James D
@FranticTyping
Followers
834
Following
273
Media
9
Statuses
389
Threat Hunting | Detection Engineering | Defensive Automation (ex @Countercept, @mwrlabs)
Joined April 2008
I'm happy to announce the release of Chainsaw v2! 🥳 . Chainsaw allows users to rapidly search through Windows event logs and hunt for threats using @sigma_hq detection rules, all without a SIEM!. Version 2 includes some exciting new features, info in 🧵.
github.com
Rapidly Search and Hunt through Windows Forensic Artefacts - WithSecureLabs/chainsaw
13
240
666
Slides from this talk are now available here:
My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀.
0
0
4
My talk "Scaling Detection and Response Teams - Enabling Efficient Investigations" is at 3:45pm today at #BSidesLDN2023 on track 2! Come down and say hi if you're around 😀.
sched.securitybsides.org.uk
Help! We’ve bought the latest tools, we’ve got all our logs in a SIEM, we’ve tuned and tweaked our detection rules, we’ve even built investigation playbooks… but we still don’t have enough time to...
2
3
21
Scaling detection and response operations at Coinbase part 2 & 3:. 🔍 Driving context into detection logic with machine and user profiles.🔧 Codifying automatic remediation for high-risk detections.📫 Automating alert triage with employees via Slackbot.
2
31
79
The first part of my blog series on how we’ve been scaling detection and response operations at Coinbase is live! . Interested in speeding up your investigations, increasing the visibility of key data sources, and improving quality of life for analysts? .
3
22
120
Awesome to see this new feature being added to chainsaw! Great work @AlexKornitzer @56616C6F72 💪.
Our incident responders recently battled TheDukes/CozyBear/APT29 out of a customer environment. We also developed tooling to help investigate the timeline of the breach. We added 3 techniques for the analysis & timestamp enrichment of Shimcache entries
0
1
4
RT @VirtualAllocEx: With "Meterpreter vs. Modern EDR(s)" I want to show, that the shellcode of well-known C2 frameworks like Metasploit is….
redops.at
0
117
0
RT @magerbomb: Our team at @elastic has been developing this feature for almost six years and we are excited to share our work with the sec….
0
7
0
RT @Purp1eW0lf: Dude, you can wipe whatever WEVTXs you want 🪠 . @HuntressLabs gon' find the user accounts, session times, machines, and met….
0
29
0
RT @jpgoldberg: I have never before criticized a competitor by name on the @1Password blog. This is an exception.
blog.1password.com
How 1Password goes above and beyond to protect you in the event of a data breach.
0
115
0
RT @holisticinfosec: Hunt, search, and extract Windows event log records with Chainsaw, now in #toolsmith 148. Experiments with an old #DFI….
holisticinfosec.io
toolsmith #148: Hunt, search, and extract event log records
0
28
0
Also, a massive shout out to @AlexKornitzer for all of his work on v2. He managed to take my “lockdown 2020 Christmas project” and turn it into a much more polished solution. ❤️.
1
0
13
v2 highlights💡. 📖 Support for event logs in XML and JSON format.🎯 Increased sigma rule logic support. More detections!.📘 Chainsaw output displays important information more clearly .🔎 Better filtering/searching options.🦖 Updated Velociraptor Plugin
4
2
17
Really cool to see this tool finally public! If you’re still viewing alert data in a jira ticket, I’d recommend checking out the approach DetectTree takes to visualise detections, it makes a massive difference.
Happy to drop this new open-source tool that connects the dots during a cyber attack to help blue teams cut down response times, avoid alert fatigue, and communicate during an incident. More info here >> #cybersecurity #incidents #infosec
1
1
6
RT @jaredcatkinson: Check out the first post in my new blog series "On Detection: From Tactical to Functional". The first post explores how….
posts.specterops.io
In my Understanding the Function Call Stack post, I introduced the nesting nature of Windows API functions. There is almost always a superficial/documented version of the API that then goes through a…
0
83
0
RT @patrickwardle: macOS malware often (ab)uses APIs such as NSCreateObjectFileImageFromMemory, NSLinkModule etc) to execute in-memory payl….
0
81
0
RT @Kostastsale: I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make….
0
1K
0
RT @AlleinAan: F-Secure is hiring my replacement, a new Head of Threat Intelligence, based in Europe. This is a genuinely exciting opportun….
emp.jobylon.com
F-Secure delivers research-led cyber security to defend organizations, society and people from real-world attacks and build resilience into their approach. Our people are a mix of technical and...
0
6
0
