ATT&CK v18 is now out! Today marks the release of Detection Strategies, where we've moved from single-sentence notes to structured, behavior-focused strategies across the board. A new blog post describes the changes medium.com/mitre-attack... with details at attack.mitre.org/resources/up....

Hardly ever in Lynn but was today. Sad to learn the rug store with this iconic neon sign apparently closed recently. Wonder what happened to the sign.

Noticed authors love to do this in the @nytimes.com Book Review: Mention a new book that hasn’t even been announced yet, let alone released. Someone did this a few years ask with an Emily St. John Mandel book. This Jami Attenberg book doesn’t exist—yet.

New on the @redcanaryco.bsky.social blog this week: We look at the similarities between the Atomic, Odyssey and Poseidon macOS stealers, shared tactics and anti-analysis techniques: redcanary.com/blog/threat-...

Some helpful and topical content posted to @redcanaryco.bsky.social yesterday. Distilled some great guidance from @forensicitguy.bsky.social on securing npm packages + responding to a compromise: redcanary.com/blog/threat-...

@redcanaryco.bsky.social's Threat Hunting team recently investigated an incident that illustrates how stealthy and patient an OAuth application attack can be. We breakdown the campaign (and how to defend against these attacks) in this blog:

Front page ad for Prager in the NYT today 🥴

I was offline last week but great to see the @redcanaryco.bsky.social team get this across the goal line. Great research from our intel team on new-to-us malware impacting cloud Linux systems: redcanary.com/blog/threat-...

Deer Isle Oysters at Pilgrim’s Inn. Could eat a lot of these.

Mid-year TDR day! Dig into all of @redcanaryco.bsky.social's findings from the first half of 2025 including a big uptick in cloud identity detections + techniques: redcanary.com/blog/threat-...

Scaling Netflix's threat detection pipelines without streaming: blog.dataexpert.io/p/scaling-ne...

Another new @redcanaryco.bsky.social ‬blog: I'm not going to @blackhatevents.bsky.social this year but if I were, these are the talks I'd try to attend. Lots of stories + intel for defenders: redcanary.com/blog/securit...

Hey, Summercon is streaming today: www.youtube.com/@SummerconFo...

MCP servers allow developers to facilitate AI agents to execute code. MCP doesn't include security mechanisms however—the onus is on developers to implement standard security best practices. @redcanaryco.bsky.social's Jesse Griggs navigates the MCP threat landscape: redcanary.com/blog/threat-...

Appreciate what #HillFarmstead does for its Harvest Festival re: curated guest taps, almost like a mini-FW Invitational. I don't think I've been to one since 2011? Whenever you used to be able to camp there afterwards.

⚛️ Use Atomic Red Team to validate security controls? Test detection coverage? Emulate adversary behaviors? Share how you use the project, suggest new tests, and ask questions at our new subreddit! www.reddit.com/r/atomicredt...

💫 @redcanaryco.bsky.social has a handful of helpful free, open-source tools, including Surveyor, which can help orgs establish a baseline of their environment and in turn, detect potential anomalies—like unsanctioned RMM tool usage that can be abused for initial access: redcanary.com/blog/threat-...

Take a bad thing and make it worse

Haim industrial complex is working overtime this year.

Median time to respond. Mean time to respond. Mean time to acknowledge. Time-based metrics can be misleading and problematic, whether you’re consuming or creating them. redcanary.com/blog/threat-...

New ATT&CK @attack.mitre.org version (v7) includes ESXi + four new techniques designed for it, expanded cloud security + Linux coverage, new mobile techniques: medium.com/mitre-attack...

Finally finished The Antidote. Fitting to end with a Land Lost Acknowledgement.

New Lana song titled something I say literally everyday: www.youtube.com/watch?v=nDYY...

Did a deep dive on this year's #RSAC schedule (500+ sessions!) for Red Canary and found what I thought were some interesting talks on adversary emulation, detection engineering, and yes, AI—it's unavoidable! redcanary.com/blog/securit...

Heard a great story about the always fascinating feral hog on @npr.org yesterday. Not a problem here but wild they cause $2.5 billion in damages every year: www.npr.org/2025/03/25/n...