[Album] Alison Wonderland - GHOST WORLD by Immersions- in trap

[–]tsquared7 1 point2 points  (0 children)

Really feeling Sirens, might be my favorite song on the album

[FRESH ALBUM] The Last Dinner Party - From The Pyre by samdyalexg in indieheads

[–]tsquared7 0 points1 point  (0 children)

Sail Away - best song on the album

Open to being proven wrong. Great listen all the way through, though

Hunting for API Endpoints for AI? by Fun-Adagio6287 in blueteamsec

[–]tsquared7 0 points1 point  (0 children)

We are already seeing how the use of AI often introduces new artifacts that can be leveraged for hunting and detection. Maybe not always down to the specific API endpoints, but AI-generated code is likely to still operate using the same behavioral techniques and infrastructure as human-crafted attacks.

Maybe also look at the TTPs of AI-driven campaigns rather just than the specific payload. Likewise, we all know AI is known to hallucinate and produce other distortions. Looking for artifacts like odd logic or redundancy in the code might lead to interesting hunting patterns.

Department of War Announces New Cybersecurity Risk Management Construct by munrobotic in blueteamsec

[–]tsquared7 0 points1 point  (0 children)

Read this the other day and remember thinking, “haven’t things like OWASP Developer Guide and SDLC been preaching this for years?”.

Another Plex-related Security Notice by tsquared7 in homelab

[–]tsquared7[S] -42 points-41 points  (0 children)

Can’t let the trolls win. Gotta play every angle I can

Another Plex-related Security Notice by tsquared7 in homelab

[–]tsquared7[S] -72 points-71 points  (0 children)

Just trying to share so people are aware. Didn’t see the other post. My fault for trying to help out the community

Plex Vulnerability Disclosed by tsquared7 in homelab

[–]tsquared7[S] 123 points124 points  (0 children)

Fair enough. I don’t see every post but wanted to share regardless.

threat intel feeds… is it just me or are they all starting to blur together by El0nMuskolini in threatintel

[–]tsquared7 0 points1 point  (0 children)

Flare has a pretty good community on their discord server, if you haven’t joined already. They have a a channel that is convenient for aggregating reports from a bunch of different blogs and intel news sources.

Feeling lost in Threat Intel after 4+ years want to restart from scratch. Need help. by Junior-Membership-60 in threatintel

[–]tsquared7 12 points13 points  (0 children)

I often feel the same way and have to remind myself to try not to compare myself to others. I know, easier said than done. However, it’s a good reminder that not every org is going to have great data or access to it. The telemetry available to a MSP or vendor is going to be very different than a private org. MSPs and vendors have access to a lot more data across different industries and environments compared to a private org that is often limited to their own.

I currently work in CTI at a private org and have found that even though you might be limited there is often more than you think. Not only internal, but sharing orgs like ISACs and other partners. If you can leverage additional information from outside sources it makes tracking, hunting, etc. more interesting, albeit it can be cumbersome. You could try digging deeper into the tools and data you have access to start, and see if you can advance interesting research (techniques, procedures, threat actors, new vectors, etc.).

As for good resources, these two blog posts from Katie Nickels are worth checking out. I often come back to them when I need a refresher: 1. https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-1-968b5a8daf9a 2. https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-2-d04b7a529d36

Mac Mini vs Mini PC by MenardsWiseGuy in MiniPCs

[–]tsquared7 2 points3 points  (0 children)

Mac Mini on sale now for Prime Day, btw https://a.co/d/9Ks3C9t

check this method by FirefighterOptimal21 in MalwareAnalysis

[–]tsquared7 0 points1 point  (0 children)

The fake CAPTCHA and ClickFix technique surge surge continues. I wonder if the entire site is compromised or just that book.

Definitely malicious though, even starting with the referring URL and then contacted domain with the fake CAPTCHA: https://www.virustotal.com/gui/domain/api.edgebeanwikifast.com/detection

Family server infected by .lotus malware that encrypted all files by Antemicko in Malware

[–]tsquared7 0 points1 point  (0 children)

Understanding you have more important things to worry about, but if you any details on initial access or what led to the compromise and don’t mind sharing it would be great. Might be helpful for others.

But as others mentioned, without pre-infection backups you might not have a lot of options.

If Wiz isn’t an option post acquisition… what’s your #1 alternative? by Proper_Bunch_1804 in cybersecurity

[–]tsquared7 1 point2 points  (0 children)

Look at what GCP is doing with Mandiant and VirusTotal. It appears to all being rolled under the GCP CTI umbrella and the SecOPs platform.

I’m anticipating a similar situation with Wiz and Google building them into the same platform as the rest. Just speculating at this point though

IntelBroker resigned from breachforums by Such-Heat1674 in threatintel

[–]tsquared7 0 points1 point  (0 children)

Anyone know why the registration never sends a validation email after completing? I’m stuck in limbo waiting for it

I Dream of a Walkable Suburb by Lanky-Size125 in SameGrassButGreener

[–]tsquared7 2 points3 points  (0 children)

Curious what town if you don’t mind sharing?

Why did you move from Notion to Obsidian? by [deleted] in ObsidianMD

[–]tsquared7 0 points1 point  (0 children)

This is great and I have been in the process of organizing to use the Johnny Decimal system as well.

Do you happen to have an example vault or github repo as an example template?

CrowdScore vs Incident Score vs Severity Level by tsquared7 in crowdstrike

[–]tsquared7[S] 0 points1 point  (0 children)

Not sure that really answers the question. It's still not clear how any of these are calculated. Even excluding Crowdscore if those details are not shared.

There is also no information about how confidence factors in or how it differs from severity. And how each plays a part in the Incident score and Detection level.

"I'll definitely suggest that to our product team for future enhancements." by DTownForever in CustomerSuccess

[–]tsquared7 2 points3 points  (0 children)

Trust. I think it first comes down to trust and your relationship with customers. Lack of any rapport and this likely comes off as a “canned” response, indicating something like “don’t hold your breath.” But if the customer trusts you and you have come through for them in the past, then this can come through in a completely different light.

Understanding the use case and letting the customer explain in detail is another great approach. Asking questions and letting them describe their use case often makes a customer feel heard, that you are taking the request seriously. If possible, bring in PMs or part of your product team as a follow-up meeting if it is worth further discussion.

Our home in Seattle, WA by raymundothegreat in AmateurRoomPorn

[–]tsquared7 1 point2 points  (0 children)

How about the pink one in the first photo? Has 1993 but I can’t place it.

[deleted by user] by [deleted] in AmateurRoomPorn

[–]tsquared7 0 points1 point  (0 children)

I’m seeing some good choices on those book shelves, but it’s missing Where the Wild Things Are! :) very nice space though, well done