@vector_sec

Matthew 6:33. Husband. Dad. IR & SecOps Manager for a QSR. Tinkerer of things. Perpetual student.

 Atlanta, GA
github.com/vector-sec
Joined July 2015
  • Tweets1.2K
  • Following225
  • Followers1.2K
108Media
‘How are you so focused under pressure?’ Me in 1995:
1,030
10,522
1,375
67,462
6,008,966
MOTHER OF ... THIS IS AMAZING!!! WE DID IT! 2024 and the world has said in formal documents: DO NOT USE A CONSUMER VPN!! If I had time I would bake a CISA CYBER CAKE! I have a feeling they will not be the only agency.... #VPN #CYBER #SECURITY
50
162
26
1,179
109,971
39
233
18
1,820
110,271
2
13
1
178
8,719
Atomics on a Friday: Unveiling LOLRMM - A New Dawn in Cyber Defense xitter.cf/i/broadcasts/1vAGROLMZ…
4
1
13
4,469
Truth 😅
161
885
181
10,877
546,397
I heard there was a secret cord That David made and displeased the Lord, But you don't really care for safety, do ya? Well it goes like this, a plug, a switch A circuit breaker open-hitched The socket catching fire, hallelujah.
122
2,089
106
14,074
866,702
Please do the incident response team a favor, and check that the X-Forwarded-For Header is set on all your reverse proxies / load-balancers / etc. They will thank you later.
22
106
11
602
128,933
(Archived from @shanselman)
Tweet screenshot: Scott Hanselman @shanselman HIPS & SSL doesn't mean "trust this." It means "this is private." You may be having a private conversation with Satan. 4/4/12 4,725 Retweets 242 Quote Tweets 5,497 Like

ALT Tweet screenshot: Scott Hanselman @shanselman HIPS & SSL doesn't mean "trust this." It means "this is private." You may be having a private conversation with Satan. 4/4/12 4,725 Retweets 242 Quote Tweets 5,497 Like

5
86
1
460
25,219
So @emailrepio by @jkamdjou et al is pretty great. Anyone know of a good and similar equivalent for phone numbers? Thanks!
2
3
416
Some commands are overwhelmingly run by attackers on compromised hosts (and seldom ever by regular users in regular usage). Our @subtee has just released a new (free) Canarytoken to make monitoring these commands trivial. Read more about it - blog.thinkst.com/2022/09/sen…
10
181
23
555
Folks, I am teaching my next Pay What You Can class next week. It is SOC Core Skills. Please share with someone who is trying to get into security. antisyphontraining.com/soc-c… Thanks!
15
268
25
615
PSA: if you have prod data in a non-prod account, It is now a prod account.
26
78
13
516
Please don't use the war in Ukraine as a sales pitch to sell security products.
5
13
5
107
This appears to be a widespread #TR #Qakbot #Qbot campaign today that could lead to Cobalt Strike, Bloodhound, and things that look very "pre-ransomware-y." The domains/hashes change, but the detection opps mentioned here are more durable. I highly recommend looking for this NOW.
Red Canary, a Zscaler company
@redcanary18 Feb 2022
Over the past few hours, we’ve observed malicious phishing emails associated with the delivery affiliate TR in multiple customer environments. The infection scheme was consistent, executing in the following pattern: OneDrive phishing page -> ZIP download -> malicious XLSB -> Qbot
4
50
3
118
Why is it called Single Sign On.. if I have to do it 43 times a day?
154
1,968
299
20,123
Cisco is offering Splunk $20 billion... Unclear if they're trying to buy the company, or just renew their subscription for another year.
66
1,056
170
5,899
The more orgs start using MFA, the less attackers rely on passwords. It's the natural evolution. Defense in depth is the way! (Or zero trust if you prefer newer buzzwords)
14
206
16
924
🎶 on the 12th day of Christmas, my SOC has sent to me: 12 crafted packets 11 leaky buckets 10 phishing emails 9 pending patches 8 tokens stolen 7 missing headers 6 ransoms pending 5 breached passwords 4 login attempts 3 open ports 2 APTs and a log4j vulnerability 🎶
21
199
9
1,028
AWS: "Implement quicksort on the whiteboard if you want to work here." Also @awscloud:
13
58
4
584
Load more