Ian Barton

DFIR | Hunter of Evil | Part-Time Splunk Wizard
Opinions = Own

[SwiftOnSecurity @SwiftOnSecurity]

Truly living with your toolset and _failing_ with it is a profound aspect of expertise. I doubt there have been any % of tech who were ever taught this. It's too dumb and obscure. You have to learn it by failing.

[SwiftOnSecurity @SwiftOnSecurity]

This is the Lock Picking Lawyer, and what I have for you today is a standard business desktop. I'm going to use a USB stick, which I of course sell on Covert Instruments dot com. I insert it, click the obfuscated batch script... and we're admin.

[nixCraft 🐧 @nixcraft]

date formats 😅

[Ian Barton @su_Tron]

@rpilocator Thanks @rpilocator ! Managed to place an order after hunting for months!

[Accidental CISO @AccidentalCISO]

One of the worst things you can do during an Incident Response scenario is to make assumptions.

Train your team to identify and question their assumptions.

[Jessie Frazelle @jessfraz]

How come there’s no reality TV show starring multiple programmers that get dropped into an unknown repo and have to fix a bug, the fastest one wins.

I’d watch that.

[Andrew Case @attrc]

If you work in #DFIR then you should read this -- really great work on a number of new attack and malware techniques:

https://t.co/y4xZPRCYu0

[Ian Barton @su_Tron]

Either way we've found another hobby that'll empty our wallets 🤣

[Ian Barton @su_Tron]

Took a miniature painting class this weekend with my wife. She's definitely more artsy than I am but I'd like to think my warrior (left) looks pretty good! #miniaturepainting

[Ian Barton @su_Tron]

@VickerySec @LitMoose Or government officials calling for investigations based on someone clicking F12 https://t.co/cLKWEnrGeO

[Ian Barton @su_Tron]

Everyone needs a double check at times. Here's Porky helping with my electrical (the circuit is of course off)

[Florian Roth ⚡️ @cyb3rops]

💛
https://t.co/9LTXfQZJVO

[Ian Barton @su_Tron]

@th3c0rt3x @LitMoose Here's the tweet that @LitMoose was mentioning for me! https://t.co/NiHDlIOUtJ

[Ian Barton @su_Tron]

I've been looking forward to the release of this article for a long time! Really happy to be able to share what myself and others from the CS Services team have seen in the field from this advanced adversary. #StellarParticle https://t.co/x2POvVw5R2

[Ian Barton @su_Tron]

For the record, I wanted to call the cookie theft/reuse technique something cool like "Cookie Monster" but fortunately @MITREattack already had the technique so no one in #DFIR will have to include my meme name in a report https://t.co/8mMYW7xxpS

[Ian Barton @su_Tron]

I've been looking forward to the release of this article for a long time! Really happy to be able to share what myself and others from the CS Services team have seen in the field from this advanced adversary. #StellarParticle https://t.co/x2POvVw5R2

[Ian Barton @su_Tron]

@LitMoose

[Florian Roth ⚡️ @cyb3rops]

What people seem to miss:
The #Log4Shell vulnerability isn't just a RCE 0day.
It's a vulnerability that causes hundreds and thousands of 0days in all kinds of software products.
It's a 0day cluster bomb.

[Sean Metcalf @PyroTek3]

Here's the really crazy thing:

NO service account should be in Domain Admins in 2021.

Take a journey with me in this Thread to see why...

[Matt Dahl @voodoodahl1]

Exchange