DEW #130 - God-mode Azure vulnerability, Composite Detections & Detection Observability In this post: * 💎 by Dirk-jan Mollema discloses a cross-tenant Azure vulnerability that gives access to any Azure tenant, with detection opportunities to boot! www.detectionengineering.net/p/dew-130-go...

I'm starting a new series on Detection Engineering called the Detection Field Manual. I wanted to publish < 10 minute reads on threat detection topics I've built in the field, at conferences and our interviews for candidates at Datadog. Here's issue 1! www.detectionengineering.net/p/detection-...

I'm so excited to announce that Datadog Security Research is launching a FREE, fully-online, Detection Engineering focused conference called Datadog Detect! bit.ly/datadog-detect Our lineup is incredible with experts in the field of detection, response and threat intelligence.

Found just outside Moscone North for RSA. Now I'm pumped for my talk tomorrow. #hacktheplanet

Detection Engineering Weekly Issue 109 is live! www.detectionengineering.net/p/det-eng-we...

Detection Engineering Weekly issue 108 is live! www.detectionengineering.net/p/det-eng-we...

@sekoia.io FYI your TLS cert is showing invalid due to date expiration for *.sekoia.io

🍎👿 The key macOS malware families of 2024: This past year saw a sharp rise in sophisticated campaigns targeting macOS users in the enterprise and the increasing adoption of cross-platform development frameworks.

I’m biased, but wow—it’s so refreshing to get updates that genuinely help me better track threat actors. 🔥 www.validin.com/blog/threat_...

Did a security researcher at Snyk really just publish malicious packages to NPM targeting Cursor.com?

🎉 link and docs and details: nims-template.notion.site

🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System! Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features. #InfoSec #DFIR #IncidentResponse #SecOps #Notion

"North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign" published by dmpdump. #ContagiousInterview, #DPRK, #CTI https://dmpdump.github.io/posts/NorthKorea_Backdoor_Stealer/

IF IT AINT EXECUTTABLE IT AINT FOR ME - dashare.zone ADMIN

The cybersecurity subreddit has a thread on influencers and “who to avoid because of xyz”. These threads irk me because there’s no clear measurement and lots of gate keeping around who is allowed to post stuff and who isn’t. www.reddit.com/r/cybersecur...

I’ve been pretty sick for the last 2 weeks, but Christmas holiday has been a much needed break for rest and recovery. Take care of yourselves people; I think stress contributed a ton to this, and being mindful and in the present has helped me out a lot. And lots of Christmas food.

telling chatgpt my editor in a very blunt and snarky way, as all vim users do

Today is not a good day. Our dog needed a vet visit because he was weak and not eating. Turns out he had blood and fluid throughout his abdomen due to cancer. He was an amazing friend and family member, and tomorrow’s issue will be somber but commemorative with lots of pupper pics. Hug your dogs!

You've got to be a total wanker to name a law after yourself, and guess what! www.chrisfarris.com/post/three-l...

love these looks from Proper Cloth's new lookbook titled "New Ivy." even the grey shetland knit with black jeans and small dress watch looks great.

DeFi platform Radiant Capital says North Korean hackers were behind the theft of over $50 million worth of assets from its servers in October this year. Radiant says it was hacked after an employee opened a malicious file received from a former contractor via Telegram: medium.com/@RadiantCapi...

zizmor would have caught the Ultralytics workflow vulnerability https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection #security #oss

NEW pod alert! Turla caught stealing from a Pakistani APT, fourth-party espionage, threat actor attribution. Plus, a Monokle-like spyware finding, Salt Typhoon disinfections and Romania's election crisis over Russian interference via TikTok. @craiu.bsky.social @jags.bsky.social

NEW EPISODE! Our esteemed guests @justinschuh.com and @matthewdgreen.bsky.social joined us to debate whether `Dual_EC_DRBG` was intentionally backdoored by the NSA or 'just' a major fuckup: securitycryptographywhatever.com/2024/12/07/d... www.youtube.com/watch?v=i0eo...

Ultralytics, a python package with close to 6.4 million downloads per month, was backdoored to run a cryptominer. Running theory from the reported GitHub issue is a GitHub action injection attack, but theres also evidence that the malicious code was published directly via PyPi and skipped CI/CD

First time I’ve seen a successful arrest and plea of a large crypto jacking campaign. Nebraska man leveraged stolen cloud resources to mine crypto for 3.5 million www.justice.gov/usao-edny/pr...

Rural Juror #2 (2024)

We are happy to introduce our latest tool "Supply Chain Firewall" 🎉 by @ikretz.bsky.social The tool detects & prevents installation of malicious packages in local development environment. Read more securitylabs.datadoghq.com/articles/int... And give it a try github.com/DataDog/supp...

Microsoft's Threat-Intelligence ETW provider now supports events to identify token impersonation attacks. I wrote a blog on these events and how Microsoft is surfacing them: jsecurity101.medium.com/behind-the-m...

Detection Engineering Weekly Issue 95 is LIVE! https://buff.ly/4gmqbvv In this post: * 💎 by Mark Ellzey on Censys' new automated hunting tool, Censeye. Tons of great infrastructure pivoting tips for folks getting into this space * Fabian Bader on EDR Silencer techniques using Windows' NRPT

Anyone going to reinvent next week?

Censys has released Censeye, a tool to identify hosts with characteristics similar to a given target github.com/Censys-Resea...

Detection Engineering Weekly Issue 94 is live! www.detectionengineering.net/p/det-eng-we... In this post: * 💎 by Volexity's Sean Koessel Steven Adair and Tom Lancaster on the nearest neighbor attack they presented at CYBERWARCON. * Hal Pomeranz on Linux LKM persistence detection opportunties

Detection Engineering Weekly Issue 94 is live! www.detectionengineering.net/p/det-eng-we... In this post: * 💎 by Volexity's Sean Koessel Steven Adair and Tom Lancaster on the nearest neighbor attack they presented at CYBERWARCON. * Hal Pomeranz on Linux LKM persistence detection opportunties

How to debug Windows service processes in the most old-school possible way... www.hexacorn.com/blog/2024/11...

Cool to see more training around detection engineering outside of major firms like SANS!

New Course: Automated Detection with Sigma Two courses in one week?!? We're so excited to share with you a new course that Faculty member @hgb.crowstrike.zip has been working hard on for about a year now! taggartinstitute.org/p/detection-...

Yesterday Banshee Stealer, the MacOS-based Malware-as-a-Service infostealer, had their source code leaked online. As a result of the leak they've shut down their operations. We've archived the leak and made it available for download on GitHub. github.com/vxundergroun...

OK last starter pack, I promise :). I wanted to collect a list of all security newsletter and podcast creators and put it into one spot, so here you go! go.bsky.app/Hrn5N6u I'll be adding more as they join bluesky

Just added a boatload of new detection engineers who joined Bluesky this week. Make sure to check this starter pack out

I’ve created a Starter Pack around cyber threat intelligence to make it easier to find that community here on Bluesky. Let me know of folks I missed, as I’m sure there are many! go.bsky.app/TxQYHap

An implementable security guardrail policy for cloud www.cloudguardrails.com#cloud-guardr...

This account will be only used to monitor and create lists so far right groups and others who are attempting to manipulate the platform and target every day users with hate, conspiracy, and misinformation are removed from your feeds.

Speaking of nostalgia. @dieworkwear.bsky.social is so good at bringing up stories of a past internet where forums dominated as the technology for subcultures. I miss the sheer ridiculousness, pettiness and playful nature of these places. You could tune in, shitpost and tune out without worry.

I was on a menswear forum with Michael Anton for many years. If you plan to work in the Trump White House and have a petty rivalry with him, let me know. I can help you say things around him that will get under his skin. @sebgorka.bsky.social

Okay I’ve gotten the detection and CTI starter pack. What other big security starter packs are there?