Talos Incident Response global leader by day - former CISO, Risk Management, etc. Gamer, RPG. travel enthusiast by night -The views expressed are my own

@pchobbit.bsky.social
Joined January 2009
This was a great blog to help to craft, showing the power behind our IR team and Threat Intelligence capabilities at Talos. Great work Team!
Cisco Talos Incident Response (Talos IR) recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Read the blog here: cs.co/6019SsMIh
1
1
3
479
Going private this weekend, go find me elsewhere
4
117
Fun to work with @Google on their latest Security white paper! My fave quote: “Folks throw money at a super expensive platform, but then don’t have a password manager for the team! It’s like spending money on ballistic windows but your door is wide open.” services.google.com/fh/files…
3
17
106
7,805
I remain as adamant as before that "humanless, full-auto #SOC" is not coming any time soon, BUT I sense that we are close to replicating the quality of shitty, low-cost MSSP/MDR with machines alone, no humans needed... So, shitty, low-cost MDRs beware, you business may be toast.
19
25
7
158
22,104
🔍💻 PowerShell Pro Tip! 💻🔍 Ever wondered what app opens specific file extensions on your Windows machine? 🤔 Sure, it’s not new, but it’s super handy! 💪 Use this PowerShell magic to find file extensions and their associated apps (like finding out `.rdp` opens with `mstsc.exe`)! 🚀 ``` $associations = @() $registryPaths = @( "HKLM:\Software\Classes", "HKCU:\Software\Classes" ) foreach ($path in $registryPaths) { Get-ChildItem $path | ForEach-Object { if ($_.PSChildName -like ".*") { $extension = $_.PSChildName $progId = (Get-ItemProperty -Path "$($_.PSPath)" -ErrorAction SilentlyContinue).'(Default)' if ($progId) { $commandPath = (Get-ItemProperty -Path "$path\$progId\shell\open\command" -ErrorAction SilentlyContinue).'(Default)' $associations += [PSCustomObject]@{ Extension = $extension ProgID = $progId AssociatedApp = $commandPath } } } } } $associations | Out-GridView -Title "File Extensions and Associated Applications" ``` gist.github.com/MHaggis/a5b0… Hit enter & watch as the magic unfolds! 🎩✨ Explore the full list in a GUI to see extensions + their apps! Because sometimes… knowing is half the battle 🛡️💡 🖥️🐱‍💻
4
31
1
162
19,758
Investigation Scenario 🔎 You’ve discovered a Windows 10 host placed in the wrong AD OU. As a result, WSUS did not pick it up for automatic updates for at least two years. What do you look for to investigate whether it has been compromised? #InvestigationPath #DFIR #SOC
6
9
39
5,707
The problem I have with AI is that the implementations are attempting to replace critical thinking with a poor replacement. It's not going to work, it causes people to stop learning or trying to be able to critically think, write, etc. and without their crutch they are useless.
79
New Sigma release r2024-11-10 is available for download 🌟 17 New Rules 🛡️ 35 Rule updates 🔬 4 Rule Fixes This release includes rules covering - Suspicious .RDP file creation by Outlook and other uncommon processes. - IIS config tampering. - PowerShell Web Access abuse. - Antivirus cheat sheet updates And more 🔥 Check the full change log and start exploring this, by downloading the latest release -> github.com/SigmaHQ/sigma/rel… Also keep an eye for the next release soon, as I go through the rest of the PRs. Thanks to the many contributors that helped shape this release, specifically ahmedfarou22, bharat-arora-magnet, BlackB0lt, CheraghiMilad, dan21san, @defensivedepth, @deFr0ggy, djlukic, @frack113, fukusuket, ionsor, jaegeral, @imlordofthering, Koifman, Mahir-Ali-khan, @MalGamy12, @M_haggis , Milad Cheraghi, @cyb3rops , ruppde, @AltgeltMax , swachchhanda000, @Kostastsale , wieso-itzi, @X__Junior
34
107
7,263
"Anton’s Alert Fatigue: The Study" bit.ly/3UJWBI1 is a result of some agonizing pondering of the "alert fatigue problem" over the years. Hopefully it is a fun read, because it was not a very fun write -)
4
20
49
4,697
And here we are. 😞
591
475
9
3,472
222,858