AI-Powered MDR & Incident Response ☂️
Israel
Joined August 2020
- Tweets657
- Following133
- Followers2.7K
- Likes1K
Security Joes retweeted
JOES AIR - Autonomous Investigations & Response™ platform is now live.
So proud of our engineering team at @SecurityJoes.
This has been a tremendously challenging journey. v1.0 ✅
Now we have a car to race with 🏎️
AIR is out💃🏻
We’ve built the most advanced SecOps platform to date.
And it’s only version 1.
linkedin.com/posts/idonaor_t…
Our latest research led by Red Team Lead Anna Breeva explores how Unicode Bidi Override Spoofing exploits the gap between what email systems authenticate and what users actually see.
Curious how it works? Read our new blog post: 🪄
securityjoes.com/blog/exploi…
It took the @n8n_io team less than a week to patch the bypass our research team found for CVE-2026-27577.
The issue allowed an authenticated attacker to escape the sandbox and achieve Remote Code Execution on the underlying n8n host.
Great collaboration with n8n!
New research released 🚀
Static analysis of the Miasma supply-chain worm’s Azure DurableTask payload - how it triggers from poisoned GitHub repos in AI IDEs, what to rotate, and starter IOCs and detection rules for incident response.
blog.securityjoes.com/post/s…
While Supply Chain hits hard, Incident Response teams should strive for developing tools to assist dev teams to harden their endpoints.
#Vaultify is one of them. Visit our new website, download the tool and clean your machine from secrets sprawl and NHI threats. ITS OPEN-SOURCE
Today we launched another version of #Vaultify to keep helping devs secure their endpoints
A website is now live with more information -
vaultify.live
Anti-Supply-Chain-Attacks 🫡
Bitlocker ransomware attacks might just went out of business...
I just reverse engineered the YellowKey BitLocker bypass
Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.
This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.
Security Joes retweeted
Releasing Vaultify, an open-source tool that hunts secrets in your machine and lets you vault all in one click.
github.com/securityjoes/vaul…
- Local only
- Includes BYOAI to assist in quick remediation & FP detection
- Vaults secrets using 1Pass CLI or other vaults
The domino effect that turned defensive infrastructure into part of the blast radius:
Our latest research, by Diogo Machado, shows how the DigiCert incident cascaded into Microsoft Defender behavior and exposed the fragility of modern trust chains.
blog.securityjoes.com/post/t…
AI observability is now critical as OpenClaw’s adaptability accelerates.
Researchers are actively exploring this shift and strengthening defenses around OpenClaw.
We’re releasing new detection capabilities for the EDR/XDR tools we use daily
securityjoes.com/post/huntin…
🚨 New Blogpost is Out!!
Over 50 GitHub accounts, and several LinkedIn accounts as well, were involved in a massive Lazarus fake hiring attack, dubbed as "LazarOps" by the security joes incident response team.
Read the full blog at - securityjoes.com/post/operat…
Our first LATAM regional meetup took place in São Paulo, Brazil! 🇧🇷
Threat Researchers from across the region came together to connect and have fun.
Check out the Dinner in the Sky video!
Obrigado, Brasil! Estamos só começando. 🇧🇷🔥
🎙️ Following our live podcast launch…
🚀 CloudCastle is now officially live on GitHub!
🙏 To everyone who joined us live — thank you!
💙 Let us know how you’re using CloudCastle.
#CloudCastle #SecurityJoes #AWSIR #ThreatHunting #OpenSource #CybersecurityTools
🚨 We’re going live in 1 hour! (18:00 IL)
We’re launching CloudCastle, live on air, and talking about how it was built,
Why it matters, and how you can start building your own tools too.
🎙️ Save your spot now — last chance to register:
eventbrite.com/e/14130545170…
🚨 New blog from Security Joes!
Weaponizing Windows Drivers: A Hacker’s Guide for Beginners
Explore how attackers exploit vulnerable drivers (BYOVD) & how defenders can stay ahead.
📖 Read now - securityjoes.com/post/weapon…
Podcast Behind The Scenes - Take 2🎬😂
Join us, July 15 2025 at 18 PM Israel Time.
(Not July 16!!)
Register here: eventbrite.com/e/building-se…
#שער_ריק #its_the_15 #AI #security_joes #incident_response
Join us as we release CloudCastle - CSPM for everyone, for free.
In this podcast-
1. Why CloudCastle
2. Code overview
3. DIY tips
4. AMA session with our CEO @IdoNaor1, who coded the tool single-handedly
Host: Sr. IR, Eilay Y.
#XJOES
linkedin.com/posts/security-…
