Threat Hunter for Rapid7. Opinions are my own.
Australia
Joined May 2012
- Tweets118
- Following153
- Followers714
- Likes538
I've just added a Velociraptor Artifact to query this ETW provider, you can grab it here: github.com/Velocidex/velocir…
Blake retweeted
It's physically impossible to keep up with the research being released nowadays. Basically life becomes a mix of FOMO, Imposter Syndrome and eventual burnout😭
What's the solution you might ask? Welp it turns out, no one is actually keeping up with everything. 😂Everyone is working on their thing, so keep doing yours.
Blake retweeted
Hi SIEM vendors,
I've noticed you're using Sigma rules from the community GitHub in your products and calling them "Built-In", but you're not giving credit to the authors. It's a simple thing to do and really important for respecting the open-source community's efforts and the Detection Rule License (DRL).
Please start crediting the authors and respect the DRL.
Have you played around with @velocidex 0.7.1-rc1? With some great features like #sigma integration, I'm excited for the future of Detection Engineering in Velociraptor. Try it out now! 😁
github.com/Velocidex/velocir…
Blake retweeted
While there are many great articles that discuss logs to be sent to a SIEM, many don't mention filtering on the endpoint during investigations. This is an area in which @velocidex excels. 🦖🚀 #FastForensicsBeforeFullSendIt #LogManagementMusts #SaveTheSIEM #SplunkCostBoss
If you missed VeloCon23, all talks are available on YouTube and the website.
docs.velociraptor.app/presen…
#dfir #cybersecurity #rapid7
Excited to be speaking at an @ACSnewsfeed event this Tuesday in the #riverina . Great opportunity for local businesses to come ask any Cyber Security incident response questions!
acs.org.au/cpd-education/eve…
Hi X, it's been a while.
I'm excited to announce that I've joined the @rapid7 @velocidex team, focusing on the open-source build. We've got some exciting things in the works, and can't wait to share them with this amazing community.
With May being Mental Health Awareness Month, I wanted to take a second to spread some awareness about Transcranial Magnetic Stimulation or TMS.
themelbourneclinic.com.au/se…
As someone who has tried multiple antidepressants, but never really found the optimal solution, TMS provided a new path with some incredible results for me. Because it is still new, most doctors I have spoken to had not heard of it, so it's important to spread awareness.
Pavel really does have some of the best Windows Kernel resources out there.
Couldn't recommend his blogs or books enough for those looking to learn Windows internals.
Kernel Object Names Lifetime scorpiosoftware.net/2023/05/…
Incredible team. You'd be working with not only some of the greatest minds in Australia, but some of the greatest in the world.
If you’re an Aussie who wants to work in vulnerability research, we at @infosectcbr are hiring at all levels, from interns to seniors. DM me for details.
Microsoft Incident Response (formerly DART) provides guidance and strategies on how to detect, recover, and prevent CVE-2022-21894 exploits via a UEFI bootkit called BlackLotus. #microsoftincidentresponse #microsoftIR: microsoft.com/en-us/security…
Microsoft IR's (formerly DART) latest blog explores the use of fuzzy hashing in log analysis and introduces JsonHash, a new fuzzy hash algorithm designed specifically for comparing semi-structured data.
techcommunity.microsoft.com/…
