
Security Analyst, Threat Intelligence Analyst, SOAR Engineer, Cloud Technologist, Threat Hunter, More at @firstenergycorp. Husband, Father of 5 @ Home.
Joined June 2020
- Tweets80
- Following374
- Followers72
- Likes63
Chris Collins retweeted
cert.gov.ua/article/5702579 - Detection on --headless
DeviceProcessEvents
| where FileName contains "msedge.exe" or FileName contains "curl.exe"
| where InitiatingProcessCommandLine contains "--headless=new"
Chris Collins retweeted
MFA fatigue attacks 🔓
✅ PDF : lnkd.in/gp7HGJNw
If you want to know the number of times end-users have denied MFA notifications( MFA denials), you can use the query.
#XDR #EDR #MicrosoftSecurity #Defender #AAD #MFA #MFAfatigue #KQL #SQL #Kusto #365daysofADX #ADX
Chris Collins retweeted
You’re *almost* done with your SOC analyst interview.
You’re asked, “Do you have any questions for us?”
Here’s a couple to consider if not covered as part of the interview process (hint: they should be).
1. A year from now, this person has come in and absolutely knocked it out of the park. What does that look like? (You’ll learn what success looks like)
2. Conversely, 6 months from now, it didn’t work out-you have to move on from this person. What happened? (You’ll learn what failure looks like)
3. How would you describe the culture? And would you say you’re nurturing that culture or do you want to change it? (You’ll learn what it feels like when management isn’t in the room)
4. What do the career pathways look like for this role and how often are more senior roles filled via promo vs. outside hire? (You’ll understand what growth looks like)
5. Will the team be growing in size this year? If so, by how much? (Growing teams come with challenges but there’s also a ton of opportunity)
6. What does turnover look like? (If high, this could be a potential warning sign that things may be amiss)
Chris Collins retweeted
Active #malware samples detected on 2023-06-11 posted by MalwarePatrol on @AlienVault
otx.alienvault.com/pulse/648…
Chris Collins retweeted
Want to find the use of SharpHound/BloodHound in your environment? Look for file creation & deletion (via cmdline) that follows the below naming schema:
yyyyMMddhhmmss_<name>.zip
➡️ FileName regex - 202[0-9]{11}\_.*\.zip
➡️ File deletion regex - .*del/s+202[0-9]{11}\_.*\.zip.*
Chris Collins retweeted
meanwhile i'm over here on the other side of nostalgia
IT'S A WILD AND CRAZY NIGHT UP IN HERE
Please support Parker in Cub Scouts by buying popcorn (Seller Code QB1PQA): pecatonicariverpopcorn.com/m…
Chris Collins retweeted
Since I spend so much time talking to and researching SOCs and SOC analysts, I often get asked, "What the biggest difference is between high and low growth SOCs?"
The answer? Expectations.
1/
Chris Collins retweeted
Uhh...just no. I haven't spent years coaching myself to be more direct just to have a random graphic I see on Twitter undo all that work. It's fine to be direct. If I say "Per my last email" I'm probably pissed, and you should know that.
Don't be *that* person who comes across passive aggressive via Slack or email. 😅 cnb.cx/3hZFM8y
Chris Collins retweeted
Exchange pwnage and new webshells finally crossed the point where we decided to create a Reddit thread to keep the community posted: reddit.com/r/msp/comments/p8…
Chris Collins retweeted
Bonus #HuntingTipOfTheDay:
You know most executables end with .EXE - but that's not a requirement. You can execute files with any extension, or no ext at all!👀
Look for processes not ending with .EXE/COM/… and you may find 🔥
(Follow @JohnLaTwC for awesome daily tips!)
Chris Collins retweeted
#HuntingTipOfTheDay
You know command switches have shortcuts. e.g. for net.exe /domain and /do both work.
Did you know every switch to net.exe works like this as long as it unambiguously matches?
#AtomicRedTeam by @redcanary has you covered👍
📎github.com/redcanaryco/atomi…
Chris Collins retweeted
#HuntingTipOfTheDay
License key generators are very tempting. You might find some low hanging fruit if you search for a keygen. The keygen is one thing, but what comes with it is another 👀
Chris Collins retweeted
A sneak peek of #Sysmon for Linux 💥
Thank you @kevsecurity for your hard work and for sharing your research @eBPFsummit ! #ebpf #eBPFSummit
🚨 Release scheduled for early October 2021 🚨
Looking forward to it 🍻 #MSTIC R&D team 😎
C'mon @MsftSecIntel why is CyberChef flagged as malware? @GCHQ
Chris Collins retweeted
#HuntingTipOfTheDay
InstallUtil is a popular living-off-the-land binary for running payloads (🙏 @subtee). Have a hunt for unusual parent processes and low prevalence /u param locations.
📎lolbas-project.github.io/lol…
👉blackhillsinfosec.com/powers… 🙏 by @fullmetalcache (@BHinfoSecurity)
Chris Collins retweeted
We always wanted a reference for Windows Logon types and credentials that can be extracted for each one. So @chiragsavla94 wrote one!
#RedTeam #ActiveDirectory #Windows
alteredsecurity.com/post/fan…
Chris Collins retweeted
#HuntingTipOfTheDay
If you write SIEM rules for Windows, this is the one blog you 💯need to read this week by @Wietze 🙏
👉xitter.cf/Wietze/status/14185623…
📎wietzebeukema.nl/blog/window…
📎github.com/wietze/windows-co…
h/t @Dinosn @DissectMalware 🙏
After some digging, I found that nearly every common lolbin has command-line features that can be abused to frustrate detection.
How much of your detection content would still work if command-line obfuscation was used? 🔣
Full blog post here👉 wietze.github.io/blog/window…
Chris Collins retweeted
Ransomware group drama.
RAMP, the forum started by Babuk ransomware group, has seen a surge of flooding and spamming. An unknown individual is stating they have 24 hours to pay $5,000 or else.
Ransomware actors are ransoming other ransomware actors.






































