Staff Threat Detection Engineer @Chainalysis and 179CPT Cyber Operations Technician 170A @MOARNG
Joined April 2017
- Tweets621
- Following1.1K
- Followers2K
- Likes16.6K
DefSecSentinel retweeted
🏈 Calling the infosec community! We had a spot open up to round out Year 4 of the "Secure the Ball" fantasy football league. If you love to talk shop, ball, and trash - join us!
⚠️ There are punishments
🙋🏻♂️ DM me for details
#infosecfantasyfootball #fantasyfootball
DefSecSentinel retweeted
Just announced: talks for #OBTS v9 🥳
Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more!
Check out the full lineup:
objectivebythesea.org/v9/tal…
Which one(s) are you most looking forward to!? 🤔
DefSecSentinel retweeted
Elastic Defend 9.5.0 now carries the taint state on Linux kernel module loading events.
I loaded Singularity (the stealthiest open source rootkit I know). On load, it hides from lsmod, /proc/modules, and /sys/module, resets the kernel taint mask to 0, and filters "taint" and its own name out of dmesg, journalctl -k, and klogctl.
Even though the system looked clean, detecting the tainted flag on the loading event already exposed it.
What is even more suspicious? The endpoint recorded this module loading out-of-tree and unsigned. The live host says the mask is 0, and taint is sticky by design, so that needs explaining and is a good hunting reference.
One caveat, because this is not a rule to switch on blind: OE is also what a DKMS build, an out-of-tree GPU driver, or a third-party filesystem module produces. Baseline the modules you load on purpose, then investigate what is left. Enforcing module signatures shrinks it further, since an unsigned module then fails to load.
Rule PR and references in the reply.
#Linux #DetectionEngineering #ThreatDetection #DFIR #Rootkits
DefSecSentinel retweeted
Seen in the wild in REF6138. Full teardown, including the kernel-process masquerade and the detections: elastic.co/security-labs/bet…
Rules that fire:
• Executable Masquerading as Kernel Process: github.com/elastic/detection…
• Process Masquerading as Kernel Process (Defend): github.com/elastic/protectio…
• Network Activity Detected via Kworker: github.com/elastic/detection…
DefSecSentinel retweeted
@SBousseaden and I did some investigations into Tycoon 2FA recently. Focused on the infrastructure, how the kit works for not only M365, but Google Workspace as well. Made a few detections for each platform. Give it a read. Hope you enjoy. #phishing #threatdetection
Happy Hunting!
elastic.co/security-labs/tyc…
DefSecSentinel retweeted
MiniPlasma LPE exploit works perftectly. Elastic Defend behavior protection catches the exploit primitives involved in the chain, providing detection coverage even against fresh public exploit.
github.com/Nightmare-Eclipse…
DefSecSentinel retweeted
We just posted some additional detection guidance for #CopyFail and #DirtyFrag using EQL, ES|QL and Auditd detection rules/hunts + mitigations. Find them below!
elastic.co/security-labs/cop…
New DirtyFrag PoC is also detected by our previously released Linux privilege escalation detection👀
That’s the advantage of focusing on the underlying privilege escalation pattern instead of a single exploit.
You can find the rule here: github.com/elastic/detection…
DefSecSentinel retweeted
Detection guidance for CopyFail (CVE-2026-31431) and DirtyFrag (ITW Linux page cache LPE): EQL, ES|QL, and auditd detection rules and hunts included:
elastic.co/security-labs/cop…
DefSecSentinel retweeted
good to see EXISTING Elastic generic privesc behavior detection/protection triggering on the RedSun LPE exploit with no prior knowledge of the vuln-details.
github.com/elastic/protectio…
New blog post is up, exploring detection options for some recent In- the- Wild Windows LPE 0- days
elastic.co/security-labs/itw…
DefSecSentinel retweeted
google workspace logs from reports API...
here's a simple query (Elastic) to check for the vercel 3rd-party OAuth app auth event:
```
data_stream.dataset: "google_workspace.token" and event.action: "authorize" and google_workspace.token.client\.id: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent\.com
```
from there, the same app ID shows up in a few other GWS fields/datastreams:
- token\.app_name -> human-readable app label
- drive.originating_app_id: 110671459871 -> every file the app viewed/downloaded/copied (prefix only, it's typically the GCP project number IIRC)
- admin.oauth2.application\.id / .name -> admin-side OAuth approvals + domain-wide delegation grants
for everything else (gmail, login, meet, chat, calendar, groups, DLP rules) I'd try actor pivot on source.user.\email + a time window around the consent event (reports API can lag up to 3 days, so go wide and check ingestion).
good luck hunters!
#Vercel #GoogleWorkspace #threathunting
DefSecSentinel retweeted
Attackers in containers don't leave persistent artifacts. No files on disk. No post-incident logs. Just short-lived runtime behavior.
Traditional detection approaches weren't built for this. Defend for Containers is.
@RFGroenewoud published a deep-dive on how D4C captures runtime signals inside containerized Linux workloads, and how to build detection logic on top of it.
The key things D4C gives you that you don't get elsewhere:
- process.interactive flags hands-on-keyboard activity in production containers — rare and high-signal
- Linux capability fields (effective + permitted) let you assess actual exploit potential, not just process names
- Every event enriched with pod name, namespace, cluster, and privilege context
- Policy wildcards let you scope detections to specific images, namespaces, or directory trees
go.es.io/48sPCtC
DefSecSentinel retweeted
New #research together with @SBousseaden and @DanielStepanic at @elasticseclabs.
We uncovered a campaign abusing Obsidian plugins and vault feature to deliver multi-platform payloads targeting both #Windows and #macOS.
The final stage is #PHANTOMPULSE, an AI-built RAT that resolves its #C2 from Ethereum blockchain transactions and its loader #PHANTOMPULL
A deep dive into the RAT internals is coming next. Stay tuned.
elastic.co/security-labs/pha…
DefSecSentinel retweeted
We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto.
The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault.
Full analysis: go.es.io/4cld0dB
DefSecSentinel retweeted
It seems possible that clickfix malware is already switching tactics to evade the new Terminal copy/paste security feature in macOS 26.4.
ClickFix techniques are evolving.
Instead of copy and paste instructions to Terminal, newer variants are using Script Editor to execute payloads on macOS.
Read more about this delivery technique in our latest blog post.
jamf.com/blog/clickfix-macos…
#clickfix #malware #threathunting
DefSecSentinel retweeted
New research by @JamfThreatLabs around evolving ClickFix techniques using Script Editor, perhaps they have a reason to move away from Terminal recently!
ClickFix techniques are evolving.
Instead of copy and paste instructions to Terminal, newer variants are using Script Editor to execute payloads on macOS.
Read more about this delivery technique in our latest blog post.
jamf.com/blog/clickfix-macos…
#clickfix #malware #threathunting
DefSecSentinel retweeted
Follow our research with the new @JamfThreatLabs handle! We may also share some additional intel on the macOS threat landscape from time to time!
DefSecSentinel retweeted
One of our researchers built an AI powered supply chain monitoring tool on a Friday afternoon.
The following Monday night it caught the Axios npm compromise before most people knew it existed.
Elastic Security Labs is open sourcing the tool.
Full story by @dez_ here: go.es.io/4bOfsuq
DefSecSentinel retweeted
New blog post - prioritizing alerts triage with higher-order detection rules
elastic.co/security-labs/hig…
DefSecSentinel retweeted
New blog: Hooked on Linux - Rootkit Detection Engineering
Part 2 of our rootkit series focused on detection. We show why static indicators fail and how to detect rootkits through runtime behavior (eBPF, ftrace, io_uring, module loads, and more).
elastic.co/security-labs/lin…
