Threat Intelligence at @Microsoft Threat Intelligence Center (MSTIC).

Everywhere
Joined March 2018
bk (Ben Koehl) retweeted
CYBERWARCON is BACK for 2026! Registration and CFP are now officially open! We’ll be in Arlington, VA+ virtually on November 20th, with Rob Joyce as our keynote. cyberwarcon.com 1/x
2
62
4
122
13,607
State of Statecraft (SOS) is a new security and intelligence conference purposed to bring together observers of espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored ops.
2
26
4
45
12,228
bk (Ben Koehl) retweeted
Do you find analyzing Rust binaries/malware tedious and unpleasant? You’re not alone! If you’re attending #REcon this year, our own @hackingump1 will be unveiling #RIFT today at 2PM EST (not at REcon? We got you covered, stay tuned). We have been using RIFT internally for some time and it has truly transformed the way we handle and analyze Rust binaries. cfp.recon.cx/recon-2025/talk… #RIFT #Rust #REon25 #MSTIC #MIRAGE
Presenting "Unveiling RIFT: Advanced Pattern Matching for Rust Libraries" at RECON Montreal 2025! Sharing research on discovering Rust dependencies in compiled binaries. See you there! 🚀 #RECON2025 #RustLang #ReverseEngineering
13
2
36
22,857
bk (Ben Koehl) retweeted
In 2024, FBI and our partners raised the alarm about China’s hacking of US telecommunications infrastructure. This year, we’re going after the individuals responsible for the intrusions. If you have information about Salt Typhoon, we want to hear from you: ic3.gov/PSA/2025/PSA250424-2 ______________________________ 2024年,联邦调查局与我们的伙伴针对中国黑客入侵美国电信系统的行动发出警示。今年,我们计划将从事入侵行动的人员绳之以法。如果您有任何关于盐台风的信息,我们希望您跟我们联系: ic3.gov/PSA/2025/PSA250424-2…
245
788
41
2,414
319,049
bk (Ben Koehl) retweeted
Come help me create mechanical advantage in defense. If you love threat hunting, learning from incidents, building new ways to find attackers, and empowering others, this may be the perfect job for you. Help expand defense from the relational world of hunting to graphs, anomalies, embeddings, and beyond. This is a hands on role. You will be hunting, creating, and applying. You will be using your ideas on current incidents helping us gain speed on attackers. Due to the collaborative nature of the work, I am only considering US working hours/time zone for this position. #msftsecurity #jobs #security #securityresearch Principal Security Researcher Redmond, Washington, United States ➡️jobs.careers.microsoft.com/g…
25
4
51
7,623
bk (Ben Koehl) retweeted
SINCON 2025 is coming! 🚀 As a proud partner of HITCON, we invite you to explore cutting-edge cybersecurity at SINCON 2025! 📅 22-23 May 2025 | 📍 voco Orchard, SG 💡 Use “SINCON25-SUPPORTER” for S$100 off! 🔗infosec-city.com/sin-25
1
1
5
978
Come work with me and the team! We have a large global team focused on extremely interesting work with a large opportunity to have impact. Principal Security Researcher (US) jobs.careers.microsoft.com/g… Do you enjoy security research?
I'm told we are hiring in MSTIC: aka.ms/msticjobs Come for the data, stay for the data. Creative problem solvers have the most impact. If we've worked together, I'm happy to refer you. But...
2
18
40
7,783
When in Taipei…. Enjoy a good cocktail and shellcode at instagram.com/h4ck3rbar
1
1
24
2,068
bk (Ben Koehl) retweeted
🚨 Speaker Spotlight 🚨 Join us at #CYBERWARCON to hear from James Elliott, a seasoned expert with 25+ years of experience! Currently at MSTIC, James has built threat intel teams for the DoD and private sector. 🎟️ Don't miss out! Get your tickets now: cyberwarcon.com
1
8
3
30
10,205
Cyber intel reunion / epic conference 2024 👇
CYBERWARCON is coming!!! Registration and CFP are now open for this year’s #CYBERWARCON! This year’s keynote will be given by the NSA’s @adamski_morgan. The in-person event is in Arlington, VA on Nov. 22nd and virtual tickets are available. 1/x cyberwarcon.com/
1
7
1,434
bk (Ben Koehl) retweeted
It simplifies the process of keeping analyst work and notes in a structured and queryable format AND allows that work to be reflected to analysts perusing the same data as soon as it's recorded. Tag, bag, comment, feed to automation - whatever your needs are.
1
4
13
2,528
bk (Ben Koehl) retweeted
🆕🚨 analysis from @Google on APT42 activity against 🇺🇸 and 🇮🇱. A ton of work from folks over the past few months dedicated to protecting users disrupting campaigns, and making life hard for the actors. More to come! blog.google/threat-analysis-…
2
69
9
141
49,185
bk (Ben Koehl) retweeted
🗓️ SAVE THE DATE: 11.22.24 #CYBERWARCON is a one-day conference focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. ⚡ For CFP updates, sign up to subscribe on our website: cyberwarcon.com!
9
54
8
127
35,349
Persistent: Gingham Typhoon has continuously targeted Australia for years. They also ebb and flow to different countries in the region as strategically important issues drive collection efforts. You may run into activity Raspberry Typhoon during the same investigations as both appear to have a small overlap in targeting. cyber.gov.au/about-us/view-a… 👏to @ASDGovAu for releasing information on their activity.
3
23
4,572
bk (Ben Koehl) retweeted
The very awesome people from Microsoft DART have put together a collection of one-page Windows forensics guides to help you understand various artefacts you can use during your investigations. Check them out - microsoft.com/en-us/security…
5
167
4
521
45,684