
Senior Engineer @SecurityOnion | Certified @SANSDefense Instructor | SECOPS/CERT Manager | Defcon BTV | Navy Vet | Sailor | Tweets Are My Own
Joined July 2011
- Tweets20.6K
- Following5K
- Followers2.5K
- Likes49.1K
Scott Lynch retweeted
勝手ながら、DFIRのログ分析に最強の「IRFlow Timeline」のバグを色々修正し、機能も改善しました!
季節やイベントに合わせたテーマも追加したので、四季を感じながらDFIR調査を楽しめます!🌸☀️🍁❄️🎄
本家リポジトリにもPRを出す予定ですが、一足先に使ってみたい方は以下のリンクからダウンロードできます!
Mac: github.com/Yamato-Security/i…
Linux: github.com/Yamato-Security/i…
Windows: github.com/Yamato-Security/i…
🤖 Made with AI
Scott Lynch retweeted
Congrats @iamdothash on another great release!
Scott Lynch retweeted
Honestly, if you read just one thing today, please read the annual report from @NCSC
In a sea on hype, this is an honest, sensible view of the world! A great job from the team!
#UK #Cyber #NCSC #DefendAsOne #Security #AI
ncsc.gov.uk/collection/annua…
Scott Lynch retweeted
.@securityonion enters the chat
Scott Lynch retweeted
OhMyDebn 4.15.0 is out!
OhMyDebn is a debonair Linux desktop for power users. It gives you the stability of Debian or Ubuntu, the ease of use of the Cinnamon desktop, and the power of AI, containers and virtualization, with two dozen themes and a keyboard-driven menu for everything. It installs on Debian, Ubuntu, Linux Mint, LMDE, Kali, Parrot OS, MX Linux, Pop!_OS, Zorin OS, Devuan, LCOS and Raspberry Pi OS.
New in this release:
- Parrot OS 7 is now supported.
- A drop-down console. Press Super and the key left of 1 for a terminal in the middle of your screen, above your other windows, running your default AI assistant. Press the same keys to hide it: your assistant keeps working, and the console comes back with the same conversation on whichever workspace you're on.
- Jade Horse, a theme in jade greens from Omarchy, with three backgrounds. It replaces Osaka Jade, and updating moves anyone using Osaka Jade to it.
- The themes from Omarchy are updated to Omarchy 4.5, with a new background for Ethereal.
- Updated components: Codex 0.166, Crush 0.99, Oh My Pi 18.15, OpenCode 2.2.5, Pi 1.5.0, T3 Code 0.1.6 and SO-CRATES 5.2.0.
Scott Lynch retweeted
SO-CRATES 5.2 now with pew pew!
New Traffic Map: watch a capture's flows and alerts fly across the world as they happened, then click a country to filter everything.
I blame @TomLawrenceTech 🤣
Scott Lynch retweeted
Congratulations to @LundukeJournal on LCOS 1.0!
If you want to give your LCOS some Omarchy vibes, then just add OhMyDebn
Lunduke Computer Operating System (LCOS) 1.0 Released!
ID Verification & data collection. Forced online accounts. Bloated, slow software. AI features shoehorned everywhere. And weird, Woke politics.
LCOS has none of that nonsense.
The LCOS 1.0 Press Release: lunduke.substack.com/p/press…
The LCOS Website: lunduke.com/lcos.html
Scott Lynch retweeted
I’ve had a number of messages asking to comment on the Lear crash. I’ve learned who the crew was, I did not know them, but I’m going to give them the respect and reverence they should be given. They were two young pilots out there doing what they loved to do.
I also agree with everything Adam is saying here. I’m sick of the constant flow of negativity every time a female or minority is involved in an accident or incident. It’s too bad people are allowed to hide behind anonymous usernames.
Scott Lynch retweeted
I’m honored, thank you @lennyzeltser !
I updated the IR report template to incorporate some of what I've learned from @joswr1ght's amazing and free book, Dynamic Incident Response. zeltser.com/incident-respons…
Scott Lynch retweeted
I updated the IR report template to incorporate some of what I've learned from @joswr1ght's amazing and free book, Dynamic Incident Response. zeltser.com/incident-respons…
Scott Lynch retweeted
More ARTEX and Cairn - find more activity in the thread
xitter.gq/ahnlabglobal/status/21…
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
Scott Lynch retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.
❤️👨💻
dynamicincidentresponse.com/…
Scott Lynch retweeted
OhMyDebn 4.14.0 is out!
Sign PDFs with your own signature, OpenCode 2 and its new desktop app, Crush from Charm, a speed and bufferbloat test, and Zorin OS 18 support.
Scott Lynch retweeted
should I add a pew pew map to SO-CRATES?
Scott Lynch retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
Scott Lynch retweeted
SO-CRATES 5.1 is out.
Last week brought two big issues: php2shell, a pair of PHP flaws that turn a multipart upload into a remote shell, and the eMudhra CA key compromise, where eight intermediate CAs turned out to have recoverable private keys.
Would you spot either in a packet capture?
php2shell: yes. Emerging Threats Open added rules within days, and the 5.1 image ships them, so SO-CRATES flags the exploit attempts under Network Alerts.
eMudhra: no IDS rule existed. Those eight intermediates never issued a real certificate, so any certificate from one of them on the wire is a forgery. SO-CRATES 5.1 adds a high-severity Finding that flags exactly that, on new captures and ones you've already analyzed.
Also new: right-click any value to pivot, and tighter stat cards that show more results above the fold.
SO-CRATES is free and open source from Security Onion Solutions: one container, works offline, for PCAPs, logs, email and binaries.
Scott Lynch retweeted
Happy to support such a worthy cause!
A heartfelt thank you to @securityonion for their $25,000 donation to the RTF! Their continued generosity helps students explore all the possibilities technology has to offer, and we are grateful to have them alongside us year after year.
Scott Lynch retweeted
MISP v3.0 Early Access: a first look at what's new
#misp #cti #OpenSource #ThreatIntelligence
misp-project.org/2026/10/16/…
Scott Lynch retweeted
For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed:
📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year
📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols
📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion
Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others!
Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!
Scott Lynch retweeted
"Approximately five hours after this initial execution, Bumblebee deployed an AdaptixC2 beacon (AdgNsy.exe), which established a new C2 channel to 172.96.137[.]160:443. The threat actor then initiated internal reconnaissance using built-in Windows utilities, including systeminfo, nltest /dclist:, whoami /groups, and net group domain admins /dom."
Read the full report: buff.ly/jTXN9HO
#DFIR #ThreatIntel
























