Johannes Ullrich retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.
❤️👨💻
dynamicincidentresponse.com/…
Johannes Ullrich retweeted
The threats are evolving. Your skills should too. 🛡️
@SANS_EDU graduate certificates help professionals specialize in high-value areas like Cloud Security, Cyber Defense Operations, and Digital Forensics. Explore your options: go.sans.edu/Q1Xyw8
Johannes Ullrich retweeted
Does your employer offer tuition assistance? 💼
You're likely eligible to use those benefits toward a cybersecurity degree or certificate @SANS_EDU. Learn how: go.sans.edu/eSwkR5
Johannes Ullrich retweeted
Would you get a Cybersecurity Master's Degree if your boss paid for it?
Put your employee benefits to work with the @SANS_EDU master's program. Earn 9 GIAC certifications while advancing your career: go.sans.edu/YwriQv
Johannes Ullrich retweeted
Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en cert.pl/en/posts/2026/09/vul…
Johannes Ullrich retweeted
The Find Evil! winners are Mulder, TRUDI and Camel. All three open source today.
Johannes Ullrich retweeted
No CISO has ever regretted the training. Here's why one still blocks 5 days a year for it. #Cybersecurity
Johannes Ullrich retweeted
Each of my executive-briefing templates answers what senior leaders actually ask. What happened, what it means for the organization, and what we should do. They're based on what I wanted to see and share as a CISO.
zeltser.com/cyber-brief-temp…
Johannes Ullrich retweeted
Learn about what’s next for our ISC sensor network. SANSFIRE keynote this evening
Johannes Ullrich retweeted
You trust SANS training.
Now make it count toward a degree.
Join @SANS_EDU on July 9 to learn how your GIAC certifications can be applied for academic credit in our master’s and graduate certificate programs: go.sans.edu/IaQEEk
Johannes Ullrich retweeted
TShark isn't just Wireshark without a mouse. Andy used it to prove SMB 3.1.1 compliance for auditors when no Windows tool could. Watch how display filters + field extraction solve real-world problems.
youtu.be/SpbUTsrRAP4
Johannes Ullrich retweeted
🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.
Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadata
All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.
Who’s trying it out? Drop a ❤️ and reply with your main use case!
#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma
@Suricata_IDS @lennyzeltser @chrissanders88 @sansforensics @TomLawrenceTech
Johannes Ullrich retweeted
🚨 Today's Headline: "GitHub hit by a compromised VSCode extension"
Every defender is now scrambling to answer the critical question: Which VSCode extensions are installed across my MDE users, and is there any impact to their development environment?
For those running Microsoft Defender for Endpoint, here’s a KQLWizard query to instantly extract the full list of VSCode extensions executed by your users. (Answering to @IAMERICAbooted SOS Call 🫡)
github.com/SlimKQL/Detection…
Go hunt down those malicious extensions before they hunt you. 🧙♂️✨
Johannes Ullrich retweeted
The Paller Cybersecurity Scholarship was created to identify and support the most promising new talent across the globe.
Today, we are proud to introduce the 2026 #PallerScholars 🌏🏆
Learn more about the scholarship and this year's winners: sans.edu/pcs
Johannes Ullrich retweeted
#SoberInCyber is hosting mocktails tonight at #BSidesCharm in Towson, MD. You can also stop by our table to grab some swag & do some crafting. We hope to see you there!
ALT Sober in Cyber table at BSides Charm with crafts and stickers
Johannes Ullrich retweeted
Introducing honeyslop: code canaries for open-source maintainers drowning in AI-hallucinated vulnerability reports.
A short release thread
Johannes Ullrich retweeted
One artifact rarely tells the full story.
Jump Lists. LNK files. Prefetch.
Each captures different activity on a Windows system.
The challenge is connecting them.
👇 Quick reference in the playbook
👉 go.sans.org/RKG6xY
Johannes Ullrich retweeted
A small utility in Asia was targeted by China’s top cyber unit. The attackers ran a sustained campaign for over 300 days. They got into the IT network. They never reached OT. Why? The general manager put the basics in place and built a security culture. That’s it. No AI. No million-dollar SOC. Fundamentals. Robert M. Lee called it his favorite case study at RSAC 2026.
📰 Full story in our deep dive: go.sans.org/nTAdXo
@OneRSAC | #RSAC #Cybersecurity #ThreatIntel #OTSecurity
