Elastic Platform Engineer @BHinfoSecurity | DFIR + Tech + Music + Coffee | @timdotzero@infosec.exchange (opinions expressed are my own)
Texas, USA
Joined March 2019
- Tweets940
- Following753
- Followers389
- Likes2.3K
T.J. retweeted
i don't post much here these days, but this one feels worth sharing to the #DFIR community
@eric_capuano has been working on this side project, almost at MVP 🌈
so if you work in forensics and want super timelines on macOS... THOON!
T.J. retweeted
God I hate the fact that Threat + Hunting is being called "Thrunting." And we now have Threat + Hunters who are "Thrunters." This is all I can see when I see these terms...
T.J. retweeted
Workshop happening THIS THURSDAY:
✔️ Pay What You Can
✔️ Collaborative interaction with instructor & fellow students
✔️ Access to course slides for future reference
✔️ Tips, tools, & techniques that can be applied immediately
antisyphontraining.com/produ…
T.J. retweeted
Something to look forward to this Friday: Foundations of Network Forensics & Analysis with Troy Wojewoda!
This workshop is 4 hours long and includes hands-on labs. It's the perfect way to fit a bit of training into your workweek.
Registration & details: antisyphontraining.com/cours…
T.J. retweeted
Hey folks!
THURSDAY - BHIS Webcast
Join us for a free one-hour webcast with the Black Hills Information Security (BHIS) ANTISOC Continuous Penetration Testing team.
Learn how we test our client's security daily and take home tools and techniques to try yourself.
Isn’t this just a Red Team? It’s complicated. We'll explain.
Our goal: help you think like the threats you're up against.
Thursday, July 24th - 1:00 PM EDT
Register (Zoom): events.zoom.us/ev/AtOpqfQYqF…
Show up early for Pre-Show Banter! and Hack It!
FRIDAY - @Antisy_Training PWYC Workshop
Something to look forward to this Friday: Foundations of Network Forensics & Analysis with Troy Wojewoda!
This Pay-Forward-What-You-Can workshop is 4 hours long and includes hands-on labs. It's the perfect way to fit a bit of training into your workweek.
Registration & more info: antisyphontraining.com/cours…
T.J. retweeted
It's dangerous to go alone, here... take this knowledge with you.
Joseph joined us last week to share what he's discovered and learned about the Dark Web, so you never ever ever have to go there for yourself!
No slide deck for this one so just sit back and enjoy - youtube.com/watch?v=TphMQAyC…
T.J. retweeted
If you're looking to get into SOC work, specifically Detection Engineering, I'm running a Pay-What-You-Can Detection Engineering workshop on March 7th: antisyphontraining.com/cours…
T.J. retweeted
INFOSEC CONTENT CREATORS! Do you have a YouTube channel, Twitch stream, blog, magazine, or anything else where you share your knowledge and insights on cybersecurity, please drop the link in the comments.
We want to help you find more people to help.
We're all in this together!
T.J. retweeted
Ever wanted to run Nuclei scans at scale without relying on Nuclei Cloud? Now you can!
Ralph May joined us for a free one-hour BHIS webcast and taught us about the power of Nuclei scans and their incredible value for security teams. But that was just the beginning.
Ralph introduced Orbit, a tool that makes this vision a reality, and showcased its features with a live demo
Watch the full webcast here - youtube.com/live/cdZXHd28Uog
Tools:
Orbit Scanner - orbitscanner.io/
T.J. retweeted
"In addition to being common, access control vulnerabilities are often high impact when exploited..."
Read more: blackhillsinfosec.com/findin…
Finding Access Control Vulnerabilities with Autorize
by: Craig Vincent
Published: 11/21/2024
T.J. retweeted
"Did you learn the standard formula? Cyber risk = Threat x Vulnerability x Consequence"
Read more: blackhillsinfosec.com/cyber-…
Cyber Risk Lessons We Can Learn From Hurricane Preparedness
by: Kelli Tarala
Published: 11/14/2024
T.J. retweeted
Blue teamers — sometimes we can lose sight of Active Directory. I mean, it just works in the background, right? Active Directory is crucial to Windows networks and a perfect target for bad actors. Dive into this article to learn common active directory pitfalls and how to avoid getting your day ruined.
Read this article and more educational content for free in PROMPT# SOC Issue - promptzine.com/soc-issue-art…
Resources on Active Directory:
Fun with Office Macros
youtube.com/live/cfKDnxeoTuQ…
From Zero to Hero: Beginner’s Guide to Active Directory
youtube.com/live/XwOV7HpVLEA…
New Methods to Attack & Defend Active Directory
youtube.com/live/rSgj-oMxG0g…
Your Active Directory Active Defense ADAD Primer youtu.be/TA5G2tOrVAo?si=089C…
Weaponizing Active Directory
youtu.be/vLWGJ3f3-gI?si=cfPm…
Active Directory Best Practices That Frustrate Pentesters
youtu.be/SdNPUhzYTUc?si=jPPg…
Blogs - blackhillsinfosec.com/tag/ac…
T.J. retweeted
Day 347 of 366 Days of Cyber!
Want to take what you learned from yesterday post further? Antisyphon Training has got you covered -antisyphontraining.com/cours…
If you'd like more helpful educational content, check out the Infosec Survival Guide: GREEN BOOK - blackhillsinfosec.com/prompt…
T.J. retweeted
If you're an educator, please reach out to the Black Hill's team about sending you copies of the guide for free to help in your efforts to raise up the next generation of infosec professionals.
blackhillsinfosec.com/contac…
Digital Forensics is a science and art! In the Yellow Volume of our Infosec Survival Guide, Blake Regan @Zer0C00L, breaks down the art of digital forensics, career paths you can take to becoming a digital forensics investigator, and resources to help you in your career!
Resources:
Blue Team Tactics by Blake regan - blueteamtactics.net
Attack Tactics 6: Return of the Blue Team - youtu.be/c7x5JsR16Qw
Blue Team Summit - youtube.com/playlist?list=PL…
A Blue Team's Perspective on Red Team Hack Tools - youtu.be/0mIN2OU5hQE
blackhillsinfosec.com/blog/
Open-Source Tools:
Forensic Tool Kit (FTK) Imager - exterro.com/forensic-toolkit
Autopsy Forensics Suite - autopsy.com
Volatility (memory analysis) - volatilityfoundation.org
Zimmerman Tools - ericzimmerman.github.io/#lin…
Wireshark - wireshark.org
iLEAPP and aLEAPP - github.com/abrignoni/iLEAPP
github.com/abrignoni/aLEAPP
Klogg - klogg.filimonov.dev
If you'd like more helpful educational content, check out the Infosec Survival Guide: GREEN BOOK - blackhillsinfosec.com/prompt…
T.J. retweeted
listening to one of the sharpest minds in our space, @Recon_InfoSec's @whoisAndrewCook, drop wisdom bombs at @BSidesAustin 🥹🔥🙌
"proactive defense: building effective threat hunts with AI and human expertise"
T.J. retweeted
What is SQL and why is it worth learning?
Come join a former SQL-hater to learn the capabilities of the universal data query language and how you can use it for more than just databases.
Join us for a free one-hour Black Hills Information Security (BHIS) webcast with Security Analyst - @EthanRobish , about Intro to Data Analytics using SQL.
Thursday, November 21st — 1:00 PM EST (UTC -5)
Register here:
events.zoom.us/ev/Ah6OIaoU5h…
Ethan will cover a broad swath of both introductory and advanced SQL features.
If you're looking to push beyond the boundaries of spreadsheets or command-line kung fu this webcast is for you.
By attending, you'll gain an understanding of the types of problems that SQL excels at along with examples using DuckDB, a modern Swiss army knife of data analytics.
Show up early for the pre-show banter!
John & Ethan
#webcast #SQL
T.J. retweeted
Free workshop: “Advanced Email Threat Hunting w/ Detection as Code” by Michael Robertson @Recon_InfoSec
Buy conference tix by EOD 11/22 to receive email when wksh reg opens—1st come, 1st served
bsidesaustin.com/schedule
@SecurityBSides @BSidesSATX @AustinISSA @dc512 @LASCONATX
ALT BSides Austin free workshop: “Advanced Email Threat Hunting w/ Detection as Code” by Michael Robertson Event dates: December 5-6, 2024 https://bsidesaustin.com/schedule
T.J. retweeted
We're excited to announce the release of ProcDump 1.0 for Mac. ProcDump functionality is now available on Windows, Linux, and macOS.
Get the tools at sysinternals.com.
See what's new on the Sysinternals Blog: techcommunity.microsoft.com/…
T.J. retweeted
If you enjoyed the webcast today and want to do everything I talked about and then some, check out my class, Foundations of SOC on @Antisy_Training
We'll build a SOC from the ground up, complete with a SIEM and ticketing system; populate that SIEM with detections, and investigate their alerts; and even do a threat hunt based on a "customer" request.
Virtual: December 5th & 6th
In-Person: @WWHackinFest Denver, February 4th & 5th
antisyphontraining.com/cours…
Thanks to everyone who attended my detection engineering webcast today. The recording is available here: youtube.com/live/i2vOukyPp8c…
T.J. retweeted
In just a few hours, @MGuevara224, Certified Instructor at SANS Institute, joins us to discuss Decoding Windows Processes and Threats.
Register for the series: lc.pub/3VmlJ8D
#cybersecurity #infosec
