Dave Bell retweeted
.@Volexity shares #threatintel on how #StormBamboo compromised an ISP to conduct DNS poisoning attacks on targeted organizations & abuse insecure HTTP software updates, delivering custom malware on both macOS + Windows.
Read the full analysis: volexity.com/blog/2024/08/02…
#dfir
I was reminded of this today for no particular reason ;)
James Mickens’ “Mossad/not-Mossad Duality” in threat models
If you're planning to be in Las Vegas next week and want to reconnect, let me know! Hope to see you there.
Dave Bell retweeted
Our friends over at @redcanary are hiring! Their Intel Analyst role is a full-time #synapse enterprise user!
jobs.lever.co/redcanary/bb7a…
Dave Bell retweeted
Praetorian is hiring for another 3 red teamers at the lead+ level of experience.
Have to be lead or above for this hiring round, no junior or senior for the red team until next quarter, but there are other open positions on our website. We filled 29 reqs in Q1 and are scaling quickly but sensibly.
Our clients have mature environments, you won’t have an easy life; but if you like to be challenged, this is a good place for you.
**I am slow in DMs, best apply via our website but drop me a note
Honeypots, right?
Very cool job opportunity at @GreyNoiseIO for technical people who love to lie- especially to attackers
boards.greenhouse.io/greynoi…
Dave Bell retweeted
Which sounds more realistic?
“If we do a few strategic things we kneecap the attackers”
“We can do all the things everywhere all at once, 365x24 forever.”
It seems like focusing our limited resources where it matters would be better.
3
Dave Bell retweeted
My friend Krypt3ia is still searching for a remote CTI role after being caught in the layoff cycle. He's got years of solid experience and technical chops - including LLM training.
If you've got leads, ping me and I can pass them along or share his resume. RT for reach pls.
I always love paying the bill for search and rescue insurance…makes me feel like I’m planning an antarctic expedition or something
It’s crazy how amazing you feel crossing the finish line…and then completely fall apart 30 seconds later
Dave Bell retweeted
First, I want to compliment @Microsoft for being forthright with details. Some of the problems I see in this report, I SEE EVERYWHERE due to VULNERABLE DEFAULTS.
Let's start with creating malicious OAuth applications. By default, ANY USER can create app registrations and consent to Graph permissions as well as sharing 3rd party company data. In tenants where this is hardened, ability to create app registrations require Application Administrator or Cloud-Application Administrator and admins must consent to permissions used by the application whether local or from another tenant.
Reading SEC filings is also my first step when figuring out “what’s important to this business” (critical input for CTI teams when deciding which threat actors are priority for tracking and which are low risk)
Dave Bell retweeted
My friends, the come has come once again. This holiday season, I'm giving away a golden ticket that grants free entry into ALL my training courses and tons of other amazing prizes.
Dave Bell retweeted
Bypassing Crowdstrike Falcon EDR hooks with targeted algo, decomposing agent's hooking logic.
Although extremely Falcon-specific, nevertheless good exercise for any maldev.
Great work, @inbits_sec!
#redteam
inbits-sec.com/posts/in-memo…
Dave Bell retweeted
Howdy folks! I wrote another free Trimarc whitepaper on #ActiveDirectory Object Ownership. 50+ pages of PDF goodness on how ownership can be abused, how to discover non-standard object ownership, remediate it retroactively, & how to defend against it proactively.
New Trimarc whitepaper by @JimSycurity: "Owned or Pwnd - Discovering and Remediating AD Object Ownership Issues" is available for download below.
hub.trimarcsecurity.com/post…
For more AD and Azure AD tips, join for our AMA tomorrow afternoon at 2pm ET.
attendee.gotowebinar.com/reg…
