Professional SOC Monkey and herder of cats @redcanaryco, gamer, volunteer firefighter, blah blah wavy hands things and stuff Opinions are from some monkey
Right here
Joined July 2010
- Tweets513
- Following262
- Followers622
- Likes55
Joe Moles retweeted
One of the things that makes Blue Mockingbird so interesting is the way it uses the COR_PROFILER environment variable to achieve persistence: bit.ly/2A0zvpM
Joe Moles retweeted
We're monitoring a threat we've dubbed "Blue Mockingbird" that is deploying Monero cryptocurrency-mining payloads on Windows machines at multiple organizations. bit.ly/2WyXJz3
Joe Moles retweeted
Invoke-AtomicRedTeam started as a framework for executing atomic tests. Now it's much more than that, so we spun it out as its own open source project. Here are some key new features: redcanary.com/blog/invoke-at…
Checkout this great event! squadup.com/events/whiskies-…
Joe Moles retweeted
Our VP of #securityoperations @FlyingMonkey127 and Twitter #CISO @mikeconvertino will host a conversation over beers and appetizers at Optimism Brewing Company in Seattle on September 19. Register to join us! hubs.ly/H0kz6Qx0
Joe Moles retweeted
Join @FlyingMonkey127 and Twitter #CISO @mikeconvertino at Optimism Brewing Company in Seattle on September 19 for a technical discussion on how you can use @MITREattack to improve your #security program: hubs.ly/H0kz7sW0
Joe Moles retweeted
The Local Security Authority Subsystem Service (lsass.exe) doesn’t typically spawn other services, so it was particularly suspicious when we recently observed it launching rundll32.exe. hubs.ly/H0jhT4l0
Joe Moles retweeted
Any security team that's working to adopt @MITREattack should consider these four free and compatible tools: hubs.ly/H0hvPwS0
Joe Moles retweeted
A good tipoff to Trickbot activity is the use of PowerShell to manipulate Windows Defender. 90% of the times we saw this command in the last 30 days the parent process was malicious:
"powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true"
Joe Moles retweeted
.@ForensicITGuy recommends some hunts that will help you uncover Rocke-related #cryptojacking activity in your environment. hubs.ly/H0hbxGY0
Joe Moles retweeted
As a longtime @CarbonBlack_Inc partner, we're excited to be among the first MDR vendors to deploy CB ThreatHunter to customers: hubs.ly/H0h96ny0
Joe Moles retweeted
JUST RELEASED: Our 2019 Threat Detection Report offers detection strategies for the most prevalent @MITREattack techniques: hubs.ly/H0h3zmb0
Joe Moles retweeted
OSX/Shlayer infections are widespread, and the macOS #malware delivers a couple #adware strains with varying persistence mechanisms that make the threat difficult to mitigate. Here's our guidance: hubs.ly/H0gQw8Y0
Joe Moles retweeted
What do you do when your adversary uses an ISO disc image file to introduce a malicious binary into your environment? hubs.ly/H0gJ0810
Joe Moles retweeted
Keisha Levan of @redcanaryco will demonstrate how to optimize team resources, allowing time for more fulfilling and proactive work.
#SANSBlueTeam Summit agenda: sans.org/u/M08
Joe Moles retweeted
#Security tools—no matter how costly—have limitations. The trick is to compensate for these with controls that reduce the impact of blind spots. @ForensicITGuy on detecting threats with limited data: hubs.ly/H0g6xx40
Joe Moles retweeted
We're excited to announce that we've added new features to our security automation tool, Exec, including support for forensics package collection, human approvals, and more: hubs.ly/H0g2rKK0
Joe Moles retweeted
In a wild deviation from our normal programming, enjoy this spirited defense of Die Hard as a timeless Christmas classic! hubs.ly/H0f-VVt0
Joe Moles retweeted
[NEW BLOG]~Surfing the Mid-Career Wave: 5 Steps to Making Your Next Move~ @JulieBrownRC hubs.ly/H0fK3Tn0