Johannes Ullrich retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.
❤️👨💻
dynamicincidentresponse.com/…
Just got my mail-in ballot. I do not take bribes. But if a candidate thinks it is important enough to turn this county/state/country into red/blue/green: I am taking donations to offset the cost of researching the candidate's programs. Is it worth $1 to you to make sure I have the resources necessary to properly evaluate your program? For $10, I may read it twice. Or join my elite research club, schedule a call with me to walk me through your program, for only $1,000. I may also raffle off a dinner with me to a candidate.
Johannes Ullrich retweeted
The threats are evolving. Your skills should too. 🛡️
@SANS_EDU graduate certificates help professionals specialize in high-value areas like Cloud Security, Cyber Defense Operations, and Digital Forensics. Explore your options: go.sans.edu/Q1Xyw8
Hermes Agent: anybody actually getting it to do any work... All I get is stuff like: "No — I haven't executed any commands to get the repo yet. My entire response was just talking about failing instead of actually doing the work."
Johannes Ullrich retweeted
Does your employer offer tuition assistance? 💼
You're likely eligible to use those benefits toward a cybersecurity degree or certificate @SANS_EDU. Learn how: go.sans.edu/eSwkR5
Johannes Ullrich retweeted
Would you get a Cybersecurity Master's Degree if your boss paid for it?
Put your employee benefits to work with the @SANS_EDU master's program. Earn 9 GIAC certifications while advancing your career: go.sans.edu/YwriQv
Johannes Ullrich retweeted
Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en cert.pl/en/posts/2026/09/vul…
Johannes Ullrich retweeted
The Find Evil! winners are Mulder, TRUDI and Camel. All three open source today.
Johannes Ullrich retweeted
No CISO has ever regretted the training. Here's why one still blocks 5 days a year for it. #Cybersecurity
Johannes Ullrich retweeted
Each of my executive-briefing templates answers what senior leaders actually ask. What happened, what it means for the organization, and what we should do. They're based on what I wanted to see and share as a CISO.
zeltser.com/cyber-brief-temp…
"rattling doorknobs and walking through the ones that opened" is all it took to compromise the water system of 30 towns... secureish.substack.com/p/we-…
Johannes Ullrich retweeted
Learn about what’s next for our ISC sensor network. SANSFIRE keynote this evening
My server room is running a bit hot at home (heat wave in Florida). Can anybody else please turn their AC off so I can use more power? You know.. AI and such.
Johannes Ullrich retweeted
You trust SANS training.
Now make it count toward a degree.
Join @SANS_EDU on July 9 to learn how your GIAC certifications can be applied for academic credit in our master’s and graduate certificate programs: go.sans.edu/IaQEEk
Johannes Ullrich retweeted
TShark isn't just Wireshark without a mouse. Andy used it to prove SMB 3.1.1 compliance for auditors when no Windows tool could. Watch how display filters + field extraction solve real-world problems.
youtu.be/SpbUTsrRAP4
Johannes Ullrich retweeted
🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.
Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadata
All of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.
Who’s trying it out? Drop a ❤️ and reply with your main use case!
#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma
@Suricata_IDS @lennyzeltser @chrissanders88 @sansforensics @TomLawrenceTech
This is very sad news. Eric authored and taught SEC401 (formerly known as "Track 1"), still one of our more popular classes. At a time when many introductory information security classes focused on theoretical principles and higher-level generic problems, Eric developed a hands-on technical class that defined the SANS promise. As an "OG" SANS instructor, he also defined the high energy, captivating teaching style characterizing SANS even after he left. Dance breaks for students, pushing an ice cream cart into class (or other instructors' classes) to get students engaged and "awake," were just a couple of his tricks that made him a great instructor. Rest in Peace.
Johannes Ullrich retweeted
🚨 Today's Headline: "GitHub hit by a compromised VSCode extension"
Every defender is now scrambling to answer the critical question: Which VSCode extensions are installed across my MDE users, and is there any impact to their development environment?
For those running Microsoft Defender for Endpoint, here’s a KQLWizard query to instantly extract the full list of VSCode extensions executed by your users. (Answering to @IAMERICAbooted SOS Call 🫡)
github.com/SlimKQL/Detection…
Go hunt down those malicious extensions before they hunt you. 🧙♂️✨
Johannes Ullrich retweeted
The Paller Cybersecurity Scholarship was created to identify and support the most promising new talent across the globe.
Today, we are proud to introduce the 2026 #PallerScholars 🌏🏆
Learn more about the scholarship and this year's winners: sans.edu/pcs
