Using Timesketch for timeline analysis? We recently added a new feature: LLM summaries of up to 500 events in view. Example below uses Gemini Flash, but you can just as easily use a local Ollama model. Setup guide: timesketch.org/guides/user/...

That's not that many cabs.

Well well well, how the turntables...

Great stuff from @tomchop.me! Memory analysis and Yara support in #OpenRelik #DFIR

I had a look at #OpenRelik last year and wrote a couple workers that might be useful: * github.com/tomchop/open...: Scan memory images using @volatilityfoundation.org plugins. Supports Yara rules * github.com/tomchop/open... - Run Yara rules on a directory. Supports third-party systems like #Yeti!

New #OpenRelik release. Task metrics (queue length, completion, failures etc) & new Prometheus exporter. Plus, a new task dashboard for deep dives into task performance. 📝 openrelik.org/changelog/ 🔗 discord.gg/hg652gktwX #DFIR

This is also the reason I never talk publicly about my dog, any favorite foods, or the season we were in < 3 months ago

Looks like shit just got real @swiftonsecurity.com

Probably the most riveting incident report I've read in a long time. I would've so much liked to be part of this investigation! Kudos to @volexity.com for going into so much detail on this novel network attack technique. www.volexity.com/blog/2024/11...

This incredible investigation is worth the time you’ll spend reading it #dfir www.volexity.com/blog/2024/11...

if you have a @github.com profile, can i ask you to update it with your @bsky.app handle? 🙏 👉 it enables some very cool integrations, like auto curated feeds and starter packs for contributors and tech

Shiiiiyet, I'm gonna try to not miss this edition! 🤞🏼🤞🏼🤞🏼

*cue pokémon battle song* "plaso I choose you!!"

Thinking of coming up with a Bluesky #DFIR Starter Pack with @the4711.org... who should we include?

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.

Today, we published this Field Guide to incident response for civil society and media, which I’ve been working on for the past year or so and which I am pretty excited about internews.org/resource/fie...

This has been years in the making, literally. @Sebdraven and I are happy to announce the release of #Yeti 2.0 (after we promised an EOM release at @hack_lu last month) Website: yeti-platform.io Release: github.com/yeti-platform/yeti mini-🧵👇🏻 #DFIR #infosec #CTI #cybersec

The talk I have at @hack_lu about Yeti and our vision of the future of forensics intelligence is online! We're already getting lots of FRs, which we'll do our best to implement before our official release EOM. Hope I made @Sebdraven proud 🥹 #dfir #infosec

I haven't had time to talk about it, but @sebdraven and I are giving a talk this week at #HackLu about some cool new changes coming to Yeti: pretalx.com/hack-lu-2023... It's going to be fun to talk about this project that has been on my todo list for 10+ years! 😅 #DFIR #infosec #CTI

My team just released dfiq.org, which is "a collection of Digital Forensics Investigative Questions and the approaches to answering them." The idea came from the will to organize investigative approaches to similar cases to increase consistency across response efforts. #dfir #infosec

How your email finds me.

VirusTotal announces Yara netloc, to extend Yara's capabilities to VT network sandbox results (domains, IPs, URLs), and not only file bytes. Looks promising! #infosec #cti https://blog.virustotal.com/2023/07/actionable-threat-intel-iv-yara-beyond.html

For 25+ yrs police, military, intel agencies and critical infrastructure around the world relied on the TETRA radio standard to secure critical communications. But now Dutch researchers have examined secret algorithms used in TETRA and found something startling - an intentional backdoor, and more

Never take file paths for granted in digital forensics. New blog post by Joachim Metz: https://osdfir.blogspot.com/2023/07/whats-in-file-path.html

Hey DFIR folks: we released a new version of Timesketch today. - OpenSearch queries in DFIQ - Preserve user defined filters - Support event list sorting - Rework comments - Analyzer results in the CLI - Sketch attributes in the CLI https://github.com/google/timesketch/releases/tag/20230721

This is very exciting, and comes (in part) from direct pushback from the infosec community. Well done to everyone who was vocal about this!! #infosec https://www.microsoft.com/en-us/security/blog/2023/07/19/expanding-cloud-logging-to-give-customers-deeper-security-visibility/

ICYMI, yesterday Microsoft reported on CVE-2023-36884 a vulnerability which myself and @r00tbsd.bsky.social reported earlier on this month. At the time we put together a nice infographic which explained our understanding of the execution chain that led to the installation of the malware involved.

Two MSOffice #0days (exploited in the wild) were perched today, #CVE-2023-36874 and #CVE-2023-36884. Kudos to the folk at Google TAG and Volexity! #infosec https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

Apple has rolled out a rapid response patch for iOS, iPadOS, and MacOS to fix a 0-day in WebKit that "may be actively exploited." Go patch your stuff. https://support.apple.com/en-us/HT213823

We just published our detailed analysis of CVE-2023-2868, a shell command injection vulnerability in the #Barracuda Secure Email Gateway appliance. Big props to my co-worker Curtis Fielding for putting all this together! #infosec #vulnerability #exploit #PoC #rapid7

WE WILL RELEASE A NEW TWITTER CLONE EVERY HOUR UNTIL OUR DEMANDS ARE MET

(cyber) Incident response in a nutshell

I used to get a spike in Mastodon notifications whenever the brid site did something stupid. It seems to be happening here now, which gives me hope that this might be the next "permanent" home.

#DarknetDiaries is one of the best infosec podcasts out there. Def gonna give this a listen!

Where are all the #DFIR folks at?!

OK, in case this helps anyone - I used skyfeed.app to build a feed that regroups infosec related keywords: https://bsky.app/profile/did:plc:ckxoq4m2eyhtncuwpnmfiika/feed/aaabofkrsl3f4 I have no idea how to make this more discoverable, but there it goes.

I gave a talk last week. My "whodis" slide didn't contain any social media links—because I just don't know what to say at this point. Current platforms are falling short (cesspool / desert / off-topic). I guess I'm taking the opportunity to consume less of it, which is not bad.

The #elbjazz festival in Hamburg was a nice way to disconnect from the socials… what have y’all been up to?

Oh, you work in detection engineering? Name all the log files.

Maybe this custom feed feature is gonna make it easier to discover content and cut down a bit on the noise. Where should I start?

One of the under-appreciated roles of bartenders is that it‘s literally their job to cultivate strong community. Regulars keep a place in business. The best bartenders curate a strong vibe that draws solid people in, who then form a community that gathers at your spot. Story below tracks 100%

Shit, the yrr are after us

The mix of British / American accents in TotK is really sending me 🤣🫠

I must be doing *something* right. *follows back*

Very excited to see this coming!

The Great Asscape

This is where I skeet from.

I'm glad to see this change finally happening!