Director of Information Security @ussignalcom #blueteam - Security Engineering and SOC Management Former AdMan | Aspiring pro home cook Comments are my own.
GR, MI
Joined April 2009
- Tweets2.7K
- Following983
- Followers375
- Likes907
nick defoe [email protected] retweeted
I promise not to ever talk about politics because I know very little about and I don’t follow it for my own mental health.
An exception is when it comes to UAP/UFOs - I apologize as I know folks are polarized and get bombarded on everything but it’s one that regardless of there is or isn’t - we deserve to know and the government can’t keep it from its people.
I’m not sold that there are aliens and skeptical because it’s all third hand, but without hurting defense capabilities if it’s super secret programs …is it us or is it something else.
The time for disclosure is now. This is a bipartisan issue and needs to happen.
Thank you @SenSchumer and @SenatorRounds.
nick defoe [email protected] retweeted
My first blog with @MicrosoftDART!
This is a post incident report, talking about some of the TTPs we saw in a recent ransomware incident. This really emphasizes the importance of doing a post ransomware IR.
microsoft.com/security/blog/…
nick defoe [email protected] retweeted
I'm sorry to report that working in Security is less "bleeding-edge malware research" and more "project manager for people who don't report to you."
nick defoe [email protected] retweeted
I have a 🧵 about CISOs and CSOs and their fate. Get a cold drink or maybe a cuppa, as this is a long one. 1/32
nick defoe [email protected] retweeted
Excited to share with you all that Target has released a web UI for Strelka, our open source file scanner! You can now use Strelka as a standalone analysis tool.
github.com/target/strelka-ui
nick defoe [email protected] retweeted
💫 Detection engineers and threat hunters - this is a big deal!
You love to see this... I couldn't agree more with their statement! (elastic.co/blog/continued-le…)
🗣️📢 Being open to detecting methods is the way to go. Security through obscurity isn’t security...
We just released 1000+ yara rules and 200+ endpoint behavior rules github.com/elastic/protectio…
nick defoe [email protected] retweeted
An American experiences universal health care
nick defoe [email protected] retweeted
dude what
Microsoft rolls back decision to block Office macros by default - @serghei
bleepingcomputer.com/news/mi…
nick defoe [email protected] retweeted
1/ The Nightmare Scenario SCOTUS is Plotting For the 2024 Election Takeover:
nick defoe [email protected] retweeted
How much is a SANS cert now? $7K? Maybe they should sit this one out.
We firmly believe entry level should mean entry level.
#cybersecurity #InfosecMemes #CybersecurityMemes
nick defoe [email protected] retweeted
Long thread but serious talk.
Seeing a massive problem in the security industry today. We have brand new candidates lacking "hands on" experience coming into the workforce and finding it extremely difficult to find a job. 1/10
nick defoe [email protected] retweeted
For orgs using M365 and allowing use of Chrome, it might be worth doublechecking that you are deploying all of the necessary Chrome extensions to ensure everything is working as expected
@dougsbaker has a really nice summary of the extensions here:
dougsbaker.com/2021/11/08/mi…
nick defoe [email protected] retweeted
Another great report from the team!
Notice how they exfiltrated important documents, backups and internal certificates.
Also, notice that there were:
🚫No Ransomware
🚫No Cobalt Strike
We have come to a new ransomless and beaconless era…
Will the Real Msiexec Please Stand Up? Exploit Leads to Data Exfiltration
➡️Initial Access: CVE-2021-44077 exploited
➡️Execution: Web shell
➡️Credential Access: WDigest + MiniDump
➡️Lat Movement: RDP using Plink
➡️Exfiltration: Sensitive data exfilled
thedfirreport.com/2022/06/06…
nick defoe [email protected] retweeted
⚠️New tool alert⚠️
Please welcome to the world of cloud incident response the Microsoft 365 Extractor Suite. A suite of scripts to acquire the Microsoft 365 Unified Audit Log. Most important features/updates in this thread 🧵
github.com/invictus-ir/Micro…
nick defoe [email protected] retweeted
Are you responsible for Azure AD in your org? This is a MUST read.
What happens when someone accidentally runs a script that deletes all the user objects in your tenant? What if you delete all the apps? Here is a short but important thread. 👇🧵
nick defoe [email protected] retweeted
DNSQuerySniffer is such a neat tool. Immersing yourself in the invisible goings-on of systems is just as important as directed study. There's little insights everywhere.
nick defoe [email protected] retweeted
Sigh.
I try to be nice... but when I see people giving flat out wrong advice... it's trying.
Complaint du jour:
q: we're struggling with patching
"expert": yes, it's hard. Just do it more... harder and faster for a bit. You'll get caught up, then it's easier.
1
nick defoe [email protected] retweeted
If you are in the US/UK/ANZ at a small co-op/muni & need ICS cybersecurity support (Dragos Platform technology, managed service, and incident response) please feel free to message me directly. Dragos is going to make our capabilities free for the smaller members of our community
nick defoe [email protected] retweeted
Cisco is offering Splunk $20 billion... Unclear if they're trying to buy the company, or just renew their subscription for another year.
nick defoe [email protected] retweeted
Macros from the internet will be blocked by default in Office. This is a really big win. Well done, @Microsoft.
docs.microsoft.com/en-us/Dep…