@DetectorRector

Detection Lead @ Mandiant Managed Defense / Former IR Consultant @mandiant. Tier 3 Hipster; I came in like a #WrectorBall

 San Francisco, CA
Joined July 2012
  • Tweets318
  • Following409
  • Followers1.3K
40Media
I’m proud to present ProtoBurp, a new Burp Suite extension to help encode and fuzz Protobuf messages based on pain points with existing tooling. Check out my latest blog post about it! dillonfrankesecurity.com/pos… #pentesting #burpsuite #protobuf #offsec

ProtoBurp: Encode and Fuzz Custom Protobuf Messages in Burp Suite

Background Protocol Buffers (Protobufs) are a language agnostic data serialization format that allow data to be safely and efficiently trasmitted or stored. Protobuf usage has exploded within the...

dillonfranke.com
2
43
1
134
18,276
.@FireEye is celebrating+affirming #LGBTQPride with 2 online events featuring US Junglist @jordanalesesne! 🎙 Zoom Mon 6/21, 11AM PT / 2PM ET Register below 🔊 90-minute #UKG x #DnB DJ set: Fri 6/25, 7PM PT / 10PM ET Live link in flyer/registration tinyurl.com/FireEyePride2021…
1
24
8
23
🚨🚨 New technique to steal AD FS secrets over the network. Defenders need to block internal traffic to AD FS servers over port 80 now! Read more: fireeye.com/blog/threat-rese… shoutout to @DrAzureAD who had the same though to look into AD FS replication and all his great work! 1/3

Mandiant Cybersecurity Consulting

Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.

cloud.google.com
6
249
17
511
Check out my latest blog together with @samsabetan! Things you'll learn about in this 2 part series: PCB inspection, UART debugging, NAND basics, chip off, firmware extraction/parsing, glitch attacks, and some RCE for the cherry on top: fireeye.com/blog/threat-rese…
1
11
2
31
Andy Rector retweeted
Saijak@Sa1jak20 Jan 2021
Another opening on my team at @Mandiant Managed Defense (this one is remote)! #mdr #infosecjobs #BlueTeam jobs.smartrecruiters.com/Fir…
8
13
Andy Rector retweeted
Glenn@hiddenillusion11 Oct 2018
Policy as Code Bot (PacBot) - a platform for continuous compliance monitoring, compliance reporting & security automation for #aws. intro: opensource.t-mobile.com/blog… code : github.com/tmobile/pacbot
2
2
Andy Rector retweeted
ʎppɐɯɔ@cmaddalena12 Sep 2018
I wrote a primer for cloud services, focusing on security issues related to storage and VMs, for the @SpecterOps blog. As a bonus, there are three cheatsheets (that will be updated) with tools, useful commands, and detailed info for AWS, Compute, and Azure:posts.specterops.io/head-in-…
6
125
1
221
Andy Rector retweeted
x0rz@x0rz6 Sep 2018
Curated list of Unix binaries that can be exploited to bypass local security restrictions 👍 gtfobins.github.io/ #LOLBins #unix #pentest #redteam
6
543
13
1,074
26 minutes of well-architected security for your Tuesday! Webinar: Get Started with Well-Architected Security Best Practices - amzn.to/2PMdfDB
30
61
Windows Event ID 4624 displays a numerical value for the type of login that was attempted. These numbers are important from a forensic standpoint but also for understanding credential exposure and mitigating risks. Descriptions in replies.
20
550
74
1,534
Andy Rector retweeted
Glenn@hiddenillusion23 Aug 2018
Interesting to see the path away from GRR & OSQuery… code : gitlab.com/velocidex/velocir… #DFIR
Uptycs - CNAPP for Hybrid Cloud Security@uptycs23 Aug 2018
Velociraptor Incident Response bit.ly/2Mv4KyH @wiredaemon
4
5
Worth noting: detection != alert. @MITREattack mitre.org/capabilities/cyber…
2
19
42
The Art of Detecting Kerberoast Attacks buff.ly/2k2UgWy << @Ben0xA does a good job of showing a methodology for narrowing the focus on noisy Windows events (like EID 4769 ticket requests)
1
130
1
222
Andy Rector retweeted
Sean Metcalf
@PyroTek32 Aug 2018
Replying to @mikhail_khusid @jepayneMSFT
Advanced auditing reference: docs.microsoft.com/en-us/win… Windows 10/2016 security auditing & monitoring reference Word document microsoft.com/en-us/download…
1
16
23
Andy Rector retweeted
Wyv3rnSec@Wyv3rnSec2 Aug 2018
Windows timestamp documentation is everywhere! How about some love for Linux, specifically EXT4 and my personal curiosity into the "born" date or "CR". This is my personal testing let me know if you have other results. #infosec #DFIR
5
113
11
204
Whenever someone asks me for public #Hardening Guides I send him a link to the @CISecurity Benchmarks > do you know other public hardening guides? learn.cisecurity.org/benchma…
11
59
1
101
Andy Rector retweeted
Glenn@hiddenillusion30 Jul 2018
EventCleaner - A tool mainly to erase specified records from Windows event logs : github.com/360-A-Team/EventC… #dfir
18
24
Exploring PowerShell AMSI and Logging Evasion blog.xpnsec.com/exploring-po… via @_xpn_
43
57
Andy Rector retweeted
Glenn@hiddenillusion17 Jul 2018
Netflix Cloud Security SIRT releases Diffy: A Differencing Engine for #dfir in the Cloud : medium.com/@NetflixTechBlog/…
12
30
Andy Rector retweeted
Sean Metcalf
@PyroTek317 Jul 2018
If you are looking to deploy Windows 10 & need security configuration guidance, the Microsoft Windows 10 security baseline is a great start. Link is to the Win10 v1803 security baseline: blogs.technet.microsoft.com/… Thanks @AaronMargosis for continuing to put this guidance together!
3
117
235
Load more