kostastsale.bsky.social - Profile | ThreadSky | a Reddit-style client for Bluesky

kostastsale.bsky.social

@thedfirreport.bsky.social | Sharing insights in #ThreatIntel, #malware, #IR & #Threat_Hunting. Opinions are mine only! 🇬🇷🇨🇦

154 posts 1,202 followers 113 following

Posts 24 Comments 26

I found some time and wrote a blog on the fake reCAPTCHA phishing issue. Wrote a blog on how it all unfolded, the risks of making these tools widely available, and my take on the whole situation. If you're interested, give it a read! 👇 🔗

submitted 1 day ago • 0 comments

New blog post: macOS Extended Attributes: Case Study dfir.ch/posts/macos_...

submitted 6 days ago • 0 comments

LMFAO 😂

submitted 7 days ago • 0 comments

Hey SDDL SDDL: Breaking Down Windows Security One ACE at a Time www.splunk.com/en_us/blog/s.... Thrilled to share my first blog at @splunk! @mhaggis.bsky.social and I take a deep dive into the weird & exciting world of SDDL and ACEs - what they are, how they work, and how attackers can abuse them.

submitted 8 days ago • 0 comments

1/ 🚨 𝗗𝗙𝗜𝗥 𝗧𝗲𝗮𝗺𝘀 & 𝗦𝗢𝗖𝘀, 𝗜𝘁’𝘀 𝗧𝗶𝗺𝗲 𝘁𝗼 𝗦𝗲𝘁𝘁𝗹𝗲 𝘁𝗵𝗲 𝗦𝗰𝗼𝗿𝗲! 🚨⁣ ⁣ Our first 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲-𝗳𝗼𝗰𝘂𝘀𝗲𝗱 𝗖𝗧𝗙 is happening this summer, and it’s 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝘃𝘀. 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 in a battle of DFIR & SecOps skills! 🏆⁣ ⁣ 👥 𝗬𝗼𝘂𝗿 𝗗𝗙𝗜𝗥 𝘁𝗲𝗮𝗺 𝘃𝘀. 𝗮𝗻𝗼𝘁𝗵𝗲𝗿.⁣ 🔍 𝗬𝗼𝘂𝗿 𝗦𝗢𝗖 𝘁𝗲𝗮𝗺 𝘃𝘀. 𝘁𝗵𝗲 𝗯𝗲𝘀𝘁 𝗶𝗻 𝘁𝗵𝗲 𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝘆.⁣ 💼 𝗬𝗼𝘂𝗿 ... 👇 ⁣

submitted 9 days ago • 1 comment

Tesla is projected to receive a $400 million contract from the U.S. Department of State for armored EVs (www.teslarati.com/tesla-projec...) SpaceX was awarded a supplemental federal contract totaling $38 million 2 days ago. (www.levernews.com/musk-just-sc...)

submitted 11 days ago • 1 comment

DFIR specialist Mthcht has released LOLC2, a collection of C2 frameworks that leverage legitimate services to evade detection lolc2.github.io

submitted 12 days ago • 2 comments

In our new blog, Senior Security Consultant Brandon McGrath explores how to apply Retrieval-Augmented Generation (RAG) to research capabilities. Find out how he leverages AI to enhance his ops. Read it now! trustedsec.com/blog/from-ra...

submitted 12 days ago • 0 comments

🎙️New episode! I've made this one based on my notes on the subject🙂I'll eventually turn them into a blog post that dives a bit deeper. 🔗Listen to it here: creators.spotify.com... ➛ Parts 1️⃣ Case Study – thedfirreport.com/20... 2️⃣ Attacker Mistakes+Psychology 3️⃣ Defense Strategies

submitted 13 days ago • 0 comments

I saw this in OpenEDR's Docs (now Xcitium)... Who's gonna tell em?

submitted 13 days ago • 0 comments

Ultimate Cybersecurity Career Humble Bundle! Includes: - Incident Response for Windows - The OSINT Handbook - Effective Threat Investigation for SOC Analysts and more! Link: humblebundleinc.sjv.io/kOaeod (Partner Link) #DFIR #IncidentResponse #MalwareAnalysis #Cybersecurity #OSINT

submitted 15 days ago • 0 comments

🚫 Wazuh is not eligible for the EDR Telemetry Project Many have asked me to add Wazuh, but after checking it out, I confirm it is NOT eligible. Wazuh is NOT an EDR! It lacks native telemetry and response actions, acting more as a log collector. Details: www.edr-telemetry.com/eligibility....

submitted 15 days ago • 0 comments

Loving the "Code Insights" from VT!! 🔥 It can save you time, but make sure to always validate by confirming the execution flow under the "Behavior" tab. I assume this is where the AI is reading the info from to create the summary, so it is less likely to make a mistake but always validate anyway🫠

submitted 16 days ago • 0 comments

Gemini 2.0 Flash is awesome, and the API tokens are 1/10th of the price compared to OpenAI with a lot larger context! Although, it’s still failing the strawberry test 😂

submitted 16 days ago • 1 comment

Taking a break from creating podcast episodes using AI voices to host another episode of our DFIR Discussions 😄 We had a great chat analyzing the latest report, check out the episode 👇

submitted 18 days ago • 1 comment

Our latest report led to a fresh Sigma rule contribution to the SigmaHQ repo – straight from our private Sigma rule repository! 🔍 Built from our private intrusion cases ⚡ Actionable, high-fidelity detection Rule: github.com/SigmaHQ/sigm... Services: thedfirreport.com/services/

submitted 19 days ago • 0 comments

This is just unreal from an information security perspective 😱 Imagine the consequences of unauthorized access by incompetent graduates who Musk appointed to review. I can’t comprehend how you Americans can allow someone like that to interfere with your nation as if it were his personal business.

submitted 22 days ago • 2 comments

🚀 EDR-Telemetry Update! Quality-of-life improvements for better usability & transparency. Plus, Cylance EDR is now in the Windows Telemetry comparison! 🔗 Click & copy sections for easy nav ⚠️ Clearer disclaimers on ineligible products ✅ Added Cylance EDR! 🔍 www.edr-telemetry.com

submitted 22 days ago • 0 comments

I tried running deepseek 70B model and my M2 Mac started crying 😂 😂 😭

submitted 23 days ago • 1 comment

New research from Unit42 with some interesting TTPs: - Data exfil and data recon from SQL DBs - PlugX doing PlugX things with the usual side loading techniques - Defense evasion mixed with loud exec TTPs—plenty of detection opportunities! Great report:

submitted 23 days ago • 0 comments

Sam Altman: “When I scrape all the data without asking questions is fine. When others do it to OpenAI, it’s a crime.” 🤮🤮 And why tf are we still calling it OpenAI when it’s been a long time since it was open sourced? They should change the name to something like ClosedAI or something.

submitted 25 days ago • 1 comment

I have started a bsky list to compile all reputable journalism outlets. So far, I just have @404media.co in the list. What others sources do you suggest I include?

submitted 26 days ago • 2 comments

#LOLBAS project update: Entries now have placeholders for paths, URLs, and more. This makes it easier to visually see what parts are "variable", and for LOLBAS API users (lolbas-project.github.io/api/) it'll be easier to use with automation. Check it out: ⭐ lolbas-project.github.io

submitted 26 days ago • 0 comments

I found out that, by default, only people you follow can message you. I've changed it to "everyone.", DMs are open! I hope I don't get as many bots messaging me as I did on Twitter tho 🫣

submitted 26 days ago • 0 comments