New open source tool for defenders to detect when attackers try to tamper with Event Tracing for Windows (ETW) to suppress the logs of their actions on endpoints: github.com/nccgroup/DetectWi… thanks to @NCCGroupInfosec for publishing this!

one time i made a suggestion to a vendor for more logging to be possible in their tool and they responded, “we’re a security company, not a logging company” and my colleague quickly quipped back with “you cannot be a good security company if you’re not a great logging company”.

This took almost a year to get through the disclosure approval process, but here's the @NetSPI blog that covers the privilege escalation issue (now fixed) that we found with the Azure Log Analytics Contributor role - netspi.com/blog/technical/cl…

I like the idea of storing logs for at least 6 months. Storing netflow for at least a month. And storing full pcaps for the last week. This gives you a good set of data to do investigations with if you need to.

Not just @azure. This is about a critical point of failure in cloud’s #SharedResponsibility model, present in @awscloud & @googlecloud as well When logs can be tampered with - quis custodiet ipsos custodes? With digital ⛓Chains of Custody⛓ you can finally guard the guardians

ever wanted to fake sign a binary, but didn't want to install additional dependencies? well now you can using my super 1337 automation github.com/jfmaes/LazySign this tool was very hard to create, I swear! I may or may not have been inspired by Conti.

My recent ransomware reports are all depressingly similar. PLEASE look to the security/patch level of edge firewall/VPN devices, send their logs to an external host for long-term storage, and make sure you have network-layer logs that show attempts to compromise these devices.

Most companies still rely on manual tools and tech for internal audit processes twib.in/l/xxaB7oo6oog4