Andrew Cook

Finding and stopping threats one day at a time, @Recon_InfoSec
SecOps. Threat Hunting. Incident Response.

[Andrew Cook @whoisAndrewCook]

@joevest @BSidesTampa I'll be there with a handful of @Recon_InfoSec folks, including @shortxstack and @eric_capuano!

[Andrew Cook @whoisAndrewCook]

@intigriti Here's @OpenAI's attempt at becoming a bug bounty hunter. How do we think it did? It certainly threw out a bunch of valid looking guesses, but did any come close enough to claim a win?

[Andrew Cook @whoisAndrewCook]

@SiriusCyberntx In general, tune the source whenever possible. That said, the real trick is having a process to tune false positives quickly and with minimal friction, which may mean “tactically” tuning at the SIEM where the workflow can be centrally managed and controlled.

[Andrew Cook @whoisAndrewCook]

Join now! Not recorded and @rj_chap will be dropping some ransomware knowledge bombs!

[Recon InfoSec @Recon_InfoSec]

Join us TODAY @ 12:30pm CT (in 2 hrs!) for THURSDAY DEFENSIVE!

Today's guest: @rj_chap, chatting about Ransomware.
https://t.co/L3LlAsyjK6

#infosec #thursdaydefensive

[Mark Tenenholtz @marktenenholtz]

Python 3.11 is out! 🎉

This is one of the most exciting releases in a while, including significant speed upgrades and better error messages.

Here's what's new:

[Andrew Cook @whoisAndrewCook]

As we watch Basic Auth in O365 finally start to die off, I find myself reflecting on how ridiculously long we've lived with MFA Bypass as a thing. Those incident & pentest findings were brutal for orgs that thought their heroic efforts to roll out MFA had done some good.

[Andrew Cook @whoisAndrewCook]

I can hear my high school physics teacher sigh every time

[Andrew Cook @whoisAndrewCook]

I thought "hey, maybe #Linux🐧is ready for regular people" and got my wife all set up👍

Two weeks later she's stuck in a black initramfs boot loop and I'm scrolling linux forums like it's 2007 to intone the right CLI-magic to fix the thing👎

Guess I'll try again in 3 more yrs🤷

[Andrew Cook @whoisAndrewCook]

Starting now! Not recorded, so be there or be square! #infosec #blueteam

[Recon InfoSec @Recon_InfoSec]

Join us TODAY @ 12:30pm CT (in 2 hrs!) for THURSDAY DEFENSIVE!

Today's guest: @_bromiley of @limacharlieio chatting about #DFIR , Blue Team, Defense, Giving Bad Guys Headaches.
https://t.co/HZVvY3blBE

#infosec #thursdaydefensive

[Andrew Cook @whoisAndrewCook]

@tuckner @JimmyVo @OpenAI Veerrry interesting. When your automation is creating your automation we're getting scary close to the singularity.

[Andrew Cook @whoisAndrewCook]

@JimmyVo you gave me an idea....will @OpenAI be writing our threat detections next? Here's a first attempt without any special training data; it seems to get the gist of it. Will we someday skip this human-centric step completely? #Blueteam #BlueteamAI

[Recon InfoSec @Recon_InfoSec]

Join us TODAY @ 12:30pm CT (in 2 hrs!) for THURSDAY DEFENSIVE!

Today's guest: @_bromiley of @limacharlieio chatting about #DFIR , Blue Team, Defense, Giving Bad Guys Headaches.
https://t.co/HZVvY3blBE

#infosec #thursdaydefensive

[Andrew Cook @whoisAndrewCook]

First one to tell me how @OpenAI will replace my #infosec job wins my eternal gratitude. I've got a mortgage to pay and food to eat.

[Andrew Cook @whoisAndrewCook]

@JimmyVo you gave me an idea....will @OpenAI be writing our threat detections next? Here's a first attempt without any special training data; it seems to get the gist of it. Will we someday skip this human-centric step completely? #Blueteam #BlueteamAI

[Andrew Cook @whoisAndrewCook]

Aachccccccucjrdciiindrlhrkrtifidrvdcdiltgrteuhoooo!

Gesundheit!

If you suffer from chronic #Yubisneeze, ask your doctor if Swapping Slots™ is right for you: https://t.co/vpd46kKtpy @Yubico

[Andrew Cook @whoisAndrewCook]

@alexstamos Hilariously well said. Also, you can bypass that dumb virtual keyboard manually and automagically. Your “secure” design shouldn’t encourage users to install random scripts :/ https://t.co/5k2xJzyxOP

[Wes Lambert @therealwlambert]

🦖Day 29 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: 'Exchange[.]Windows[.]Registry[.]NetshHelperDLLs'

Author: @eric_capuano

Link: https://t.co/KdfasizqCW

[Andrew Cook @whoisAndrewCook]

Messing around with @OpenAI looking for some interesting #BlueTeam use cases is like playing two truths and a lie: shocking accuracy followed complete fiction. Here's the (slightly modified) 2021 Kesaya attack as analyzed by a robot. Any lies? Try it out! https://t.co/D5TANJJxqn

[Andrew Cook @whoisAndrewCook]

@eric_capuano @Recon_InfoSec Thanks for the nudge, Eric! Just had to remember the ol' password...Winter2009! did the trick.

[Andrew Cook @whoisAndrewCook]

@Recon_InfoSec....are we the baddies? @OpenAI seems convinced that we're on the wrong team. 🤔 I don't know who to believe any more 😬 https://t.co/ZDGbwfgaJ3

[Andrew Cook @whoisAndrewCook]

figuring out what all this twitter buzz is all about