Senior Engineer @SecurityOnion | Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own

Joined July 2011
Scott Lynch retweeted
For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed: 📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year 📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols 📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others! Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!
2
5
7
419
"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom." Read the full report: buff.ly/jTXN9HO #DFIR #ThreatIntel
3
18
81
7,148
🔥🖥️👍🏻
SO-CRATES 5.0 is out 🧅 SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline. New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
1
1
2
120
Scott Lynch retweeted
hashcat v8.0.0 released! The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards. Release notes: github.com/hashcat/hashcat/b… Download: hashcat.net/hashcat/
24
413
33
1,976
87,919
𝗕𝗲𝗳𝗼𝗿𝗲 𝘆𝗼𝘂 𝗱𝗶𝘀𝗮𝗯𝗹𝗲 𝗡𝗧𝗟𝗠: 𝗸𝗻𝗼𝘄 𝘄𝗵𝗮𝘁 𝗯𝗿𝗲𝗮𝗸𝘀. Hardcoded apps, IP-based connections, legacy appliances with no Kerberos path. Audit first, block later. Microsoft's NTLM-deprecation FAQ: buff.ly/CtsX44x #Microsoft #WindowsSecurity
5
1
26
2,083
Scott Lynch retweeted
SO-CRATES 5.0 is out 🧅 SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline. New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
4
4
2
13
653
In case anyone wants to see how these attacks work and test their detection/response, I did a webinar with @AlteredSecurity where I showed how to modify evilginx and automate passkey registration Code is here: github.com/nathanmcnulty/res… Video (4m-8m): youtube.com/watch?t=239&v=kw…
Entra ID Protection finally added a detection around suspicious addition of credentials 🥳 We've been seeing attackers register passkeys a lot lately, no attestation for users who are eligible to use SMS/voice is only making it worse... :-/ learn.microsoft.com/en-us/en…
1
14
82
5,224
Hacking a Bluetooth speaker from IKEA: Technical research and a love story hidden in encrypted firmware. 🔵🦷🔊🪓♥️ More details on: LinkedIn: lnkd.in/p/djfJvtFd Substack: it4sec.substack.com/p/hackin… Telegram: t.me/it4sec/90
2
10
117
4,032
Scott Lynch retweeted
Hanging out at the best BSides in the country. @BSidesAugusta
1
2
6
221
Scott Lynch retweeted
The @MarkBaggett 🐍
1
2
78
Scott Lynch retweeted
If you’re attending @BSidesAugusta looks @attrc ‘s talk is going to be excellent as well as the one by @dougburks pimpin his SO-CRATES tool. If you see him give him a Bill & Ted “Excellent!!!”
2
1
3
275
Scott Lynch retweeted
Super excited for @BSidesAugusta today! Hope to see you at my talk at 3PM on SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
1
1
1
182
Scott Lynch retweeted
Josh Brower is presenting “Sigma Correlations: Everything, Everywhere, All Within 5 Minutes” at Security Onion Conference @securityonion
1
2
152
Scott Lynch retweeted
Chart showing the number of Internet-facing PHP services over time: trends.shodan.io/search?quer…
3
41
3
135
11,539
Scott Lynch retweeted
Matt Gracie is kicking off this year’s Security Onion Conference with a review of what we’ve been up to the last year! @securityonion
1
1
2
204
Scott Lynch retweeted
Bryant Treacle presenting “Defending OT/ICS Environments with Security Onion” at Security Onion Conference @securityonion
1
2
168
We just released a new Splunk ESCU version 6.9.1 with initial coverage for PHP2Shell - Grab the update today splunkbase.splunk.com/app/34… Check out the dedicated analytic story for more details - research.splunk.com/stories/… Big shoutout to Onur Mustafa Erdogan @raven_tait @SnekCharmerr for making this happen
1
10
1
37
2,093
Scott Lynch retweeted
New Field Note: Reconstructing an Attacker’s Workflow During a recent incident, we recovered several PowerShell scripts an attacker left behind. They revealed a surprisingly practical post-exploitation toolkit: - File-based command execution - Credential harvesting through Windows authentication prompts - Active Directory reconnaissance and remote WMI access testing - SMB share discovery and permission checks Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network Link: dfir.ch/posts/field_note_att…
2
20
65
5,210