performant lookups at scale, single IP address or a large list.

[Jason Ostrom @securitypuck]

I just published this article - "Sentinel for Purple Teaming" https://t.co/Hyfgn6zpe2
Automates logging configuration to Sentinel. AD deployment. Explores different Managed Identities from a pentester lens.
#CloudSecurity #Azure #pentest #PurpleTeam

[Jason Ostrom @securitypuck]

You can run injects of user behavior and create the telemetry that will make your training very realistic. "GHOSTS Playground" is released under a permissive MIT license, allowing you control over what you do with it. Roll up your sleeves and check it out! PRs welcome and the docs show you how to customize.

[Jason Ostrom @securitypuck]

Releasing this security lab environment called "GHOSTS Playground" - it implements the "GHOSTS framework" - what is GHOSTS? Read on...
https://t.co/y3NvXBidI9
#purpleteaming #pentest

[Jason Ostrom @securitypuck]

Use this to conduct your own research for building out NPCs using LLMs. Build your own pentest learning lab, or use it to create a Purple Teaming lab or class. I've focused on the API and building out three options to use the NPC endpoints.

[Jason Ostrom @securitypuck]

@pwnEIP That’s awesome. I remember our adventures. You teaching?

[SANS Offensive Operations @SANSOffensive]

In this modern age, battles are fought on many fronts. In Chapter 1 of the Aviata Cloud Solo Flight Challenge workshop series, @mosesrenegade will show you how to look at a target organization's misconfigured public items, and more.

✍️ Register now: https://t.co/M7h0IMI4en

[Jason Ostrom @securitypuck]

@rootsecdev @SANSInstitute The link has been fixed for this @SANSOffensive workshop. The link was never supposed to expire. Generated a new link that shouldn't. Sorry about that. Here it is again: https://t.co/4ENC2svLfo

[Jason Ostrom @securitypuck]

@rootsecdev @SANSInstitute @SANSInstitute could we bring back that OVA link? I'll work on restoring the https://t.co/VDExjl7KGH. I accidentally deleted the VPS hosting it.

[Jason Ostrom @securitypuck]

@rootsecdev Hey saw your note over to @mosesrenegade . Believe it or not, I had that lab permanently hosted on a site and accidentally deleted it. Let me see if I can bring it back up soon. There was a workbook for it. I'll also ping SANS to see if they can bring back the OVA link.

[Jason Ostrom @securitypuck]

https://t.co/n4r0fpkQwC

[Jason Ostrom @securitypuck]

Just released an update to my Adversary-as-Code automated security lab. But seriously :-). Updated to latest Caldera 5.0 update. Added API cheat sheet in terraform for sending abilities. Been playing with sending techniques over an API, lots of potential here for automation + offensive security engineering...#mitre #purpleteaming

[Jason Ostrom @securitypuck]

Changes:
* Added TLS hosting with new Caldera 5.0 VueJS app. Fixed an issue missing in Caldera docs preventing remote hosting.
* Verified proper API for sending abilities against an agent. Added to terraform cheat sheet.
* Removed Prelude Operator