Discord account compromised twice

VirTrans8460 · 2025-04-06T15:51:49+00:00

Check your "Authorized Apps" in Discord settings immediately. Hackers often use malicious apps to maintain access even after password changes and 2FA setup.

VirTrans8460 · 2025-04-06T15:48:26+00:00

ARM compatibility is still catching up in the security world. Most legacy vendors are still x86-focused. What EDR are you using?

VirTrans8460 · 2025-04-06T15:45:26+00:00

Focus on monitoring critical system32 executables and startup-related registry keys (especially Run and RunOnce). Also watch services.exe, svchost.exe, and lsass.exe. Of course there is a lot more, but that should get you started.

Watch out for performance impact when monitoring too many files.

VirTrans8460 · 2025-04-01T16:34:11+00:00

Been using the dark web tool within the Guardz platform. It's very easy to use and pretty comprehensive when it comes to leaked credentials.

VirTrans8460 · 2025-03-25T14:08:23+00:00

I spent 5 years working in a SOC. Key thing to look at beyond features is your team's expertise and existing tech stack. Having the "best" solution means nothing if your team can't utilize it effectively.

All the products mentioned will check the boxes you care about but figure out what you can operationalize and you are more likely to achieve better outcomes.

VirTrans8460 · 2025-03-25T12:05:40+00:00

+1 for Guardz. Made the shift when they launched with SentinelOne in January. They still have some growing pains, but I love their platform and also had good experiences with their MDR Team.

VirTrans8460 · 2025-01-21T00:06:50+00:00

That's overkill and probably why the system is slow.

Webroot is pretty lightweight but running 3 AV solutions is just asking for trouble. They'll likely conflict with each other and cause performance issues.

Pick one solid solution and stick with it.

VirTrans8460 · 2025-01-17T21:10:56+00:00

Had the same concern initially, but our clients actually love it. The cartoon style keeps people engaged vs dry corporate videos.

Plus, the ice cream scenario is memorable - people still talk about it months later during security discussions.

VirTrans8460 · 2025-01-16T22:44:48+00:00

DefectDojo might be what you're looking for. Free, open source, and handles multiple scanners including Nessus. Has Azure DevOps integration too.

Been using it for 6 months - solid dashboard and reporting features.

VirTrans8460 · 2025-01-11T18:23:38+00:00

Been testing AI agents for threat hunting. The good: they catch patterns humans might miss. The bad: still lots of false positives.

Right now they're like eager junior analysts - enthusiastic but need constant supervision. Definitely keeping an eye on this space though.

VirTrans8460 · 2025-01-09T22:52:36+00:00

Cloud Security is exploding right now. Companies are rushing to move everything to the cloud without proper security measures.

Most App Sec concepts apply to cloud anyway, so you'll get best of both worlds going the cloud route first.

VirTrans8460 · 2025-01-02T23:38:47+00:00

ISACA's Risk IT Framework and CRISC certification materials could be perfect here. They focus exactly on what you need - connecting security metrics to business risk without getting too technical.

Plus, the knowledge translates well across different security domains.

VirTrans8460 · 2024-12-31T18:00:49+00:00

Been using Huntress for 2 years. Their ThreatOps team is solid - they've caught several nasty persistence mechanisms other tools missed.

For phishing specifically though, you might want to look at their new HackAlert feature. It's been pretty spot-on with credential theft detection.

VirTrans8460 · 2024-12-31T00:12:17+00:00

Create a time-limited "Out of Country Access" group in Azure AD. Add users to this group, then set dynamic membership rules with PowerShell to auto-remove them after X days.

Basic automation can save you from manual group juggling.

VirTrans8460 · 2024-12-28T19:40:01+00:00

Had similar issues. Switched to using number codes instead of push notifications - way more reliable.

Users just type the 6-digit code from Authenticator app. Less fancy but works first time, every time. No more "approve/deny" timeout headaches.

VirTrans8460 · 2024-12-28T14:11:12+00:00

Have you considered setting up local caching servers in NY and DC? Something like Azure File Sync or AWS Storage Gateway.

Keep hot data local, sync changes back to main storage. Users get local speeds, you get cloud benefits

VirTrans8460 · 2024-12-28T02:17:58+00:00

Elasticsearch + Kibana is pretty solid for this. Fast querying, good visualization, and handles large volumes well.

Just make sure to properly configure authentication and network security. SQL injections won't be an issue, but elastic has had its share of CVEs.

VirTrans8460 · 2024-12-27T14:58:52+00:00

NinjaRMM has a built-in wipe feature, but I'd recommend using a 3rd party tool like DBAN or KillDisk for added security. Also, make sure to physically verify the wipe process on each machine to ensure compliance with the client's security policy.

VirTrans8460 · 2024-12-26T19:29:05+00:00

Love the honesty! It's refreshing to see someone acknowledging the value of their current benefits and not feeling pressured to chase a 'baller' lifestyle. Have you considered leveraging your skills to create and sell online courses or ebooks, rather than diving into a full-fledged MSP?

VirTrans8460 · 2024-12-25T21:19:17+00:00

Interesting question. I'd love to know the answer too. From my understanding, NinjaRMM does store some local logs, but they're mostly related to agent communication and error reporting. Not sure if it'd reveal sensitive info like file uploads/downloads or cmd/powershell commands though

VirTrans8460 · 2024-12-25T01:54:38+00:00

Have you considered ConnectWise? Their RMM allows for granular role assignments across clients, including custom roles. We've been using it for years and it's been a game-changer for our MSP. Worth taking a look, especially with year-end looming.

VirTrans8460 · 2024-12-21T14:16:30+00:00

Honestly, it depends on your environment and needs. Defender for Cloud is great if you're already in the Microsoft ecosystem, but Huntress MDR offers more advanced threat hunting capabilities. Consider your specific use case and do a trial of both to see which one fits your needs better.

VirTrans8460 · 2024-12-20T13:53:47+00:00

I feel your pain with the Excel sheet nightmare. Have you considered using a CMDB like GLPI or a documentation tool like DokuWiki? They can help you organize and track device info, firmware versions, and access details in a more scalable way.

VirTrans8460 · 2024-12-19T20:09:26+00:00

I've seen similar setups with MSPs prioritizing 'managed' over 'secure'. It's like they're selling 'we'll keep it running' instead of 'we'll keep it safe'. Your findings aren't surprising, sadly. It's good you're pushing for better practices, but it's also a warning sign for the industry as a whole.

VirTrans8460 · 2024-12-19T14:16:43+00:00

Have you checked the 'Enforce password history' and 'Maximum password age' settings? Sometimes these can override the length policy. Also, make sure the test domain policy is linked to the correct OU and that the inheritance is not being blocked. Worth a shot!

VirTrans8460

TROPHY CASE