40 days until Black Hat! 🤯 Join @eric.zip, @whit.zip, and @nynir.bsky.social in August! Registration is open for our 4-day Advanced Security Operations & Threat Hunting course! 🔥 🤓 🙌 Course details, outline, and registration here: blackhat.com/us-26/traini...

Triage.zip now has support for macOS & Linux 🚀

2 months until Black Hat! 🤓 Join @eric.zip, @whit.zip, and @nynir.bsky.social for a 4-day training at @blackhatevents.bsky.social! Registration is open for our Advanced Security Operations and Threat Hunting course! 🔥👩‍💻🙌 Course outline and registration: blackhat.com/us-26/traini...

ATTN NERDS: Join @eric.zip, @whit.zip, and @nynir.bsky.social for a 4-day training at @blackhatevents.bsky.social! Registration is open for our Advanced Security Operations and Threat Hunting course! 🔥👩‍💻🙌 Early bird discount until 5/22 👀 Register: blackhat.com/us-26/traini...

I recommend this! I’ve done live course via antisyphon and I’m doing non-live version via coursestack right now. I had to DFIR semi-manually in the past and it was not fun. Velociraptor would’ve made life way easier.

Learn to hunt and respond with Velociraptor with @eric.zip and @whit.zip at @wildwesthackinfest.bsky.social October 6-7, 2026 in Deadwood, SD! www.antisyphontraining.com/product/thre... #dfir #threathunting

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA and registration is open for our Advanced Security Operations and Threat Hunting course! 🔥🤓 Join @eric.zip, @whit.zip, and @nynir.bsky.social for our 4-day training: Early bird discount until 5/22 👀 Details: blackhat.com/us-26/traini...

ATTN NERDS: We're returning to @blackhatevents.bsky.social USA and registration is now open for our Advanced Security Operations and Threat Hunting course! 💙🤓🚀 Join @eric.zip, @whit.zip, and @nynir.bsky.social for our 4-day training: blackhat.com/us-26/traini...

Are you a fan of Velociraptor and Claude Code? We have a gift for you! Our first of many Claude Code plugins is a VR Artifact generator, and it's quite good at it! Give it a try and let us know what you think... github.com/Digital-Defe... #dfir #velociraptor #claudecode @velocidex.com

Net-NTLMv1 is dead. Rainbow tables are now public, making cracking trivial. If it’s still lurking in your environment, now’s the time to root it out. Inventory, detect, and kill it before an attacker does. cloud.google.com/blog/topics/...

Obligatory blog post describing the detection methodology I used. blog.ecapuano.com/p/hunting-mo...

I have PR'd a new @velocidex.com Artifact to the Exchange to hunt for exploitation of #CVE-2025–14847. As far as I know, this is the only defensive signature for this CVE that exists currently. github.com/Velocidex/ve...

Friendly reminder to my #DFIR friends... If you ever need an offline triage collector in a pinch, @whit.zip and I maintain one for you! Powered by latest version of Velociraptor, preconfigured to get all the important pieces for investigation. 1. Download 2. Execute 3. Find bad guys triage.zip

Same awesome tool, new look -- triage.zip got a facelift! Also, updated to work with latest changes to Velociraptor's new Triage Targets: triage.velocidex.com This project made possible due to the epic team behind @velocidex.com 💙 We only aim to make it even more accessible to the masses. #DFIR

We are launching a Black Friday deal on our most popular course, Threat Hunting & Incident Response w/Velociraptor! From now until midnight (EST) 11/28, enjoy 40% off our best-selling on-demand course. Register: ddi.sh/thvr-bf-2025 Use Code: blackfriday2025 #DFIR #ThreatHunting

I have always wanted an app like Zimmerman's Timeline Explorer, but for macOS.... Sadly, nothing remotely close exists except Excel 🤮 Stoked to say, I am nearly done with the the MVP! 😎 Supertimelines on MBP! #dfir

Another THVR in the books! We had so much fun with this group of nerds this week. Thanks for the engaging chats and for choosing to hang with us for a couple days--until next time 🤓🦖💙 We hope everyone enjoyed the con! @wildwesthackinfest.bsky.social @antisyphontraining.bsky.social

If you’re interested in tinkering with LLMs to assist with incident triage, check out this demo I did with @limacharlie.io using Claude Code and the LC MCP: youtu.be/dSCmLIBkTdo?... I open sourced the Claude configs and context files for anyone that wants to try it out: github.com/Digital-Defe...

New blog post! PowerShell transcripts for threat hunting & IR 🚀 blog.ecapuano.com/p/dfir-artif...

a certain mr @timmedin.bsky.social made a guest appearance during ASOTH day 3 today to drop some kerberoasting knowledge bombs on our students love this guy. THANK YOU TIM 🤓🫶🔥🎟️ @blackhatevents.bsky.social

ATTN NERDS: 5 more days until it's go time at Hacker Summer Camp! 💙 There's still time to register: www.blackhat.com/us-25/traini... And if you can't join us at @blackhatevents.bsky.social, check out our on demand courses 🤓🦖🔥 academy.digitaldefenseinstitute.com/catalog

T-minus 12 days until my favorite humans - @eric.zip & @whit.zip - and I deliver our Advanced Security Operations and Threat Hunting training at @blackhatevents.bsky.social. If you're a SOC analyst and/or work in IR, we'd love to have you. Come level up with us :) www.blackhat.com/us-25/traini...

Join us at the @antisyphontraining.bsky.social Blue Team Summit Aug 28 – Aug 29 for Threat Hunting & Incident Response with Velociraptor! www.antisyphontraining.com/course/threa...

1 month to go! 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip at hacker summer camp! Registration: www.blackhat.com/us-25/traini...

🚀 Just launched: DetectionForge — a purpose-built platform for crafting, testing & validating @limacharlie.io detection rules. Perform detection unit tests & multi-org backtesting + import/export IaC 🔗 Try it: detectionforge.ddi.sh 💻 GitHub: github.com/Digital-Defe... #detectionengineering #secops

we had an absolutely amazing time at #x33fcon 🤓🇵🇱 thank you to our students who joined our @antisyphontraining.bsky.social class, and thank you to the organizers for taking such good care of us 🫶 poland is beautiful

Here are the slides/resources from our #SecurityFest talk on "Modernizing Incident Response Using Techniques that Scale" Talk: www.youtube.com/live/Znl7TBF...

And next week we’re in Poland for x33fcon! We’re running our 2-day workshop: Threat Hunting & Incident Response with Velociraptor www.x33fcon.com#!t/TI_IR.md

@whit.zip and I just arrived in Sweden for Security Fest and we’re so excited! 🇸🇪 cfp.securityfest.com/2025/talk/NP...

Ready to level up your SOC skills? Our Threat Hunting and IR With Velociraptor course dives deep into Velociraptor through hands-on labs and realistic attack scenarios. Learn to build custom queries, triage systems, and take decisive action—confidently and repeatably. Start here: ddi.sh/thvr 🔥🦖🤓

ATTN NERDS: we'll be teaching at @blackhatevents.bsky.social during hacker summer camp again! come join me and @eric.zip and @bromiley.io for our 4-day training: Advanced Security Operations and Threat Hunting 🤓🔥💙 www.blackhat.com/us-25/traini...

🥹💙

ATTN NERDS: join me and @eric.zip in october at @wildwesthackinfest.bsky.social where we are running our 2-day course! again! threat hunting & incident response w/velociraptor! register virtual or in-person: ddi.sh/thvr-wwhf 🤓🦖🔥 #infosec #dfir #threathunting #WWHF #Deadwood2025

Want to see a little bit of the magic behind our Threat Hunting & Incident Response w/Velociraptor course? Check out our Antisyphon webcast! www.youtube.com/watch?v=MqQ-... Now available OnDemand: ddi.sh/thvr

Our newest on-demand course, Threat Hunting and Incident Response with Velociraptor, contains over 10 hours of HD video content and 23(!) hands-on labs! You can now see a free preview of one of the 23 labs: ddi.sh/thvr-preview #DFIR #infosec #incidentresponse #threathunting

We're coming to #x33fcon! Join @eric.zip and @whit.zip in June for our 2-day Threat Hunting & Incident Response With Velociraptor course! More info: www.x33fcon.com#!t/TI_IR.md See you soon, Poland! 🥹💙🦖

WE! HAVE! STICKERS! 🥹✨

One of our students shared this in our Discord recently and our hearts are full! Whether you are an aspiring or seasoned security professional, we build hands-on training designed to help you level up! Learn more: ddi.sh/academy #infosec #training #cybersecurity #dfir #threathunting

These folks rock, you won't be disappointed!

"Threat Hunting & Incident Response with Velociraptor" On-Demand is live! Use this promo code for 20% off until 4/13: thvrlaunchpromo academy.digitaldefenseinstitute.com/courses/2259... #infosec #dfir #threathunting #incidentresponse #velociraptor

👀Check out this awesome hands-on learning that helped me out as I got started in the field!

"Threat Hunting & Incident Response with Velociraptor" coming soon in a new on-demand format! Stay tuned! 🦖 #threathunting #incidentresponse #dfir #infosec

@eric.zip and @whit.zip will be back in Deadwood! Join them for pre-con training class, Threat Hunting and Incident Response with Velociraptor, at WWHF - Deadwood 2025! --> wildwesthackinfest.com/wild-west-ha...

Want to wield Velociraptor like a pro? Join @eric.zip & @whit.zip in October at @wildwesthackinfest.bsky.social where we are running our 2-day course, Threat Hunting & Incident Response w/Velociraptor! Register virtual or in-person: ddi.sh/thvr-wwhf #infosec #dfir #threathunting #WWHF #Deadwood2025

Have you ever needed a ready-to-go #DFIR triage collector in a pinch? I got you covered! All you need to remember is triage.zip 🚀 It's a prebuilt Velociraptor collector configured to grab all the things you probably need for initial forensic analysis.

Join us at @blackhatevents.bsky.social for "Advanced Security Operations & Threat Hunting" This course is perfect for those specializing in detection engineering, threat hunting, adversary detection, and incident response. #infosec #dfir #BHUSA Register: ddi.sh/bh-usa-2025

We're running "Threat Hunting & Incident Response w/Velociraptor" at #x33fcon June 10 - 11 in Gdynia, Poland! Register here: www.x33fcon.com#!t/TI_IR.md #dfir #infosec

New blog post: Introduction to YARA blog.ecapuano.com/p/introducti... #infosec #dfir

We've launched our first of many on-demand #infosec courses on the new DDI Academy! academy.digitaldefenseinstitute.com The first course is a total revamp of @eric.zip's popular "So You Want to be a SOC Analyst?" series. Rebuilt from the ground up, and now all you need is a web browser!

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA again this year! Registration is now open for our Advanced Security Operations and Threat Hunting course 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip for our 4-day training: www.blackhat.com/us-25/traini...