Phill Moore @phillmoore X Profile

Phill Moore

@phillmoore

Followers

9K

Following

7K

Media

415

Statuses

7K

This Week in 4n6 // ThinkDFIR https://t.co/vLyL2sgQsy I might not know much, but I do know how to Google Tweets are mine

https://t.co/NUM9xmeq8s

Sydney, Australia

Joined March 2009

Don't wanna be here? Send us removal request.

Phill Moore

@phillmoore

3 days

A question about arbitrary values in USB registry keys #DFIR https://t.co/bXK7TwG0lM

thinkdfir.com

I was recently teaching the SANS FOR500 Windows Forensic Analysis class in Canberra and I was asked a question about how we track the connection times for USB devices in the registry: My answer at …

1

5

20

Phill Moore

@phillmoore

3 days

Week 47 - 2025 #DFIR https://t.co/Kb1WJvx5A9

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

14

19

Phill Moore

@phillmoore

10 days

Week 46 - 2025 #DFIR https://t.co/Gff7Gpk478

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

15

23

Phill Moore

@phillmoore

11 days

Day 6 about to kick off for my last #FOR500 class for the year. 5 students will be crowned as new lethal forensicators!

1

13

Phill Moore

@phillmoore

17 days

Week 45 - 2025 #DFIR https://t.co/dgfgBdq9dU

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

10

23

Phill Moore

@phillmoore

24 days

Week 44 – 2025 #DFIR https://t.co/8oGCrFI3a9

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

15

25

Phill Moore

@phillmoore

1 month

Week 43 – 2025 #DFIR https://t.co/DYXqGrDMBk

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

12

21

Phill Moore

@phillmoore

1 month

Week 42 - 2025 #DFIR

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

11

23

Phill Moore

@phillmoore

1 month

Week 41 - 2025 #DFIR https://t.co/VeV2VdkbTV

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

13

22

Phill Moore

@phillmoore

2 months

Week 40 - 2025 #DFIR https://t.co/uQ1qFyBeeG

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

15

20

Phill Moore

@phillmoore

2 months

Week 39 - 2025 #DFIR https://t.co/LTqLpZwl8i

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

13

26

Phill Moore

@phillmoore

2 months

Week 38 - 2025 #DFIR https://t.co/jFOB2gyskp

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

18

26

Phill Moore

@phillmoore

2 months

Week 37 - 2025 #DFIR https://t.co/dEaWh252ej

thisweekin4n6.com

Inside the Salesloft-Drift Breach: What It Means for SaaS & Identity SecurityIn this session, Permiso’s CTO will cover:- How attackers moved from GitHub → AWS → Salesforce using stolen OAuth to…

0

21

32

Phill Moore

@phillmoore

3 months

Week 36 - 2025 #DFIR https://t.co/LnVJ3sCDc6

thisweekin4n6.com

Learn Scattered Spider’s Updated TTPs & How to Defend Against ThemIn this webinar, Permiso’s CTO and Head of P0 Labs Threat Research will discuss:- How Scattered Spider’s methods have evolved o…

0

16

30

Phill Moore

@phillmoore

3 months

If you're in Tokyo make sure to drop in on Friday and learn about how to examine an encrypted virtual disk!

SANS Japan

@SANS_JAPAN

3 months

🔥Community Nightのお知らせ 9月12日にCommunity Nightを開催します！ SANSのPhill Mooreが「暗号化されたディスクの襲撃者」と題して講演します。インシデント解決に不可欠な一連のフォレンジック証拠を、手動と自動の両方の手法を用いて回復した方法を説明します。詳細： https://t.co/GjQhxqTILJ

0

1

7

Wiz

@wiz_io

3 months

🚨 Your Cloud DFIR Desk Mat is here! A first-ever poster mapping MITRE ATT&CK to key AWS, Azure & GCP log sources and API events. 📥 Get your copy: https://t.co/8q8UyYFiMO