Infosec Consultant, redteam specialist, threat research and adversary emulation with @fisglobal (OSCE/OSCP/GDAT...CISSP)
VA
Joined March 2009
- Tweets765
- Following62
- Followers118
- Likes289
Pinned Tweet
Excited to finally publish this research and red team tool updates!
RedCloud: Learning from #Astaroth link.medium.com/DLfmHCKH85 #redteam #cloudflare #pentest
Steve Walker retweeted
We issued V2 supplemental guidance to Emergency Directive 21-01. @NSAgov verified version 2020.2.1 HF2 of SolarWinds Orion eliminates previously identified malicious code. Agencies using non-affected versions must update to the new version: cyber.dhs.gov/ed/21-01/#supp…
Great write-up on defending against an attacker's most likely lateral movement approach, and red team favorite - SMB-based comms.
Restricting SMB-based lateral movement in a Windows environment #Ransomware medium.com/palantir/restrict…
Great #CTF weekend! Thanks @metasploit! I set a PR of solved challenges (10) w team BitSwitchers, and posted a write-up for future me to avoid pain, er, remember wheelsvt.medium.com/2020-met…
Best cycling race series in the world right now.
I put all the Tour de Quarantine videos on a YouTube playlist to make it easier to share with a cycling fan in your life that might need a little comic relief right now. #tourdequarantine #tdq youtube.com/playlist?list=PL…
Rolling some @MITREattack ATT&CKCon live streaming today and tomorrow while I build a CTI-backed VECTR purple team playbook. How are you using ATT&CK?
Great thought provoking piece by @McKinsey on Financial crime and fraud in the age of cybersecurity bit.ly/2nvCaBX
Already took SEC599 (great course)! Will be at #PurpleTeamSummit and excited to meet and learn from others who are effectively merging red and blue.
Go deep purple! Attend the inaugural #PurpleTeamSummit and take the SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses course at SANS Purple Team Summit & Training!
Register today: sans.org/u/Q0L
Attending my first Threat Intel conference at Anomali Detect'19. Enjoying new perspectives on using threat data to improve SecOps.
Great work @Cyb3rWard0g! Looking forward to using this for emulation exercises and building new defensive capabilities.
New from @Cyb3rWard0g - Check out Mordor, a tool for recording and generating data sets for attack actions. Using this data, you can expedite the development of analytics for the detection capability within your organization.
Check out the post here: posts.specterops.io/enter-mo…
Steve Walker retweeted
Capital One says data theft impacts 106 million people. Here's a closer look at the person charged with the hack, and what this breach may mean for consumers. There is evidence to suggest we may hear similar disclosures from other companies soon. krebsonsecurity.com/2019/07/…
#popcorn Turla Espionage Group Hacks OilRig APT Infrastructure bleepingcomputer.com/news/se…
Good writeup on FL ransomware from @threatpost. I've been called in on some ransomware IRs, and w/o backups it's tough - but also consider what groups you support if you pay!
threatpost.com/ransomware-fl…
#ransomware #cybersecurity
I'm a little late to the party, but great work @4A4133 and the other JAs! TLS Fingerprinting with JA3 and JA3S medium.com/p/tls-fingerprint…
And they still stick with them because Huawei is competitively priced??
Bloomberg: Vodafone Found Hidden Backdoors in Huawei Equipment.
bloomberg.com/news/articles/…
Back to the drawing board for the next WiFi protocol...
Ars Technica: Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords.
arstechnica.com/information-…
via @GoogleNews
Steve Walker retweeted
Do you have PowerShell logging on? I sure hope so! It's by far the most popular @MITREattack tactic see in confirmed threats! (From @redcanaryco's Threat Detection Report redcanary.com/resources/guid…)
Nice work @HagerWBZ @wbz @ptrancyber! I enjoy helping w these!
"A hacking expert showed the I-Team why Nest systems can be easily compromised." --> Attacking the user. It's the integrations users allow or reused passwords & not using 2-step authentication. cbsloc.al/2HDk2Op