Scott Lynch (@packetengineer) header
Scott Lynch (@packetengineer) profile picture

Senior Engineer @SecurityOnion | Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own

Joined July 2011
Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)Photo by Scott Lynch (@packetengineer)
勝手ながら、DFIRのログ分析に最強の「IRFlow Timeline」のバグを色々修正し、機能も改善しました! 季節やイベントに合わせたテーマも追加したので、四季を感じながらDFIR調査を楽しめます!🌸☀️🍁❄️🎄 本家リポジトリにもPRを出す予定ですが、一足先に使ってみたい方は以下のリンクからダウンロードできます! Mac: github.com/Yamato-Security/i… Linux: github.com/Yamato-Security/i… Windows: github.com/Yamato-Security/i…
🤖 Made with AI
2
29
1
139
7,138
Scott Lynch retweeted
Congrats @iamdothash on another great release!
Just launched cliamp v2.4.0. Was about time. Thank you all for the contributions!
1
1
12
386
Scott Lynch retweeted
Honestly, if you read just one thing today, please read the annual report from @NCSC In a sea on hype, this is an honest, sensible view of the world! A great job from the team! #UK #Cyber #NCSC #DefendAsOne #Security #AI ncsc.gov.uk/collection/annua…
8
62
2
300
16,571
Scott Lynch retweeted
.@securityonion enters the chat
Security is like an onion 🧅 There’s more to it than passwords. Strong security relies on multiple layers of protection: - Physical security - Identity and access - Networks - Applications - Data protection No single layer can do it alone.
2
9
271
Scott Lynch retweeted
OhMyDebn 4.15.0 is out! OhMyDebn is a debonair Linux desktop for power users. It gives you the stability of Debian or Ubuntu, the ease of use of the Cinnamon desktop, and the power of AI, containers and virtualization, with two dozen themes and a keyboard-driven menu for everything. It installs on Debian, Ubuntu, Linux Mint, LMDE, Kali, Parrot OS, MX Linux, Pop!_OS, Zorin OS, Devuan, LCOS and Raspberry Pi OS. New in this release: - Parrot OS 7 is now supported. - A drop-down console. Press Super and the key left of 1 for a terminal in the middle of your screen, above your other windows, running your default AI assistant. Press the same keys to hide it: your assistant keeps working, and the console comes back with the same conversation on whichever workspace you're on. - Jade Horse, a theme in jade greens from Omarchy, with three backgrounds. It replaces Osaka Jade, and updating moves anyone using Osaka Jade to it. - The themes from Omarchy are updated to Omarchy 4.5, with a new background for Ethereal. - Updated components: Codex 0.166, Crush 0.99, Oh My Pi 18.15, OpenCode 2.2.5, Pi 1.5.0, T3 Code 0.1.6 and SO-CRATES 5.2.0.
1
3
1
9
533
Scott Lynch retweeted
SO-CRATES 5.2 now with pew pew! New Traffic Map: watch a capture's flows and alerts fly across the world as they happened, then click a country to filter everything. I blame @TomLawrenceTech 🤣
1
2
5
247
Scott Lynch retweeted
Congratulations to @LundukeJournal on LCOS 1.0! If you want to give your LCOS some Omarchy vibes, then just add OhMyDebn
Lunduke Computer Operating System (LCOS) 1.0 Released! ID Verification & data collection. Forced online accounts. Bloated, slow software. AI features shoehorned everywhere. And weird, Woke politics. LCOS has none of that nonsense. The LCOS 1.0 Press Release: lunduke.substack.com/p/press… The LCOS Website: lunduke.com/lcos.html
3
4
55
2,157
Scott Lynch retweeted
I’ve had a number of messages asking to comment on the Lear crash. I’ve learned who the crew was, I did not know them, but I’m going to give them the respect and reverence they should be given. They were two young pilots out there doing what they loved to do. I also agree with everything Adam is saying here. I’m sick of the constant flow of negativity every time a female or minority is involved in an accident or incident. It’s too bad people are allowed to hide behind anonymous usernames.
A plane crashes in Florida, lives are lost, and within HOURS the blue-checkmark crowd is blaming a female pilot and screaming “DEI.” Here's the problem: They don't understand how a two-pilot cockpit works. As a pilot, I'm disgusted. Watch this before you embarrass yourself.
128
341
15
4,740
358,805
More ARTEX and Cairn - find more activity in the thread xitter.gq/ahnlabglobal/status/21…
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates. I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast. I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood. #ARTEX #Cairn nextron-systems.com/2026/10/…
1
11
62
8,167
Scott Lynch retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free. ❤️👨‍💻 dynamicincidentresponse.com/…
12
92
4
434
34,034
Scott Lynch retweeted
OhMyDebn 4.14.0 is out! Sign PDFs with your own signature, OpenCode 2 and its new desktop app, Crush from Charm, a speed and bufferbloat test, and Zorin OS 18 support.
1
1
4
236
Scott Lynch retweeted
should I add a pew pew map to SO-CRATES?
Replying to @UK_Daniel_Card
Ever since 1983 people think hacking is pew pew maps.
1
1
4
396
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates. I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast. I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood. #ARTEX #Cairn nextron-systems.com/2026/10/…
🤖 Made with AI
13
50
2
190
21,567
Scott Lynch retweeted
SO-CRATES 5.1 is out. Last week brought two big issues: php2shell, a pair of PHP flaws that turn a multipart upload into a remote shell, and the eMudhra CA key compromise, where eight intermediate CAs turned out to have recoverable private keys. Would you spot either in a packet capture? php2shell: yes. Emerging Threats Open added rules within days, and the 5.1 image ships them, so SO-CRATES flags the exploit attempts under Network Alerts. eMudhra: no IDS rule existed. Those eight intermediates never issued a real certificate, so any certificate from one of them on the wire is a forgery. SO-CRATES 5.1 adds a high-severity Finding that flags exactly that, on new captures and ones you've already analyzed. Also new: right-click any value to pivot, and tighter stat cards that show more results above the fold. SO-CRATES is free and open source from Security Onion Solutions: one container, works offline, for PCAPs, logs, email and binaries.
1
3
6
347
Scott Lynch retweeted
Happy to support such a worthy cause!
A heartfelt thank you to @securityonion for their $25,000 donation to the RTF! Their continued generosity helps students explore all the possibilities technology has to offer, and we are grateful to have them alongside us year after year.
1
2
6
246
Scott Lynch retweeted
For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed: 📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year 📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols 📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others! Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!
2
5
1
8
1,418
"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom." Read the full report: buff.ly/jTXN9HO #DFIR #ThreatIntel
3
19
85
7,987