Net-NTLMv1 is dead. Rainbow tables are now public, making cracking trivial. If it’s still lurking in your environment, now’s the time to root it out. Inventory, detect, and kill it before an attacker does. cloud.google.com/blog/topics/...

Obligatory blog post describing the detection methodology I used. blog.ecapuano.com/p/hunting-mo...

I have PR'd a new @velocidex.com Artifact to the Exchange to hunt for exploitation of #CVE-2025–14847. As far as I know, this is the only defensive signature for this CVE that exists currently. github.com/Velocidex/ve...

Friendly reminder to my #DFIR friends... If you ever need an offline triage collector in a pinch, @whit.zip and I maintain one for you! Powered by latest version of Velociraptor, preconfigured to get all the important pieces for investigation. 1. Download 2. Execute 3. Find bad guys triage.zip

Same awesome tool, new look -- triage.zip got a facelift! Also, updated to work with latest changes to Velociraptor's new Triage Targets: triage.velocidex.com This project made possible due to the epic team behind @velocidex.com 💙 We only aim to make it even more accessible to the masses. #DFIR

We are launching a Black Friday deal on our most popular course, Threat Hunting & Incident Response w/Velociraptor! From now until midnight (EST) 11/28, enjoy 40% off our best-selling on-demand course. Register: ddi.sh/thvr-bf-2025 Use Code: blackfriday2025 #DFIR #ThreatHunting

I have always wanted an app like Zimmerman's Timeline Explorer, but for macOS.... Sadly, nothing remotely close exists except Excel 🤮 Stoked to say, I am nearly done with the the MVP! 😎 Supertimelines on MBP! #dfir

Another THVR in the books! We had so much fun with this group of nerds this week. Thanks for the engaging chats and for choosing to hang with us for a couple days--until next time 🤓🦖💙 We hope everyone enjoyed the con! @wildwesthackinfest.bsky.social @antisyphontraining.bsky.social

If you’re interested in tinkering with LLMs to assist with incident triage, check out this demo I did with @limacharlie.io using Claude Code and the LC MCP: youtu.be/dSCmLIBkTdo?... I open sourced the Claude configs and context files for anyone that wants to try it out: github.com/Digital-Defe...

New blog post! PowerShell transcripts for threat hunting & IR 🚀 blog.ecapuano.com/p/dfir-artif...

a certain mr @timmedin.bsky.social made a guest appearance during ASOTH day 3 today to drop some kerberoasting knowledge bombs on our students love this guy. THANK YOU TIM 🤓🫶🔥🎟️ @blackhatevents.bsky.social

ATTN NERDS: 5 more days until it's go time at Hacker Summer Camp! 💙 There's still time to register: www.blackhat.com/us-25/traini... And if you can't join us at @blackhatevents.bsky.social, check out our on demand courses 🤓🦖🔥 academy.digitaldefenseinstitute.com/catalog

T-minus 12 days until my favorite humans - @eric.zip & @whit.zip - and I deliver our Advanced Security Operations and Threat Hunting training at @blackhatevents.bsky.social. If you're a SOC analyst and/or work in IR, we'd love to have you. Come level up with us :) www.blackhat.com/us-25/traini...

Join us at the @antisyphontraining.bsky.social Blue Team Summit Aug 28 – Aug 29 for Threat Hunting & Incident Response with Velociraptor! www.antisyphontraining.com/course/threa...

1 month to go! 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip at hacker summer camp! Registration: www.blackhat.com/us-25/traini...

🚀 Just launched: DetectionForge — a purpose-built platform for crafting, testing & validating @limacharlie.io detection rules. Perform detection unit tests & multi-org backtesting + import/export IaC 🔗 Try it: detectionforge.ddi.sh 💻 GitHub: github.com/Digital-Defe... #detectionengineering #secops

we had an absolutely amazing time at #x33fcon 🤓🇵🇱 thank you to our students who joined our @antisyphontraining.bsky.social class, and thank you to the organizers for taking such good care of us 🫶 poland is beautiful

Here are the slides/resources from our #SecurityFest talk on "Modernizing Incident Response Using Techniques that Scale" Talk: www.youtube.com/live/Znl7TBF...

And next week we’re in Poland for x33fcon! We’re running our 2-day workshop: Threat Hunting & Incident Response with Velociraptor www.x33fcon.com#!t/TI_IR.md

@whit.zip and I just arrived in Sweden for Security Fest and we’re so excited! 🇸🇪 cfp.securityfest.com/2025/talk/NP...

Ready to level up your SOC skills? Our Threat Hunting and IR With Velociraptor course dives deep into Velociraptor through hands-on labs and realistic attack scenarios. Learn to build custom queries, triage systems, and take decisive action—confidently and repeatably. Start here: ddi.sh/thvr 🔥🦖🤓

ATTN NERDS: we'll be teaching at @blackhatevents.bsky.social during hacker summer camp again! come join me and @eric.zip and @bromiley.io for our 4-day training: Advanced Security Operations and Threat Hunting 🤓🔥💙 www.blackhat.com/us-25/traini...

🥹💙

ATTN NERDS: join me and @eric.zip in october at @wildwesthackinfest.bsky.social where we are running our 2-day course! again! threat hunting & incident response w/velociraptor! register virtual or in-person: ddi.sh/thvr-wwhf 🤓🦖🔥 #infosec #dfir #threathunting #WWHF #Deadwood2025

Want to see a little bit of the magic behind our Threat Hunting & Incident Response w/Velociraptor course? Check out our Antisyphon webcast! www.youtube.com/watch?v=MqQ-... Now available OnDemand: ddi.sh/thvr

Our newest on-demand course, Threat Hunting and Incident Response with Velociraptor, contains over 10 hours of HD video content and 23(!) hands-on labs! You can now see a free preview of one of the 23 labs: ddi.sh/thvr-preview #DFIR #infosec #incidentresponse #threathunting

We're coming to #x33fcon! Join @eric.zip and @whit.zip in June for our 2-day Threat Hunting & Incident Response With Velociraptor course! More info: www.x33fcon.com#!t/TI_IR.md See you soon, Poland! 🥹💙🦖

WE! HAVE! STICKERS! 🥹✨

One of our students shared this in our Discord recently and our hearts are full! Whether you are an aspiring or seasoned security professional, we build hands-on training designed to help you level up! Learn more: ddi.sh/academy #infosec #training #cybersecurity #dfir #threathunting

These folks rock, you won't be disappointed!

"Threat Hunting & Incident Response with Velociraptor" On-Demand is live! Use this promo code for 20% off until 4/13: thvrlaunchpromo academy.digitaldefenseinstitute.com/courses/2259... #infosec #dfir #threathunting #incidentresponse #velociraptor

👀Check out this awesome hands-on learning that helped me out as I got started in the field!

"Threat Hunting & Incident Response with Velociraptor" coming soon in a new on-demand format! Stay tuned! 🦖 #threathunting #incidentresponse #dfir #infosec

@eric.zip and @whit.zip will be back in Deadwood! Join them for pre-con training class, Threat Hunting and Incident Response with Velociraptor, at WWHF - Deadwood 2025! --> wildwesthackinfest.com/wild-west-ha...

Want to wield Velociraptor like a pro? Join @eric.zip & @whit.zip in October at @wildwesthackinfest.bsky.social where we are running our 2-day course, Threat Hunting & Incident Response w/Velociraptor! Register virtual or in-person: ddi.sh/thvr-wwhf #infosec #dfir #threathunting #WWHF #Deadwood2025

Have you ever needed a ready-to-go #DFIR triage collector in a pinch? I got you covered! All you need to remember is triage.zip 🚀 It's a prebuilt Velociraptor collector configured to grab all the things you probably need for initial forensic analysis.

Join us at @blackhatevents.bsky.social for "Advanced Security Operations & Threat Hunting" This course is perfect for those specializing in detection engineering, threat hunting, adversary detection, and incident response. #infosec #dfir #BHUSA Register: ddi.sh/bh-usa-2025

We're running "Threat Hunting & Incident Response w/Velociraptor" at #x33fcon June 10 - 11 in Gdynia, Poland! Register here: www.x33fcon.com#!t/TI_IR.md #dfir #infosec

New blog post: Introduction to YARA blog.ecapuano.com/p/introducti... #infosec #dfir

We've launched our first of many on-demand #infosec courses on the new DDI Academy! academy.digitaldefenseinstitute.com The first course is a total revamp of @eric.zip's popular "So You Want to be a SOC Analyst?" series. Rebuilt from the ground up, and now all you need is a web browser!

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA again this year! Registration is now open for our Advanced Security Operations and Threat Hunting course 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip for our 4-day training: www.blackhat.com/us-25/traini...

Wrapping up day 2 of THVR @wildwesthackinfest.bsky.social Mile High 🤓💙🦖 Threat hunting ✅ Sick beats ✅ Lots of nerd jokes ✅ Shameless playlist plug: open.spotify.com/playlist/11v... Delivered with 🫶 by @eric.zip and @whit.zip

Hellooo, Denver! 🤓💙 Day 1 of Threat Hunting/Incident Response With Velociraptor @wildwesthackinfest.bsky.social Mile High is well underway!

See you nerds in Denver soon! 🤓💙🏔️

also, NIMS is 100% @eric.zip's brainchild. he started it a few weeks ago and i've been testing and providing feedback along the way last week i dove in with him and wrote the middleware for it, github.com/shortstack/n..., and we geeked out all weekend, bingeing shows and making new nerd toys 🥹🌈

🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System! Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features. #InfoSec #DFIR #IncidentResponse #SecOps #Notion

Ready to take your threat hunting & IR game to the next level? Join us this February at WWHF Mile High for Threat Hunting & Incident Response with Velociraptor! 🖥️ Hands-on labs with cloud VMs 👨‍🏫 Expert-led by @eric.zip & @whit.zip 🎯 Real-world hunting skills

Want to learn more about Velociraptor? 🦖🤓💙 Join @eric.zip and @whit.zip at @wildwesthackinfest.bsky.social Mile High in February! ⛰️ Available in person or virtual! 🙌 Course details: www.antisyphontraining.com/course/threa... Register: wildwesthackinfest.com/wild-west-ha...

Want to learn more about Velociraptor? Come attend our hands-on Threat Hunting & Incident Response w/Velociraptor course at WWHF Mile High in February! Virtual option still open but only for a limited time! www.antisyphontraining.com/course/threa...

Do you use Velociraptor? 😎🦖 Join us at @wildwesthackinfest.bsky.social in February and level up! Learn to use Velociraptor’s advanced features for threat hunting and incident response at scale 🔥 Details: www.antisyphontraining.com/course/threa... Register: wildwesthackinfest.com/wild-west-ha...