Collaborate Disseminate
I didn’t start out in threat intel. I didn’t start my career in cybersecurity in DF/IR work. I started doing vulnerability assessments using commercial tools (ISS’s Internet Scanner) and well as freely-available tools (i.e., ToneLoc and THCScan, f… Continue reading Burn Out, Or Fade Away
I ran across this Ctrl-Alt-Intel blog post today, which discusses RustGate v2, and noticed that for all of what was addressed in the blog, there wasn’t a great deal of content regarding the delivery method, the LNK file itself. Figure 1 illustrat… Continue reading LNK Metadata
I had an opportunity a bit ago to engage with three other folks within the industry, all at the same time, and all of us from varied backgrounds. We had some similarities in our backgrounds, and some overlaps or near-misses in our experiences and emplo… Continue reading Knowledge Retention & Sharing in DF/IR
Many times within the industry, we hear things stated repeatedly, or with authority, or both, and simply accept them as fact, as being true. However, a lot of times, these statements of “truth” are based on the aperture and perspective of the individua… Continue reading True Lies
I recently ran across a comment from a SOC manager on social media that said, “Finding initial access is difficult.”I thought about it for a moment, and had to ask, “why is that?”For context, I transitioned from military service in 1997, and shortly th… Continue reading Finding Initial Access
There’s a good bit of file analysis that goes into CTI reports, including (but not limited to) malware analysis. But for some reason, not all files appear to be worthy of parsing and analysis. We also tend to see in-depth descriptions of the value of L… Continue reading LNK Files in CTI
I’m just going to say it.IOCs are not “threat intel”. Lists of IP addresses and domain names, without context, are data points and information, not “intel”. Threat intel is based on patterns developed from the accumulation/aggregation of data.In 2… Continue reading Rigor in Threat Intel
I’m just going to say it.IOCs are not “threat intel”. Lists of IP addresses and domain names, without context, are data points and information, not “intel”. Threat intel is based on patterns developed from the accumulation/aggregation of data.In 2… Continue reading Rigor in Threat Intel
I’ve worked a lot of places over the years, all for varying lengths of time. While this worked against me in the early days, with potential employers wondering why I didn’t stay longer at my previous employer, and wondering how long I’d potentially sta… Continue reading Consistency
I like timelines, particularly when it comes to forensic investigations. There I said it. The first step to addressing an issue is admitting that you have a problem.I’ve been creating timelines since about 2008-ish, or so. I have a series of blog … Continue reading Timelines