Mastodon 🐘

Josh LemonWow, Microsoft is removing <a href="https://infosec.exchange/tags/WMIC" class="mention hashtag" rel="nofollow noopener" target="_blank">#WMIC</a> from Windows! But they aren't removing the underlying WMI framework, so threat actors will have to use PowerShell to access WMI.I'm not sure this will have a significant impact on what Threat Actors do with WMI, however, it'll at least force a Threat Actor to use PowerShell where there is better built-in visibility (if it's enabled), compared to WMIC.🔗 <a href="https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242" rel="nofollow noopener" translate="no" target="_blank">https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242</a><a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/CSIRT" class="mention hashtag" rel="nofollow noopener" target="_blank">#CSIRT</a> <a href="https://infosec.exchange/tags/CERT" class="mention hashtag" rel="nofollow noopener" target="_blank">#CERT</a>

Brian Greenberg :verified:CrowdStrike just dropped $290M on a company most of us haven't heard of: Onum. This big-ticket acquisition is a statement about where the industry is headed. The real value here is real-time data pipelines. We're moving from just collecting telemetry to proactively filtering and enriching it so AI models can work faster and more efficiently. It's a foundational shift. TL;DR 🤖 $290M acquisition of Onum 🧠 Focus is on AI-powered data pipelines 🚀 Accelerates threat detection at scale 💡 Less friction for AI/SOC teams <a href="https://www.csoonline.com/article/4057472/crowdstrike-bets-big-on-agentic-ai-with-new-offerings-after-290m-onum-buy.html" rel="nofollow noopener" translate="no" target="_blank">https://www.csoonline.com/article/4057472/crowdstrike-bets-big-on-agentic-ai-with-new-offerings-after-290m-onum-buy.html</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://infosec.exchange/tags/CrowdStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CrowdStrike</a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://infosec.exchange/tags/cloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#cloud</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

Just Another Blue TeamerHappy Monday Everyone!I usually use this space to share workshops, articles, or insights from the community but today is a little different. I was humbled to see my name listed alongside so many amazing professionals as a nominee for the SANS Institute Difference Makers Award.This recognition isn’t about me, though. It’s about celebrating the people who push our field forward, make an impact, and inspire others. If someone has made a difference in your journey, I encourage you to take a moment to recognize them.Nomination form: <a href="https://lnkd.in/dNNeTQKJ" rel="nofollow noopener" translate="no" target="_blank">https://lnkd.in/dNNeTQKJ</a>Have a wonderful day, and as always Happy Hunting!Original Post from Rob T. Lee: <a href="https://www.linkedin.com/posts/leerob_our-core-mission-in-sans-institute-dfir-classes-activity-7372981624734576640-zrwN?utm_source=share&utm_medium=member_desktop&rcm=ACoAABd7OUoBVN750zcbzPTXBcB9nFZcxIiKpRc" rel="nofollow noopener" translate="no" target="_blank">https://www.linkedin.com/posts/leerob_our-core-mission-in-sans-institute-dfir-classes-activity-7372981624734576640-zrwN?utm_source=share&utm_medium=member_desktop&rcm=ACoAABd7OUoBVN750zcbzPTXBcB9nFZcxIiKpRc</a>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#DFIR</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a>

DROP\ TABLE Hacker of EarthseaWhy Your Security Team Needs Geographic Threat Intelligence Visualization 🗺️ Traditional security dashboards show you WHAT happened, but not WHERE it's happening or HOW threats are connected geographically. Your SOC analysts are drowning in isolated alerts while missing the bigger picture - attack campaigns that span multiple IPs and locations. This geographic blind spot is costing companies millions in delayed detection and response times. 🎯 Five Reasons to Use Geographic Threat Intelligence: Faster Incident Response - See attack patterns immediately, not after hours of analysis Better Resource Allocation - Focus security resources on high-risk geographic areas Enhanced Threat Hunting - Spot attack campaigns across multiple IPs and locations Improved Prioritization - Group related threats by geography and risk level Better Communication - Show executives the threat landscape visually Don't let your security team fight blind. Give them the geographic intelligence they need to win the battle against cyber threats. <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntelligence</a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOC</a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://infosec.exchange/tags/SecurityOperations" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityOperations</a> <a href="https://infosec.exchange/tags/CyberDefense" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberDefense</a> <a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://infosec.exchange/tags/SecurityAnalytics" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityAnalytics</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/CyberThreats" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberThreats</a> <a href="https://infosec.exchange/tags/SecurityTools" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityTools</a> <a href="https://infosec.exchange/tags/DataVisualization" class="mention hashtag" rel="nofollow noopener" target="_blank">#DataVisualization</a> <a href="https://infosec.exchange/tags/SecurityInnovation" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityInnovation</a> <a href="https://infosec.exchange/tags/CyberAwareness" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberAwareness</a> <a href="https://infosec.exchange/tags/SecurityLeadership" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityLeadership</a> <a href="https://infosec.exchange/tags/RiskManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#RiskManagement</a> <a href="https://infosec.exchange/tags/SecurityMonitoring" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityMonitoring</a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/CyberResilience" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberResilience</a> <a href="https://infosec.exchange/tags/SecurityStrategy" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityStrategy</a><a href="https://chickenpwny.github.io/AzureOrder365/" rel="nofollow noopener" translate="no" target="_blank">https://chickenpwny.github.io/AzureOrder365/</a>

Pyrzout :vm:Innovator Spotlight: Darwinium – Source: www.cyberdefensemagazine.com <a href="https://ciso2ciso.com/innovator-spotlight-darwinium-source-www-cyberdefensemagazine-com/" rel="nofollow noopener" translate="no" target="_blank">https://ciso2ciso.com/innovator-spotlight-darwinium-source-www-cyberdefensemagazine-com/</a> <a href="https://social.skynetcloud.site/tags/rssfeedpostgeneratorecho" class="mention hashtag" rel="nofollow noopener" target="_blank">#rssfeedpostgeneratorecho</a> <a href="https://social.skynetcloud.site/tags/autonomouscybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#autonomouscybersecurity</a> <a href="https://social.skynetcloud.site/tags/cyberdefensemagazine" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberdefensemagazine</a> <a href="https://social.skynetcloud.site/tags/realtimeintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#realtimeintelligence</a> <a href="https://social.skynetcloud.site/tags/cyberdefensemagazine" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberdefensemagazine</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/digitalresilience" class="mention hashtag" rel="nofollow noopener" target="_blank">#digitalresilience</a> <a href="https://social.skynetcloud.site/tags/perimetersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#perimetersecurity</a> <a href="https://social.skynetcloud.site/tags/AInativesecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#AInativesecurity</a> <a href="https://social.skynetcloud.site/tags/Beagleredteaming" class="mention hashtag" rel="nofollow noopener" target="_blank">#Beagleredteaming</a> <a href="https://social.skynetcloud.site/tags/adaptivedefense" class="mention hashtag" rel="nofollow noopener" target="_blank">#adaptivedefense</a> <a href="https://social.skynetcloud.site/tags/fraudprevention" class="mention hashtag" rel="nofollow noopener" target="_blank">#fraudprevention</a> <a href="https://social.skynetcloud.site/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://social.skynetcloud.site/tags/GenerativeAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#GenerativeAI</a> <a href="https://social.skynetcloud.site/tags/riskjourneys" class="mention hashtag" rel="nofollow noopener" target="_blank">#riskjourneys</a> <a href="https://social.skynetcloud.site/tags/cyberfraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberfraud</a> <a href="https://social.skynetcloud.site/tags/agenticai" class="mention hashtag" rel="nofollow noopener" target="_blank">#agenticai</a> <a href="https://social.skynetcloud.site/tags/Darwinium" class="mention hashtag" rel="nofollow noopener" target="_blank">#Darwinium</a> <a href="https://social.skynetcloud.site/tags/Spotlight" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spotlight</a> <a href="https://social.skynetcloud.site/tags/CISOs" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISOs</a>

BongoknightCould some people here be interested in a stream/blogpost/threads about threat hunting methodology?I plan to use real world examples found in Cloudflare Top 1M domains. Boosts are welcome! <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/threathunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#threathunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/CTI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CTI</a>

Claroty🔌 Find out how Claroty helps <a href="https://infosec.exchange/tags/PublicUtilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#PublicUtilities</a> organizations reduce their cyber risk with the quickest time-to-value (TTV) and a lower total cost of ownership (TCO)–regardless of the scale or maturity of your program. 📄 <a href="https://claroty.com/resources/datasheets/ot-cybersecurity-and-nerc-cip-compliance-for-public-power-utilities" rel="nofollow noopener" translate="no" target="_blank">https://claroty.com/resources/datasheets/ot-cybersecurity-and-nerc-cip-compliance-for-public-power-utilities</a><a href="https://infosec.exchange/tags/SLG" class="mention hashtag" rel="nofollow noopener" target="_blank">#SLG</a> <a href="https://infosec.exchange/tags/NERCCIP" class="mention hashtag" rel="nofollow noopener" target="_blank">#NERCCIP</a> <a href="https://infosec.exchange/tags/NERC" class="mention hashtag" rel="nofollow noopener" target="_blank">#NERC</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/NetworkProtection" class="mention hashtag" rel="nofollow noopener" target="_blank">#NetworkProtection</a> <a href="https://infosec.exchange/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZeroTrust</a> <a href="https://infosec.exchange/tags/NERCCIP0151" class="mention hashtag" rel="nofollow noopener" target="_blank">#NERCCIP0151</a> <a href="https://infosec.exchange/tags/ExposureManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#ExposureManagement</a> <a href="https://infosec.exchange/tags/AssetDiscovery" class="mention hashtag" rel="nofollow noopener" target="_blank">#AssetDiscovery</a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/CPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPS</a>

InfoQ⚠️ As <a href="https://techhub.social/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ransomware</a> attacks grow in frequency, scale, and sophistication, endpoint security & reactive backups are no longer enough.🔐 Defense has moved beyond traditional antivirus - the new focus is the storage layer: ✅ Immutable backups ✅ AI-powered detection ✅ Isolated vaults📰 Read the <a href="https://techhub.social/tags/InfoQ" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoQ</a> article by Arjun Mullick (Engineering Manager, Meta): <a href="https://bit.ly/4623E3x" rel="nofollow noopener" translate="no" target="_blank">https://bit.ly/4623E3x</a><a href="https://techhub.social/tags/CloudSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudSecurity</a> <a href="https://techhub.social/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://techhub.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://techhub.social/tags/SecurityVulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityVulnerabilities</a>

Josh LemonThat's a bit nasty - a threat actor uses <a href="https://infosec.exchange/tags/Velociraptor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Velociraptor</a> (open source IR tool) as their primary C2 implant on the victim's system.You think they might also let the victim use it for responding to the compromise as well? 😂 <a href="https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/" rel="nofollow noopener" translate="no" target="_blank">https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/</a><a href="https://infosec.exchange/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#DFIR</a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a>

GraylogScaryByte has tackled an important and growing challenge—digital academic fraud. 💻 🏫 🦹 Their integrated <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> platform combining <a href="https://infosec.exchange/tags/Graylog" class="mention hashtag" rel="nofollow noopener" target="_blank">#Graylog</a> Security, AWS, and Obala AI now unifies observability, streamlines detection, and accelerates response time for critical institutions. 🙌 ScaryByte delivers outcomes that matter, including: 🔍 Real-time threat detection ☑️ Faster forensics and compliance 🖥️ Expert-led deployments, scalable on AWSLearn more about how ScaryByte is helping institutions restore trust in online learning.💡😃 See the full case study.👇 <a href="https://graylog.org/resources/customer-story-scarybyte/" rel="nofollow noopener" translate="no" target="_blank">https://graylog.org/resources/customer-story-scarybyte/</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/TDIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#TDIR</a>

GraylogIt's time to tune in for the latest from <a href="https://infosec.exchange/tags/GraylogLabs" class="mention hashtag" rel="nofollow noopener" target="_blank">#GraylogLabs</a>! 📺 🎊 Today we're taking about the new Caddy Webserver Content Pack. Say what? No, not <a href="https://infosec.exchange/tags/Caddyshack" class="mention hashtag" rel="nofollow noopener" target="_blank">#Caddyshack</a>! ⛳ 🦫 Caddy Webserver! 🖥️ This new content pack is going to help you quickly turn raw logs into structured, searchable insights. 🔎💡 🙌 It's available in Illuminate 6.4 and a Graylog Enterprise or Graylog <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> license, and delivers ready-to-use parsing rules, streams, and dashboards. 🚚 Read up on: ❓ What this pack does 🪵 Getting logs into <a href="https://infosec.exchange/tags/Graylog" class="mention hashtag" rel="nofollow noopener" target="_blank">#Graylog</a> 🫵 Why you should log Caddy Webserver logs 🔍 How this helps you quickly detect anomalies, identify suspicious requests, and feed relevant data directly into your <a href="https://infosec.exchange/tags/TDIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#TDIR</a> workflows<a href="https://graylog.org/post/caddy-webserver-data-in-graylog/" rel="nofollow noopener" translate="no" target="_blank">https://graylog.org/post/caddy-webserver-data-in-graylog/</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#incidentresponse</a> <a href="https://infosec.exchange/tags/SIEM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIEM</a>

Just Another Blue TeamerHappy Monday everyone!CrowdStrike is reminding us that just because some of us use Macs, doesn't mean we are malware proof! In this case the cybercriminal group dubbed <a href="https://ioc.exchange/tags/COOKIESPIDER" class="mention hashtag" rel="nofollow noopener" target="_blank">#COOKIESPIDER</a> was deploying their stealer known as <a href="https://ioc.exchange/tags/SHAMOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SHAMOS</a>. Using a combination of malvertising and the <a href="https://ioc.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#ClickFix</a> technique, the group would trick their victim's into installing the Shamos stealer which leads to it running "host reconnaissance and data collection tasks, including searching for known cryptocurrency-related wallet files and sensitive credential-based files on disk". As always, take a read for yourself to see all the details I left out! Enjoy and Happy Hunting!Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS <a href="https://www.crowdstrike.com/en-us/blog/falcon-prevents-cookie-spider-shamos-delivery-macos/" rel="nofollow noopener" translate="no" target="_blank">https://www.crowdstrike.com/en-us/blog/falcon-prevents-cookie-spider-shamos-delivery-macos/</a>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener" target="_blank">#readoftheday</a>

GraylogReason #532 for why you should register NOW(!) for <a href="https://infosec.exchange/tags/GraylogGO" class="mention hashtag" rel="nofollow noopener" target="_blank">#GraylogGO</a>... Seth Goldhammer will be delivering the highly anticipated annual roadmap keynote, "The Road Ahead: Graylog’s Vision for Innovation and <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a>". 🛣️ 🚗 🗺️ Where is <a href="https://infosec.exchange/tags/Graylog" class="mention hashtag" rel="nofollow noopener" target="_blank">#Graylog</a> headed next? 💡 What are the upcoming strategies, innovations, and enhancements that will help you stay ahead in today’s rapidly evolving threat landscape? ✨ What are the Graylog usability improvements that will empower your teams? 🤔 How does Graylog build “<a href="https://infosec.exchange/tags/SIEM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIEM</a> without compromise?”Find out! On Sept. 17th at 9AM ET—but only if you REGISTER (it's 🆓) — <a href="https://graylog.info/41iu8fv" rel="nofollow noopener" translate="no" target="_blank">https://graylog.info/41iu8fv</a>Whether your an enterprise customer or an open source user, you’ll leave this session inspired and ready to take full advantage of what’s next.<a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a>

Just Another Blue TeamerHappy Wednesday everyone!<a href="https://ioc.exchange/tags/GodRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#GodRAT</a> is a new remote trojan that is targeting financial institutions as reported by Kaspersky. According to their analysis, GodRAT is based on the <a href="https://ioc.exchange/tags/Gh0stRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#Gh0stRAT</a> codebase and uses steganography to evade detection. It supports additional plugins that are used to explore the victim's systems, deploy browser password stealers, and during the attack they even deployed the <a href="https://ioc.exchange/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#AsyncRAT</a> as a backup to maintain access.Looking at two password stealer payloads, it can give us some ideas of where to begin a hunt focused on this threat: Both the Chrome and MS Edge password stealer added an executable to the path %ALLUSERSPROFILE%\google\ and named them after the browser they were after ("chrome.exe" and "msedge.exe" respectfully). An interesting hunt would be to look at new executables added to this directory OR hunt for executables that may be masquerading as browser related executables! However you do it, get hunting!GodRAT – New RAT targeting financial institutions <a href="https://securelist.com/godrat/117119/" rel="nofollow noopener" translate="no" target="_blank">https://securelist.com/godrat/117119/</a>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a> <a href="https://ioc.exchange/tags/IntelDriveThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#IntelDriveThreatHunting</a>

The DefendOps DiariesOkta just flipped the script on cybersecurity by open-sourcing its Auth0 Rules Catalog. Imagine a community-powered playbook that spots threats before they strike—ready to change the game? Check out how this could redefine defense.<a href="https://thedefendopsdiaries.com/oktas-open-source-initiative-empowering-cybersecurity-with-the-auth0-rules-catalog/" rel="nofollow noopener" translate="no" target="_blank">https://thedefendopsdiaries.com/oktas-open-source-initiative-empowering-cybersecurity-with-the-auth0-rules-catalog/</a><a href="https://infosec.exchange/tags/okta" class="mention hashtag" rel="nofollow noopener" target="_blank">#okta</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://infosec.exchange/tags/auth0" class="mention hashtag" rel="nofollow noopener" target="_blank">#auth0</a>

Josh Lemon🕵🏼‍♂️ Calling all Detection & Response People! 🚨Don't forget to contribute to the SANS Institute Detection & Response Survey! 🔗 <a href="https://survey.sans.org/jfe/form/SV_afaP0wOMXHGLhDE" rel="nofollow noopener" translate="no" target="_blank">https://survey.sans.org/jfe/form/SV_afaP0wOMXHGLhDE</a>🗓️ It closes at the end of this week!It would be great to get as much feedback from the community as possible. I'll be publishing the report towards the end of this year so everyone can benefit from the findings.<a href="https://infosec.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://infosec.exchange/tags/CSIRT" class="mention hashtag" rel="nofollow noopener" target="_blank">#CSIRT</a> <a href="https://infosec.exchange/tags/CERT" class="mention hashtag" rel="nofollow noopener" target="_blank">#CERT</a> <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#SOC</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/SANSSurvey" class="mention hashtag" rel="nofollow noopener" target="_blank">#SANSSurvey</a>

Graylog🗣️ Let's talk about APTs (advanced persistent threats). 😬 An APT can gain access to your company’s systems and networks then hide within, and wait to complete objectives at a later time. ⏳👀 Since they can cause long-term damage to sensitive systems and data, understanding what they are and why they matter will enable you to better protect your org. 🛡️ Read our latest blog to learn about: 🗝️ The key characteristics of APTs ⚔️ The 3 stages of an APT attack 🎯 The main motives and targets of an APT attack 🔍 How to detect an advanced persistent threat 👍 Best practices for mitigating, detecting, and responding to APTs<a href="https://graylog.org/post/advanced-persistent-threat-what-they-are-and-why-they-matter/" rel="nofollow noopener" translate="no" target="_blank">https://graylog.org/post/advanced-persistent-threat-what-they-are-and-why-they-matter/</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/cyberattack" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberattack</a> <a href="https://infosec.exchange/tags/TDIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#TDIR</a> <a href="https://infosec.exchange/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://infosec.exchange/tags/incidentresponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#incidentresponse</a>

Just Another Blue TeamerHappy Monday everyone!Cisco Talos researchers report on a "malvertising campaign" that involved the <a href="https://ioc.exchange/tags/PS1Bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#PS1Bot</a>, which is modular and has "several modules delivered to perform a variety of malicious activities on infected systems." It has the capability to capture keystrokes from their victim, conduct reconnaissance and establish persistence. This campaign involved Search Engine Optimization (SEO) poisoning and/or malvertising where the file name matched the keywords used in this target. The victim received a compressed archive that had a single file named "FULL DOCUMENT" which functioned as the downloader and retrieved the next stage. Powershell modules cam into play later that had the capability to detect which antivirus was being used by the victim, capture screen shots and key strokes, collect wallet information, and gain persistence, which is a pretty creative way of achieving it! But I won't spoil it! Find out for yourself and discover all the other details I left out! Enjoy and Happy Hunting!Malvertising campaign leads to PS1Bot, a multi-stage malware framework <a href="https://blog.talosintelligence.com/ps1bot-malvertising-campaign/" rel="nofollow noopener" translate="no" target="_blank">https://blog.talosintelligence.com/ps1bot-malvertising-campaign/</a>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener" target="_blank">#readoftheday</a> <a href="https://ioc.exchange/tags/inteldriventhreathunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#inteldriventhreathunting</a>

Just Another Blue TeamerHappy Friday everyone!Really thankful for the opportunity to join Arun Warikoo at the SANS Digital Forensics and Incident Response Summit to talk about my passion, Threat Hunting. We focused on how to prioritize a structured-hunt (hypothesis driven) and when to conduct an unstructured, or a data-structured hunt. A big thank you to Heather Barnhart and Phil Hagen for hosting and providing us the opportunity to speak at the event, it truly was an honor and an unforgettable experience! If you missed it in person or virtually during the event, here it is! Enjoy and Happy Hunting!Making Sense of the Chaos: When to Conduct Structured and Unstructured Threat Hunts <a href="https://www.youtube.com/watch?v=VAVj1JE6dG0" rel="nofollow noopener" translate="no" target="_blank">https://www.youtube.com/watch?v=VAVj1JE6dG0</a>Intel 471 Cyborg Security, Now Part of Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatIntel</a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatHunting</a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThreatDetection</a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#HappyHunting</a>

Pyrzout :vm:The top CTEM platforms you should know in 2025 <a href="https://www.helpnetsecurity.com/2025/08/14/ctem-platforms-2025/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2025/08/14/ctem-platforms-2025/</a> <a href="https://social.skynetcloud.site/tags/vulnerabilitymanagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilitymanagement</a> <a href="https://social.skynetcloud.site/tags/threatdetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatdetection</a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://social.skynetcloud.site/tags/Don" class="mention hashtag" rel="nofollow noopener" target="_blank">#Don</a>'tmiss <a href="https://social.skynetcloud.site/tags/framework" class="mention hashtag" rel="nofollow noopener" target="_blank">#framework</a> <a href="https://social.skynetcloud.site/tags/Hotstuff" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hotstuff</a> <a href="https://social.skynetcloud.site/tags/opinion" class="mention hashtag" rel="nofollow noopener" target="_blank">#opinion</a> <a href="https://social.skynetcloud.site/tags/threat" class="mention hashtag" rel="nofollow noopener" target="_blank">#threat</a> <a href="https://social.skynetcloud.site/tags/Ionix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ionix</a> <a href="https://social.skynetcloud.site/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#News</a>

Recent searches

Search options

Administered by:

Server stats:

#threatdetection