@GlassSec

DFIR Dude

 Virginia
jon.glass
Joined March 2014
  • Tweets1K
  • Following587
  • Followers497
121Media
Half Full of Security retweeted
Ali Hadi | B!n@ry@binaryz0ne18 Feb 2023
First video about MBR drive layouts. #DFIR "Fixing a Corrupted MBR Drive - Case #1" youtube.com/watch?v=w2wcW3rc…
1
14
61
7,811
Half Full of Security retweeted
proxylife@pr0xylife28 Dec 2022
#Qakbot - azd - .pdf > .url > .zip > .img > .lnk > .cmd > .dll (27.12.2022) cmd.exe /c RulesChanges_SVX8.lnk cmd.exe /c RecentInformation.cmd rundll32 /s directcontract.dll,Updt Samples 👇 bazaar.abuse.ch/sample/b46c7… bazaar.abuse.ch/sample/1bcb3… IOC's github.com/pr0xylife/Qakbot/…
28
103
18,042
Half Full of Security retweeted
Hasan Toor
@hasantoxr11 Nov 2022
Stanford University is offering free online courses. No application or fee required. Here are 5 FREE courses you don't want to miss:
672
8,861
185
30,750
Half Full of Security retweeted
Hacking Articles
@hackinarticles17 Sep 2022
Best of OSCP Linux Command Cheat Sheet (Part 1) Credit @fr0gger_ #infosec #cybersecurity #cybersecuritytips #pentesting #oscp #redteam #informationsecurity #cissp #CyberSec #networking #networksecurity #CheatSheet #infosecurity #cyberattacks #security #vulnerabilities
11
244
4
952
Half Full of Security retweeted
Germán Fernández
@1ZRR4H10 Sep 2022
#Qakbot post-compromise discovery commands: net view cmd /c set arp -a ipconfig /all nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP net share net1 share route print netstat -nao net localgroup whoami /all #recon #discovery
68
2
236
The difference between Windows and Linux...
146
1,657
161
16,769
Half Full of Security retweeted
DFIR Training
@DFIRTraining3 Sep 2022
13
102
8
636
Half Full of Security retweeted
DFIR Diva@DfirDiva1 Sep 2022
I just updated the Incident Response Training Plan using free courses, starting from complete beginner to IT. (Fixed broken links, replaced/added courses, removed things that were no longer free) dfirdiva.com/free-incident-r… #DFIR #incidentresponse
2
52
150
Half Full of Security retweeted
Dr. Tech
@doctechmd31 Aug 2022
Programming meeting
167
1,849
225
10,282
Half Full of Security retweeted
Ken Westin@kwestin26 Aug 2022
Really a lot of Infosec is fucking around and finding out.
10
24
5
225
McAfee antivirus 😅
39
194
42
1,140
Half Full of Security retweeted
Renzon
@r3nzsec8 Aug 2022
ZIP > ISO > .LNK > Bumblebee .dll file > Cobalt Strike > AnyDesk > Adfind > VulnRecon > Procdump > Seatbelt > Invoke-kerberoast.ps1 > PS Cobalt Strike payload > Lolbins What a great report to start our Monday! Thanks, @TheDFIRReport, as always! #dfir thedfirreport.com/2022/08/08…

BumbleBee Roasts Its Way to Domain Admin - The DFIR Report

In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022....

thedfirreport.com
2
176
5
493
Half Full of Security retweeted
Bryce@bryceabdo3 Aug 2022
the SOC when an alert for suspicious powershell usage hits the queue
48
393
51
2,032
Half Full of Security retweeted
Hillary Clinton
@HillaryClinton3 Jun 2022
No one actually needs an AR-15.
39,117
19,608
9,457
208,395
Half Full of Security retweeted
Martin Tartarelli
@tartamar4 Jun 2022
We need more Security Engineers! #BSidesSF
36
282
43
1,476
Half Full of Security retweeted
Ólafur Waage@olafurw1 Jun 2022
Off by one
Sabrina
@sabrinaesaquino1 Jun 2022
Make a programmer cry with 4 words
27
269
6
2,061
Half Full of Security retweeted
Adam Parkhomenko
@AdamParkhomenko4 May 2022
Republicans are getting very upset people keep retweeting this ad so I figured I would post for any of you who haven’t seen it yet and then I am going to retweet myself tonight.

#GOPHandmaidsTale

It's time to organize. Consider chipping in at the link in this video to fuel our important efforts to defeat Republicans in the midterms.

3,443
52,943
7,343
70,638
Half Full of Security retweeted
Taz Wake@tazwake26 Apr 2022
Another DFIR reminder. Your Incident Manager (and arguably most individual responders) do NOT need direct access to all the things. The MANAGER should be running things, not connecting and getting data. Your responders should focus on expert knowledge areas, not collection.
7
17
3
91
BREAKING: Florida bans programming books that mention race conditions.
98
833
142
8,606
Half Full of Security retweeted
Taz Wake@tazwake19 Apr 2022
Disclaimer: I hate "metrics" and think they are a useless curse on #CyberSecurity #infosec However, I am in a minority. What would be your #1 metric for Incident Response and why? #dfir
59
11
4
104
Load more