Security architect and researcher with experience in cybersecurity starting at thirteen. 20ish years experience, 60+ certifications, and co-found of H & A
Illinois, USA
Joined September 2011
- Tweets1.1K
- Following63
- Followers4.7K
- Likes1.3K
H & A Security Solutions | Securitymapper retweeted
I am looking for a mid-level SOC Analyst to join us at @HASecSolutions. Come join @SecurityMapper and the team! DM me if interested or pass this along if you know anyone! #infosec #soc #hiring #cybersecurity
H & A Security Solutions | Securitymapper retweeted
We just released a new version of DeTT&CT including ATT&CK Mobile support! Thanks to the Dutch National Police who sponsored this!
Checkout this new version! github.com/rabobank-cdc/DeTT…
H & A Security Solutions | Securitymapper retweeted
It’s finally here, the SANS Blue Team Summit 2022!! Join us for free online today and tomorrow at sans.org/blueteam-summit! #infosec #cyberdefense #blueteamsummit
H & A Security Solutions | Securitymapper retweeted
Hey cyber defenders, we've got the SANS Blue Team Summit coming up in a few months and the CFP is now open until June 24! We'd love to have you present and hang out at our event in Scottsdale, AZ in October! Submit your talk here! sans.org/u/1lvZ #infosec #CyberSecurity
H & A Security Solutions | Securitymapper retweeted
What are Event Rules!? Event Rules add power to the Analyst's triage steps by allowing for fine grained, repeatable actions on events before they even hit the queue. Follow @reflexsoar for an upcoming video detailing more on Event Rules. #infosec #reflexsoar #automation
H & A Security Solutions | Securitymapper retweeted
Join @securitymapper & @SecHubb TOMORROW as they discuss how to prepare for, & choose tools that will help give you the best possible results. Let’s get rid of those time-thieving bad alerts!
Set a reminder & join us: youtu.be/wZBXJGf8OuY
H & A Security Solutions | Securitymapper retweeted
🚨**IN 1 HOUR**🚨
Before the New Year, New Start event, come hang out and talk about cyber defense in 2022 with co-chairs @aboutsecurity @SecurityMapper
Click here to set a reminder & join us > xitter.cf/i/spaces/1gqGvlDOmylxB
#AllAroundDefenders #BlueTeamOps
H & A Security Solutions | Securitymapper retweeted
New to cyber folks:
What is the part you struggle with most?
Poll responses will shape a blog/tool series I'm working on.
Please RT for reach.
I need help with:
36%knowing tools to use
7%learning OS commands
17%knowing network protocols
40%scripting
344 votes • Final results H & A Security Solutions | Securitymapper retweeted
This spoke to me today. Thank you for this, @TheRialMichelle!
H & A Security Solutions | Securitymapper retweeted
It doesn't take 100x longer to apply 100 #YARA rules than to apply a single rule. In fact, it only takes a little longer. But a single bad rule can slow down the whole process.
Learn more about Aho-Corasick
en.wikipedia.org/wiki/Aho%E2…
Paper by @regeciovad
researchgate.net/publication…
H & A Security Solutions | Securitymapper retweeted
YARA haters and my replies
What if they obfuscate the code?
I have rules to detect obfuscation.
What if they pad that file to make it huge?
I have a rule that detects huge files of that type.
What if they randomize casing?
I have rules that detect uncommon casings.
H & A Security Solutions | Securitymapper retweeted
The new Sigma converter will support multiple output formats per backend. Here: Plain Splunk queries and Queries embedded in savedsearches.conf format.
Implementation is easy: mostly providing templates which embed the generated queries.
ALT New Sigma converter generating plain Splunk queries.
ALT New Sigma converter generating a Splunk savedsearches.conf.
ALT Backend code for Splunk savedsearches.conf.
H & A Security Solutions | Securitymapper retweeted
Thanks @SANSDefense for the invite. This was a lot of fun!
Recap: There’s no more strategic thing than defining where you want to get to and measuring it. Strategy informs what "great" means and measurements tell you if you’re there or not.
It's panel time at #BlueTeamSummit!
Join @SecHubb & @SecurityMapper for their panel with @anton_chuvakin & @jhencinski to talk scaling and automation in the SOC > sans.org/blueteam-summit
#SOC #Scale #Automation #CyberDefense
H & A Security Solutions | Securitymapper retweeted
Gathering my thoughts for a panel discussion tomorrow on scaling #SOC operations in a world with increasing data as part of the Sans #BlueTeamSummit.
No idea where the chat will take us, but luck favors the prepared. A 🧵 of random thoughts likely helpful for a few.
H & A Security Solutions | Securitymapper retweeted
I am so excited about my SANS #BlueTeamSummit talk!
As we get closer I want to share some tidbits & give context for a topic that may look like a bit of a stretch. What on earth do raft guiding & IR have in common???
A surprising amount, tbh.
1/6
H & A Security Solutions | Securitymapper retweeted
Our prayers were answered 🙏
LAUREL
Linux Audit – Usable, Robust, Easy Logging
- merges auditd events
- JSON output
- high performance
- say goodbye to arg0 & arg1
#auditd #SIEM #SOC
Repo
github.com/threathunters-io/…
Auditd problems
github.com/threathunters-io/…
H & A Security Solutions | Securitymapper retweeted
Don’t miss out on our Blue Team Summit this Thursday and Friday 🧢
Hey #CyberDefenders
What are you doing on Sept 9th? If you love #BlueTeaming and FREE content, we’ve got the answer for you:
#BlueTeamSummit 2021
Register for FREE: sans.org/u/1cQ5
#infosec #cybersecurity #blueteam
H & A Security Solutions | Securitymapper retweeted
Join @SecHubb & @SecurityMapper for the FREE SANS #BlueTeamSummit on Sept 9-10 for #blueteam talks on timely detection, responding to compromises, and monitoring adversary activities to maintain and improve security over time! sans.org/blueteam-summit
youtu.be/8oRlwjjykgI