Lead Engineer, NSM @Target Github: https://xitter.cf/t.co/tmQk6TbWMr https://xitter.cf/t.co/5KDnHsdBlV Mastodon: @weslambert@infosec.exchange
Augusta, GA
Joined January 2016
- Tweets2.5K
- Following284
- Followers1.8K
- Likes3.2K
Wes Lambert retweeted
The private keys for the eMudhra CA were compromised yesterday. Here's all the IPs likely hosting fake eMudhra certificates. These were found using JA4X on hunt.io but you can do the same thing on Censys, Xpanse, Validin, or any other tool running JA4+
Wes Lambert retweeted
🦖 A quick blog post to share velociraptor-skills: AI skills for DFIR with Velociraptor.
Includes the repo link and a walkthrough of installation and lab use.
🔗 labs.infoguard.ch/posts/ai_a…
Wes Lambert retweeted
One of my colleagues published some research today into a campaign targeting Iranian dissidents labs.infoguard.ch/posts/iran…
Wes Lambert retweeted
Recording of my talk at @sec_kc about malware in extensions. A summary of the attacks that might impact your organization.
youtu.be/y850kRQXMCI?is=0oJj…
Wes Lambert retweeted
Look closely at the detections Samir uses here. What is really interesting about extensions is that some of the best context like developer email, install velocity, and published date are never available on the endpoint. You need to be able to merge this context with code.
Malicious browser extensions can be a tricky attack vector and may go unnoticed, been playing with Elastic workflow + Elastic Defend response console, daily hunt for newly installed browser extensions using file events -> reputation check -> if suspicious -> archive and delete from impacted host -> open case with summary
elastic.co/docs/explore-anal…
📢 Come join us in #Atlanta, GA November 13-14 at Monday Night Brewing - The Grove, for #DEATHCon 2026 on-site!📢
We'll have many excellent workshops and interesting environments to explore, focusing on #threathunting and #detectionengineering!🏹
lnkd.in/eTSS5RhX
#DEATHCon #Atlanta (on-site) tickets are now generally available! Come join us November 13-14 at #MondayNightBrewing - The Grove!
We have a very limited number of tickets, so don't wait!
#threathunting
#detectionengineering
simpletix.com/e/deathcon-atl…
#DEATHCon 2026 tickets are now generally available! Come join us online, on-site in Atlanta, GA, or at one of the other awesome sites!
deathcon.io/tickets.html
#DetectionEngineering
#ThreatHunting
#Cybersecurity
#Infosec
Come join us online or in-person in Atlanta!
simpletix.com/e/deathcon-atl…
#DEATHCon2026 💀Tickets will be available on 7/7 at deathcon.io/tickets.html - You can see the awesome 🔥 #detectionengineering & #threathunting workshop lineup now at: deathcon.io/workshops.html
Wes Lambert retweeted
This is it folks! This is the last weekend to submit a DEATHCon workshop CFP proposal if you want to get in the first round of acceptance! We've got a lot of great submissions already but there's room for yours too! deathcon.io Click on CFP. Conf can pay for travel!
Wes Lambert retweeted
Malware campaigns are targeting real estate agents.
Attackers build rapport, then send a malicious Zoom link that grants full remote access.
Indicators of compromise and detection guidance here:
sublime.security/blog/scamme…
Wes Lambert retweeted
🎯 Added this Velociraptor artifact on the exchange to assist scoping IOCs related to the recent publicly disclosed Notepad++ supply chain attack.
- Find impacted notepad++ versions
- Find suspicious files in public reports
- Find public reported network urls in running processes
- Find Warbird clipc.dll shellcode loader strings
🔗 docs.velociraptor.app/exchan…
Simple scoping for abused/exposed #Notepad++ via #Velociraptor notebook. For installed apps storing registry values, not portable (more likely to be leveraged given update mechansim, AFAIK).
In-depth: rapid7.com/blog/post/tr-chry….
I'm sure @mgreen27 has an uber artifact cooking 🔥
Wes Lambert retweeted
#100DaysOfYara
🔎 Messed around with detecting the cool Warbird technique outlined by Rapid7 in their recent Chrysalis blog
Velociraptor gives us the unique ability to target the VAD with live analysis:
1. Targeting sections mapped to clipc.dll
2. With PAGE_EXECUTE_READ protection
3. DEADBEEF or CAFEFE in the first bytes
🔗github.com/mgreen27/100dayso…
Wes Lambert retweeted
We’re hiring at Sublime Security 🚀
We’re building security that actually stops email-based attacks, and we’re growing our team with people who want to ship meaningful work at real scale.
Open roles include:
🔧 Engineering Manager, Product
🛠 Corporate IT Engineer (US East Coast + UK)
📈 Sales Engineering Manager (West Coast)
✉️[email protected]
Simple scoping for abused/exposed #Notepad++ via #Velociraptor notebook. For installed apps storing registry values, not portable (more likely to be leveraged given update mechansim, AFAIK).
In-depth: rapid7.com/blog/post/tr-chry….
I'm sure @mgreen27 has an uber artifact cooking 🔥
Wes Lambert retweeted
new @velocidex artifact and write-up detailing CVE-2025-14847 and how to detect #MongoBleed from @eric_capuano 🤓🔥🦖
blog.ecapuano.com/p/hunting-…
I just updated the wlambert/velociraptor #velociraptor
@velocidex
Docker image to 0.75.6 to address CVE-2025-14728, detailed here: docs.velociraptor.app/announ…
Repo here, with more long-needed updates coming soon:
github.com/weslambert/veloci…
#DFIR
#Infosec
Wes Lambert retweeted
The extension was approved, now what? Are you going back tomorrow to see if it changed? You know they auto update instantly right? Rolling out to Secure Annex - code change alerts.
This takes comparison of the code from the previous version along with additional context to understand how the code in an extension is changing over time.
