Wes Riley

DFIR and all that goes with it. Eve Online player, Harley rider, and lover of various firearms. Opinions are my own and guaranteed to be useless.

[Wes Riley @wesleyriley]

Hoping someone finds this useful: Just posted a paper from @RSAsecurity IR (my team) into one of my Carbanak/FIN7 cases from this year. #DFIR
https://t.co/2ubC1jxsTl

[Wes Riley @wesleyriley]

@MalwareJake What the fuck did I just read?

[Wes Riley @wesleyriley]

@0xMatt "Love puzzles, burnout? Join DFIR!"

[Wes Riley @wesleyriley]

@ItsReallyNick What the fuck did I just watch? It sounds like someone opened the first chapter of a Networks 101 class and started reading random words...

[Jake Williams @MalwareJake]

That's terrifying.

[Wes Riley @wesleyriley]

@IanColdwater Adding CISSP to this as well, as generally bears little weight for most practioners at the technical/analyst level. Just hand me some malware, PCAP, and/or logs, Ill whip you up an analysis, and we can interview off that.

[Wes Riley @wesleyriley]

@mikemillercyber Also, on the hiring orgs side: Practicums. Please, practicums. No matter how much help I get, I cant make a "good" resume. But not applying for resume maker, applying for analyst role. A standard problem set will allow ppl to show what they can *actually* do in the job.

[Wes Riley @wesleyriley]

@MalwareJake Had one place use same company for phishing testing and email notification for legit corporate training. The phishing got more responses than the legit corporate training mail.

[Wes Riley @wesleyriley]

@JackRhysider "You denied that request, sir/ma'am..."

(In reply to being asked why the necessary gear/training was not available to detect or respond to an active or newly-discovered breach)

[Wes Riley @wesleyriley]

@hacks4pancakes Pretty sure that's just free training...hell, could probably count it towards CPE credit lol

[Wes Riley @wesleyriley]

@FrankMcG Oh yeah, way under that. Though to be fair, I'm just getting back on here, and I give no guarantee that any of my shitposts are useful lol

[Wes Riley @wesleyriley]

A little review of the SUPERNOVA webshell reported to have been used in recent SWinds/FEYE compromise: https://t.co/K0pXWLf1BD #apt29 #DFIR #SolarWinds #UNC2452 #FireEye

[Wes Riley @wesleyriley]

@EpicNameBro Love it! Hope y'all are doing well, and give us a yell next you're in town!

[Wes Riley @wesleyriley]

@MalwareJake Also, no one that owns an AR-15 platform runs it stock, and that thing is straight out of the box. $20 says he thinks his finger is currently on the charging handle....

[Wes Riley @wesleyriley]

@EpicNameBro Well, Animal Crossing is a perfect segway to Doom...proper application of a shotgun to a demon or zombie is one of those life skills that you never know when it might come in handy.... :)

[Wes Riley @wesleyriley]

@A_dmg04 @Bungie @thislukesmith Will it ever be possible to look like a D1 Titan in D2 while actually being a Titan? Lots of us Titans really, *really* miss it...and it's been 3 years... https://t.co/m66VuL4BeP

[Wes Riley @wesleyriley]

@EpicNameBro President Whitmore 2020 confirmed lol :)

[Lesley Carhart @hacks4pancakes]

I can’t believe I have to say this, but if your reaction to finding out someone is actively seeking treatment for a mental health or substance abuse problem is to fire/disown/demote/evict them, you’re in no way supporting their recovery or encouraging other people to seek help.

[Wes Riley @wesleyriley]

@Maliciouslink Don't forget 10 years in:
- machine learning
- statistic
- data sciences
- preferring mustard on your hamburger
- beard growth
- writing all code exclusively in vi with no syntax highlight
- CI/CD
- EDR
- NGAV
- EIEIO

...and partridges req'd, but pear trees preferred...

[Wes Riley @wesleyriley]

@chrissistrunk @BSidesJackson @Krelkci @SecurityBSides Did you not get my submission? I know you for sure at least had one, cause that was me lol

[Wes Riley @wesleyriley]

@jmyers36 Thank you sir! :)