Learn from 4 IR experts on how they do Endpoint Triage.
Apr 17.
I'll MC and you'll hear from @keydet89.bsky.social (Huntress), Kai Thomsen (Dragos), @dfirmike.bsky.social (Sleuth Kit Labs) and Quinnlan Varcoe (Blueberry Security).
See you there!
register.gotowebinar.com/register/600...
01.04.2025 16:04 — 👍 2 🔁 1 💬 0 📌 0
Alert Triage vs Endpoint Triage: What SOCs Need to Know
As we talk to corporate security teams about how they respond to incidents and EDR alerts, we find it useful to highlight the Endpoint Triage step in
For those in the #SOC: Alert Triage vs Endpoint Triage
Blog post that is part of our Endpoint Triage series.
Alert triage focuses on validating and prioritizing the EDR/SIEM alert.
Endpoint triage focuses on prioritizing the host. How bad is it?
www.cybertriage.com/blog/alert-t...
21.03.2025 13:38 — 👍 4 🔁 4 💬 0 📌 0
Information Artifacts: Simplify DFIR Analysis
Do you know the differences between MUICache, ShimCache, AMCache, and PMCache without the help of Google? Did you know that one of them is made up?
We're using the term "Information Artifacts" for high-level #DFIR concepts like "Processes" and "Inbound Logins". I think they are easier to train than low-level Prefetch, UserAssist etc. (i.e. Data Artifacts). Those map to an Info Artifact (Prefetch -> Process).
www.cybertriage.com/blog/informa...
27.01.2025 17:30 — 👍 4 🔁 1 💬 1 📌 0
RBTALKS5: How Pfizer uses AI to detect insider risk - Risky Business
RBTALKS5: How Pfizer uses AI to detect insider risk
This is a fascinating interview from @campuscodi.risky.biz about the actual productive use of LLMs in combating insider threats. Well worth the listen for a conversation around AI without a bunch of marketing BS. risky.biz/RBTALKS5/
20.12.2024 14:09 — 👍 0 🔁 0 💬 0 📌 0
"Distrust and caution are the parents of security." - Benjamin Franklin
https://malwaremaloney.blogspot.com
Security person. Coding on the side.
The largest collection of malware source code, samples, and papers on the internet.
Password: infected
(unofficial, this is a bot! Maintained by @yjb.bsky.social, the bot can't handle retweets, video, and maybe a few other things)
B2B Marketing Executive - Love: Cloud | #DevOps | #Cybersecurity | #SaaS | MSPs | #B2B | #GTM | #PMM | #Channel | #Berlin | #Boston Curation & Posts by me, not my employer
Threat Hunting - DFIR - Detection Engineering
🐙 https://github.com/mthcht
🐦 https://x.com/mthcht
📰 https://mthcht.medium.com
phishing, maldocs, threat intel
Cybersecurity nerd; #DFIR @ Google by day; FOSS, threat intel and malware analysis by night. Investigator, coder, terrible sense of humor.
https://yeti-platform.io and more (github.com/tomchop)
views are my own • he/him • tomchop.me
Livin' the DFIR Lyfe | Incident Response Manager @ Canva | CuratedIntel Member | Stubborn Western Australian working in infosec | Thoughts are my own
Velociraptor@Rapid7. #DFIR, #CTI and research.
https://mgreen27.github.io
https://kostas.page | Opinions are mine only! 🇬🇷🇨🇦
Placeholder profile : https://x.com/cyb3rops | glad to be in this respectful safe space | vi/vim
Threat Intel / CTI / OT / ICS / Critical Infra stuff along with other things. I genuinely care, and wish others did too.
Website: pylos.co
Training/Consulting: paralus.co
Know. When it matters.
https://canary.tools
Security tools and infrastructure on-demand. Use LimaCharlie to automate and manage security operations at scale.
Affordable and accessible cybersecurity training that doesn't suck.
Featuring cybersecurity practitioners, former SANS instructors, and industry recognized leaders from all over the world.
https://www.antisyphontraining.com
Specializing in pen testing, red teaming, and Active SOC. We share our knowledge through blogs, webcasts, open-source tools, and Backdoors & Breaches game.
blackhillsinfosec.com & poweredbybhis.com
MITRE ATT&CK® - A knowledge base for describing the behavior of adversaries. Replying/Following/Reposting ≠ endorsement.
GreyNoise analyzes Internet background noise. Use GreyNoise to remove pointless security alerts, find compromised devices, or identify emerging threats.
A security firm providing Incident Response, Proactive Threat Assessments, Trusted Advisory, and Threat Intelligence // volexity.com
