Security Analyst, Threat Intelligence Analyst, SOAR Engineer, Cloud Technologist, Threat Hunter, More at @firstenergycorp. Husband, Father of 5 @ Home.

Joined June 2020
cert.gov.ua/article/5702579 - Detection on --headless DeviceProcessEvents | where FileName contains "msedge.exe" or FileName contains "curl.exe" | where InitiatingProcessCommandLine contains "--headless=new"
1
1
408
Chris Collins retweeted
MFA fatigue attacks 🔓 ✅ PDF : lnkd.in/gp7HGJNw If you want to know the number of times end-users have denied MFA notifications( MFA denials), you can use the query. #XDR #EDR #MicrosoftSecurity #Defender #AAD #MFA #MFAfatigue #KQL #SQL #Kusto #365daysofADX #ADX
2
25
86
8,061
Chris Collins retweeted
You’re *almost* done with your SOC analyst interview. You’re asked, “Do you have any questions for us?” Here’s a couple to consider if not covered as part of the interview process (hint: they should be). 1. A year from now, this person has come in and absolutely knocked it out of the park. What does that look like? (You’ll learn what success looks like) 2. Conversely, 6 months from now, it didn’t work out-you have to move on from this person. What happened? (You’ll learn what failure looks like) 3. How would you describe the culture? And would you say you’re nurturing that culture or do you want to change it? (You’ll learn what it feels like when management isn’t in the room) 4. What do the career pathways look like for this role and how often are more senior roles filled via promo vs. outside hire? (You’ll understand what growth looks like) 5. Will the team be growing in size this year? If so, by how much? (Growing teams come with challenges but there’s also a ton of opportunity) 6. What does turnover look like? (If high, this could be a potential warning sign that things may be amiss)
7
63
6
512
110,971
Active #malware samples detected on 2023-06-11 posted by MalwarePatrol on @AlienVault otx.alienvault.com/pulse/648…
1
1
215
Chris Collins retweeted
Want to find the use of SharpHound/BloodHound in your environment? Look for file creation & deletion (via cmdline) that follows the below naming schema: yyyyMMddhhmmss_<name>.zip ➡️ FileName regex - 202[0-9]{11}\_.*\.zip ➡️ File deletion regex - .*del/s+202[0-9]{11}\_.*\.zip.*
4
46
222
meanwhile i'm over here on the other side of nostalgia IT'S A WILD AND CRAZY NIGHT UP IN HERE
9
8
73
Please support Parker in Cub Scouts by buying popcorn (Seller Code QB1PQA): pecatonicariverpopcorn.com/m…
1
1
Since I spend so much time talking to and researching SOCs and SOC analysts, I often get asked, "What the biggest difference is between high and low growth SOCs?" The answer? Expectations. 1/
6
35
6
160
Uhh...just no. I haven't spent years coaching myself to be more direct just to have a random graphic I see on Twitter undo all that work. It's fine to be direct. If I say "Per my last email" I'm probably pissed, and you should know that.
Don't be *that* person who comes across passive aggressive via Slack or email. 😅 cnb.cx/3hZFM8y
22
21
5
341
Exchange pwnage and new webshells finally crossed the point where we decided to create a Reddit thread to keep the community posted: reddit.com/r/msp/comments/p8…
2
60
1
137
Chris Collins retweeted
Bonus #HuntingTipOfTheDay: You know most executables end with .EXE - but that's not a requirement. You can execute files with any extension, or no ext at all!👀 Look for processes not ending with .EXE/COM/… and you may find 🔥 (Follow @JohnLaTwC for awesome daily tips!)
4
39
2
141
Chris Collins retweeted
#HuntingTipOfTheDay You know command switches have shortcuts. e.g. for net.exe /domain and /do both work. Did you know every switch to net.exe works like this as long as it unambiguously matches? #AtomicRedTeam by @redcanary has you covered👍 📎github.com/redcanaryco/atomi…
3
40
2
95
Chris Collins retweeted
#HuntingTipOfTheDay License key generators are very tempting. You might find some low hanging fruit if you search for a keygen. The keygen is one thing, but what comes with it is another 👀
3
18
81
A sneak peek of #Sysmon for Linux 💥 Thank you @kevsecurity for your hard work and for sharing your research @eBPFsummit ! #ebpf #eBPFSummit 🚨 Release scheduled for early October 2021 🚨 Looking forward to it 🍻 #MSTIC R&D team 😎
5
150
6
323
C'mon @MsftSecIntel why is CyberChef flagged as malware? @GCHQ
Chris Collins retweeted
#HuntingTipOfTheDay InstallUtil is a popular living-off-the-land binary for running payloads (🙏 @subtee). Have a hunt for unusual parent processes and low prevalence /u param locations. 📎lolbas-project.github.io/lol… 👉blackhillsinfosec.com/powers… 🙏 by @fullmetalcache (@BHinfoSecurity)
40
96
Chris Collins retweeted
#HuntingTipOfTheDay If you write SIEM rules for Windows, this is the one blog you 💯need to read this week by @Wietze 🙏 👉xitter.cf/Wietze/status/14185623… 📎wietzebeukema.nl/blog/window… 📎github.com/wietze/windows-co… h/t @Dinosn @DissectMalware 🙏
After some digging, I found that nearly every common lolbin has command-line features that can be abused to frustrate detection. How much of your detection content would still work if command-line obfuscation was used? 🔣 Full blog post here👉 wietze.github.io/blog/window…
49
138
Ransomware group drama. RAMP, the forum started by Babuk ransomware group, has seen a surge of flooding and spamming. An unknown individual is stating they have 24 hours to pay $5,000 or else. Ransomware actors are ransoming other ransomware actors.
11
58
20
216