Detection engineering @datadoghq. Interested in ☁️ threats. Prev @expelsecurity and @mandiant intel. LEGO enthusiast. Never finding good bourbon. Opinions mine.
St Louis, MO
Joined May 2016
- Tweets563
- Following394
- Followers1.3K
- Likes940
Pinned Tweet
We were trying to conceptualize the "current state" of cloud [native] threat detection and this is what we sorta came up with. Sharing it more broadly in case others find it useful in organizing your cloud detection & response approach 🔎
We've shared our analysis of the axios supply-chain compromise with full detail on the initial package to the second stage on each platform's RAT capability. This was clearly intended to compromise the developer environment. More amazing work by the team.
securitylabs.datadoghq.com/a…
Anthony Randazzo retweeted
This is how it’s supposed to work. This is how everyone levels up while protecting more people/orgs in parallel. More vendors should seek to mimic this type of collaboration.
We’re all on the same team…unless you only look at Security as a business, but that’s another tweet :)
Datadog 🤝 Okta: "The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public Okta Security Detection Catalog, ensuring that the broader security community benefits from this joint research regardless of their tooling"
Read more here: sec.okta.com/articles/2026/0…
Our Q1 Threat Roundup is out! Nice work by the team as always!
securitylabs.datadoghq.com/a…
Great writeup on a couple new persistence mechanisms the team saw recently ultimately resulting in SES abuse for phishing.
securitylabs.datadoghq.com/a…
Another amazing aggregation of annual cloud security statistics from the team here at @datadoghq
datadoghq.com/state-of-cloud…
Great post by @JulieASparks and team on the recent happenings with Snowflake
securitylabs.datadoghq.com/a…
Anthony Randazzo retweeted
Today is an interesting day! I read a report about a threat actor, and for once I'm impressed! This is the first I can remember in which a TA has displayed NEW tradecraft, before researchers have shared it widely. Let's review in this 🧵
invictus-ir.com/news/the-cur…
Our amazing team found some interesting new ☁️ threat actor techniques. Give it a read!
securitylabs.datadoghq.com/a…
And if you find this interesting, we're hiring in the US but especially in EMEA!
careers.datadoghq.com/all-jo…
Exploiting Windows pods in kubernetes? ✅ More awesome work from the team here at @datadoghq
securitylabs.datadoghq.com/a…
Great write up by the team on some of the hunting pivots we're doing to find evil in AWS!
We've released a new post detailing a threat hunting methodology in AWS CloudTrail, as well as some findings about real attacker activity we've seen in the wild - including the most common enumeration calls
securitylabs.datadoghq.com/a…
AWS CloudTrail Lake SQL queries included!
Anthony Randazzo retweeted
Datadog's security team has just released KubeHound, an open-source attack mapping tool for Kubernetes clusters
securitylabs.datadoghq.com/a…
kubehound.io/
Comes with 25 attack types, each one comes with step by step instructions of how to exploit it
Anthony Randazzo retweeted
Come join my team - you'll get to work with the cool kids @techyteachme @amrandazz, several others & yours truly :)
If you're interested in researching threats, hunting, detection engineering, cloud security and helping build our Cloud SIEM product then this role might be for you.
Happy to answer any questions.
SN: The role is for EMEA folks (see listed locations in req below)
👉🏽grnh.se/3bec72c21us
Anthony Randazzo retweeted
Want to simulate cloud ransomware in your AWS account?
Stratus Red Team now supports 3 attack techniques to emulate S3 ransomware!
• S3 Ransomware through individual file deletion
• S3 Ransomware through batch file deletion
• S3 Ransomware through client-side encryption
🧵
Very cool e2e threat emulation that the team built to test relevant #atomicredteam cloud workload techniques with a hook into Datadog platform
datadoghq.com/blog/workload-…
For my cloudsec folks in EU TZ, we’ve got some new reqs to continue building great security detections in our security platform! Preference for Paris, Lisbon, Madrid, and Tel Aviv office locales but can always make an exception for exceptional talent.
careers.datadoghq.com/detail…
Awesome PM role responsible for all things cloud threats on our Cloud Security Management platform!
careers.datadoghq.com/detail…
The great @daycyberwox did a thing! Check out how to quickly validate AWS threats end to end via Stratus Red Team into Datadog Cloud SIEM 🔥 Even if you're not a Datadog customer, you can test with a Datadog trial!
github.com/DataDog/cloud-sie…
datadoghq.com/blog/aws-threa…
Very unique (at least to me) threat model for cloud-based ransomware against Azure SharePoint. Lots of detection possibilities. Thanks for sharing @obsidiansec
obsidiansecurity.com/blog/sa…
