
Senior Engineer @SecurityOnion | Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own
Joined July 2011
- Tweets20.6K
- Following4.9K
- Followers2.5K
- Likes48.9K
Scott Lynch retweeted
MISP v3.0 Early Access: a first look at what's new
#misp #cti #OpenSource #ThreatIntelligence
misp-project.org/2026/10/16/…
Scott Lynch retweeted
For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed:
📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year
📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols
📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion
Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others!
Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!
Scott Lynch retweeted
"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom."
Read the full report: buff.ly/jTXN9HO
#DFIR #ThreatIntel
Scott Lynch retweeted
🔥🖥️👍🏻
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
hashcat v8.0.0 released!
The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards.
Release notes: github.com/hashcat/hashcat/b…
Download: hashcat.net/hashcat/
Scott Lynch retweeted
Great Sunday read for all people doing red teaming ⤵️
When a Red Team Engagement Gets Detected: Operational Decisions, Risk Boundaries, and Escalation gikaku.net/2026/10/25/red-te…
Scott Lynch retweeted
𝗕𝗲𝗳𝗼𝗿𝗲 𝘆𝗼𝘂 𝗱𝗶𝘀𝗮𝗯𝗹𝗲 𝗡𝗧𝗟𝗠: 𝗸𝗻𝗼𝘄 𝘄𝗵𝗮𝘁 𝗯𝗿𝗲𝗮𝗸𝘀.
Hardcoded apps, IP-based connections, legacy appliances with no Kerberos path. Audit first, block later. Microsoft's NTLM-deprecation FAQ:
buff.ly/CtsX44x
#Microsoft #WindowsSecurity
Scott Lynch retweeted
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
Scott Lynch retweeted
In case anyone wants to see how these attacks work and test their detection/response, I did a webinar with @AlteredSecurity where I showed how to modify evilginx and automate passkey registration
Code is here:
github.com/nathanmcnulty/res…
Video (4m-8m):
youtube.com/watch?t=239&v=kw…
Entra ID Protection finally added a detection around suspicious addition of credentials 🥳
We've been seeing attackers register passkeys a lot lately, no attestation for users who are eligible to use SMS/voice is only making it worse... :-/
learn.microsoft.com/en-us/en…
Scott Lynch retweeted
Hacking a Bluetooth speaker from IKEA: Technical research and a love story hidden in encrypted firmware. 🔵🦷🔊🪓♥️
More details on:
LinkedIn: lnkd.in/p/djfJvtFd
Substack: it4sec.substack.com/p/hackin…
Telegram: t.me/it4sec/90
Scott Lynch retweeted
Hanging out at the best BSides in the country.
@BSidesAugusta
Scott Lynch retweeted
If you’re attending @BSidesAugusta looks @attrc ‘s talk is going to be excellent as well as the one by @dougburks pimpin his SO-CRATES tool. If you see him give him a Bill & Ted “Excellent!!!”
Scott Lynch retweeted
Super excited for @BSidesAugusta today!
Hope to see you at my talk at 3PM on SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
Scott Lynch retweeted
Josh Brower is presenting “Sigma Correlations: Everything, Everywhere, All Within 5 Minutes” at Security Onion Conference @securityonion
Scott Lynch retweeted
Matt Gracie is kicking off this year’s Security Onion Conference with a review of what we’ve been up to the last year! @securityonion
Scott Lynch retweeted
Bryant Treacle presenting “Defending OT/ICS Environments with Security Onion” at Security Onion Conference @securityonion
Scott Lynch retweeted
We just released a new Splunk ESCU version 6.9.1 with initial coverage for PHP2Shell - Grab the update today splunkbase.splunk.com/app/34…
Check out the dedicated analytic story for more details - research.splunk.com/stories/…
Big shoutout to Onur Mustafa Erdogan @raven_tait @SnekCharmerr for making this happen
Scott Lynch retweeted
New Field Note: Reconstructing an Attacker’s Workflow
During a recent incident, we recovered several PowerShell scripts an attacker left behind. They revealed a surprisingly practical post-exploitation toolkit:
- File-based command execution
- Credential harvesting through Windows authentication prompts
- Active Directory reconnaissance and remote WMI access testing
- SMB share discovery and permission checks
Parts of this tradecraft overlap with activity Microsoft documented in its analysis of the TerminalFix campaign, a ClickFix variant that ultimately deploys a reverse tunnel into the victim network
Link: dfir.ch/posts/field_note_att…






























