Detection engineering and threat hunting
Helsinki
Joined August 2013
- Tweets465
- Following86
- Followers424
- Likes1.3K
Niklas Särökaari retweeted
A good detection includes:
- Clear aim (e.g, remote process exec on DC)
- Unlocks end-to-end workflow (not just alert)
- Automation to improve decision quality
- Response (hint: not always contain host)
- Volume/work time calcs
- Able to answer, “where does efficacy need to be?”
Niklas Särökaari retweeted
A lot of security pros have remarked that this breach vs #Uber looks, quacks and walks like activity from the LAPSUS$ data theft/ransom group that got busted up earlier this year. But the truth is LAPSUS$ gave others a playbook for getting into F500 companies that reliably works.
Unfortunately this stuff still works and RTs usually goes the extra mile 😅
This Post is from an account that no longer exists. Learn more
Here's a secret: you don't need a "Tier 1 SOC" at all if you have a security team that understands how to write quality detections and uses the correct tools.
Secret #2: Those tools have nothing to do with ML/AI.
”VBA macros obtained from the internet will now be blocked by default.” 👏👏👏
We're making some changes to the way Office macros work to improve security. Details here - techcommunity.microsoft.com/….
Thank you to folks across the security and Office platform teams for supporting this work - especially the Security team's PM Kellie.
Must read.
Attack and defense focus a lot on techniques, but underpinning those techniques is a mindset 🧠. Some thoughts over the last few years on the defender's mindset:
medium.com/@johnlatwc/defend…
Niklas Särökaari retweeted
Scott on the @TrimarcSecurity team wrote this much needed & excellent article on how best to protect an Active Directory environment & it's more than just AD.
Article covers protecting workstations/servers including GPO configuration.
This is a must read
hub.trimarcsecurity.com/post…
New article from @ScottWBlake on protecting privileged credentials in an Active Directory environment.
Recommendations:
* Limit # of priv accounts
* Remove DA local admin rights
* Control systems DAs & EAs can access
* Ensure local admin pw changes often
trimarc.co/tw-ProtectingPriv…
Niklas Särökaari retweeted
In the series of “books I wish I’d read sooner” is @networkattack’s
Network Attacks and Exploitation: A Framework. I really appreciate the solid examples and the focus on humanity throughout. amazon.com/Network-Attacks-E…
Niklas Särökaari retweeted
The effort it takes to build and land a successful phish in a modern environment is really under appreciated. Getting a click is easy building something that doesn’t get reported when received, opened, or days after opening is another thing.
Niklas Särökaari retweeted
Restricting SMB based lateral movement in a #Windows environment.
Lessons learned from work with the @SpecterOps team; drawing from previous posts by @mattifestation, @Haus3c, @cryps1s, @harmj0y & Mr SMB himself @NerdPyle
bit.ly/SMB-lateral-movement
#redteam #blueteam #infosec
