@cybersecmeg@CrowdStrike As someone who currently works in CTI and wants to continue to get into malware analysis. Is sharing my findings on Twitter a good place to start 'building a portfolio' so to speak? Or would a full blog be better?
@x86rax What type of scripts do you use for monitoring? I'm trying to evolve past refreshing my VirusTotal searches every day looking for new SOCGholish infrastructure.
Anyone have experience analyzing SocGholish / FakeUpdates compromised sites? Seeing a lot of the malicious redirects returning 404s today and not sure if it's poor infrastructure management on their part or some type of anti-analysis?
@ImposeCost I feel like vendors are either pumping a list of atomic IOCs or full 10-page fintel weeks later (which does still have value, don't get me wrong). I have to come to twitter to learn about timely updates to TTPs to hunt for.
@ImposeCost I would love to see more short form tactical intel (not just a list of IOCs). Like daily-cadence, very short, reports of top-malware strain campaigns. "Hey IcedId is delivering via .iso attachments with this theme today. When run here's the process trees that lead to 2nd stage".
@GootLoaderSites@eSentire@esthreat Any recommendations on how to confirm if a specific <domain>/xmlrpc[.]php is actually malicious vs a stuffed false positive?
36 Followers 74 FollowingTurning relevant threat intelligence into actionable detections and threat hunts to help security teams improve coverage and respond to incidents
45 Followers 79 FollowingI am a user. I like VR/RE/Exploit Dev/CTF/SDR/RF/Unix/assembly/Python/things that {float,fly,drive}/dark mode
@[email protected]
36 Followers 74 FollowingTurning relevant threat intelligence into actionable detections and threat hunts to help security teams improve coverage and respond to incidents
4K Followers 13 Following📣 We tweet malicious packages detected on npm in real-time. 🚨 Not affiliated with @npmjs or @github. 🛡 Powered by the @SocketSecurity threat feed. ✨
3K Followers 1 FollowingTrain on raw telemetry from actual breaches. Investigate malware and reconstruct the kill chain from process creation to exfiltration and beyond.
5K Followers 101 FollowingCreator of Debloat and https://t.co/tIYqmw6pxt
Support: https://t.co/l9kCPRoD2y
Join the Debloat/CertGraveyard discord: https://t.co/ZcWIqa6ZA9
10K Followers 6K Following@Volatility Core Dev | Art of Memory Forensics co-author | Sr. Director of Adversary Tactics @HuntressLabs | #DFIR enthusiast/trainer | [email protected]
762 Followers 9 Followinghttps://t.co/O6yx9lhxus consists of a bunch of experienced Cyber Threat Analysts and Incident Responders who have been working together for many years.
17K Followers 1 FollowingTHESE 👏 TWEETS 👏 ARE 👏 FICTION👏
This account tweets fictional or headline inspired breach scenarios.
To play: Share opinions on prevention or response steps.
195K Followers 415 FollowingSANS is the most trusted and by far the largest source for information & cyber security training, certification and research in the world.
11K Followers 0 FollowingAssetnote combines advanced reconnaissance and high-signal continuous security analysis to help enterprises gain insight and control of their evolving exposure.