Ray Pugh III retweeted
#SOC caught attacker in #GCP when they issued API call to CreateServiceAccountKey via SDK from odd IP.
This triggered alert w/:
- IP enrichment
- Historical context for user/API
Team scoped & fixed.
Initial access? Exposed cred.
More details ⬇️
expel.com/blog/incident-repo…
Ray Pugh III retweeted
We'll look back in 10 years and credit the modern operations center to @jhencinski. If you lead a Security Operations Center - listen to his appearance on the @SecHubb/@SANSInstitute podcast:
sans.org/podcasts/blueprint/…
Ray Pugh III retweeted
Our first @expel_io annual report is here!
It includes data and insights on:
- BEC (public enemy #1)
- Pre-ransomware activity
- Supply chain attacks
- Cryptojacking
Our goal: translate the security events we’re detecting into strategy for your org.
expel.com/great-expeltations…
Ray Pugh III retweeted
Great eXpeltations 2022 has arrived!
Help your org manage risk with data and insights on the biggest #infosec threats, how to handle 'em, and what you can expect in the year ahead. Download it today at expel.com/great-expeltations…. #MDR #SOC #ransomware #cryptojacking #phishing #BEC
Ray Pugh III retweeted
#JobAlert: thrive working w/ others? Love destroying dreams of attackers? Dig working with a variety of tech at the intersection of detection & response automation and weaving it all together?
We're #nowhiring a Sr. Detection & Response Engineer: expel.io/about/careers/?gh_j… #hiring
Ray Pugh III retweeted
au·to·di·dact: a self-taught person
Teach yourself infosec!
The guide below from my friend @wifi_ve intends to provide a basic (and generally, free) set of resources for getting started with learning computer security.
teachyourselfinfosec.com/
Ray Pugh III retweeted
Anyone have a good experience with a managed vuln management (MVM) provider? If so, who did you use and what did you love about the service?
Also interested in folks that may have had bad MVM experiences. What didn't you get that you were hoping for?
Ray Pugh III retweeted
Quick 🧵of some of the insights and actions we're sharing with our customers based on Q2 '21 incident data.
TL;DR:
- #BEC in O365 is a huge problem. MFA everywhere, disable legacy protocols.
- We’re 👀 more ransomware attacks. Reduce/control the self-install attack surface.
Ray Pugh III retweeted
MS Defender for Identity helped us spot #redteam at a customer this week.
Lead: Suspected Kerberos SPN exposure
This was ~20 hours before we had any significant activity from an EDR integration.
Good example of the importance of being able to extend beyond EDR.
Ray Pugh III retweeted
The Global Response Team at @expel_io is hiring! If you’re a passionate incident responder or looking to blend in some blue to your red team skills — we’d love to talk to you!
👇Senior D&R Analyst role details:👇
expel.io/about/careers/?gh_j…
Ray Pugh III retweeted
Stopping REvil before ransom is great, but not why I joined @expel_io
I wanted to translate security events into strategy at scale
No, I don't want to keep sending incidents for <threat>
Instead, any incident is an op to help a customer improve
It's rewarding to 👀 progress:
Ray Pugh III retweeted
🎣 Expel for #Phishing 🎣
Your one-stop-shop for suspicious email investigations, featuring:
📜 Detailed findings reports
⚕️ Recommendations & remediation actions
📊 Easy-to-understand metrics & trends
Give the gift of 🕑 back to your #secops team: expel.io/cloud/managed-phish… #MDR
Ray Pugh III retweeted
"If you’re not using data to spot too much cognitive loading – or finding ways to free up mental capacity – that’s a recipe ripe for burnout 😭."
Tips and insights from @jhencinski & the @expel_io #SOC on metrics/techniques to protect against volatility: expel.io/blog/performance-me…
Ray Pugh III retweeted
If you have a #SOC #QC program be super transparent about the trend.
We wrote a #Slack bot that sends the #QC trend to the team each day. We talk about it. We plan. We adjust.
QC legend:
- 🔴 failed
- 🟢 passed
- ⚫ missed
Visualize. Review. Plan. Improve. Repeat.
Ray Pugh III retweeted
Come chat with me and the @expel_io team about threat detection and response in #AWS today at 11:00 AM EDT.
Format: Ask us anything! Bring questions. It'll be a conversation.
Sign-up: info.expel.io/AMA-June-3-Reg…
Ray Pugh III retweeted
Caveat: This is what we've found useful in our journey to better detect and respond in AWS and might not work for everyone. And yes, I did steal @jhencinski's effective tweet style 😀
Hope this is helpful!
Ray Pugh III retweeted
Love the team, love the culture we built, love the work we are doing. Stoked for what's next 🙌🙌🙌
techcrunch.com/2020/05/13/ex…