Chris DiSalle
@chrisdfir.updatex64.zip
Technical Lead, Incident Response @ Cisco Talos DFIR, drums, and the simple things
The SAVE Act could change how Americans register to vote. Find out what documents you need — state-by-state guide: www.savethevotes.org #thesaveact #usa #democracy #voting #elections
Save the Votes — Citizen Preparedness Resource
Find out exactly what documents you need to vote under the SAVE Act. State-by-state guides, birth certificate costs, voter ID rules, and election office links for all 50 states.
savethevotes.org
Check out this blog post to learn more about our Incident Response team at Cisco Talos and how we can help your organization.
Cisco Talos Intelligence Group@talosintelligence.com · 11mo agoWhen a cybersecurity crisis strikes, Cisco Talos Incident Response transforms chaos into control. Read our latest blog for a behind-the-scenes look at what happens when you engage our team: cs.co/63324AZeIQ
Experiencing a security incident? The Cisco Talos Incident Response team delivers fast, expert support to help you identify, contain and remediate threats when every second counts: www.youtube.com/watch?v=XFw0...
Watch out for threat actors who try to reel you in! 🎣 Phishing to achieve initial access soared this quarter, comprising 50% of all Talos IR incidents. Read our Quarterly Trends report for Q1 2025: http://cs.co/633252gat3
Hot off the press! Check out the Talos 2024 Year In Review report to learn about threat actor activities we encountered last year.
Cisco Talos Intelligence Group@talosintelligence.com · last yr.Cisco Talos’ 2024 Year in Review is available now! With visibility into more than 886 billion security events per day, the report features our key insights. Read the full report here: http://cs.co/63320FzuMG
Get the latest on what our team is seeing in the quarterly trends report! #dfir #cybersecurity
Cisco Talos Intelligence Group@talosintelligence.com · 2y agoThe Talos Incident Response Quarterly Trends report for Q4 2024 is out now! The report covers web shell usage and a spike in the exploitation of public-facing applications. Read the full findings here: blog.talosintelligence.com/talos-ir-tre...
Found one of my favorites in the used bin at the record store today. Cat Stevens - Buddha and the Chocolate Box (1974)
While there are some awesome methods to detect web shells with Yara, sometimes structured data can help solve the case. In this oversimplified example, I go over how you can use two artifacts with Velociraptor to help you find evil on your Linux server. #dfir #blueteam #cybersecurity
Hunting Linux Web Shells with Velociraptor
Linux forensics can be tricky, especially when investigating subtle threats like web shells. Unlike Windows, which provides tools like the Master File Table ($MFT) for metadata-rich investigations, Li...
linkedin.com
While there are some awesome methods to detect web shells with Yara, sometimes structured data can help solve the case. In this oversimplified example, I go over how you can use two artifacts with Velociraptor to help you find evil on your Linux server. #dfir #blueteam #cybersecurity
Hunting Linux Web Shells with Velociraptor
Linux forensics can be tricky, especially when investigating subtle threats like web shells. Unlike Windows, which provides tools like the Master File Table ($MFT) for metadata-rich investigations, Li...
linkedin.com
#Linux lacks a resource like the Windows Master File Table ($MFT). I've developed this #Velociraptor artifact to collect metadata from files and folders recursively in selected paths to create a bodyfile. This may bring an MFT-like feel to filesystem analysis. #dfir github.com/chrisdfir/Ve...
github.com
Played The Incredible Machine a lot as a little kid. Same dev has a modern version on Steam. store.steampowered.com/app/241240/C... #games #steam
Contraption Maker on Steam
The spiritual successor to The Incredible Machine from its original designer and programmer. Play 100s of puzzles. Build and share elaborate contraptions with an huge variety of parts and critters.
store.steampowered.com
Retro Tech Dreams@retrotechdreams.bsky.social · 2y agoThe Incredible Machine (1993)
"According to Cisco Talos’ data, roughly 60% of all email containing a QR code is spam." Malicious QR codes - how big of a problem is it really? Check out this 60 second recap. The full analysis is available at cs.co/6010tMy7s #cybersecurity #qrcodes #talosthings
Malicious QR Codes: How big of a problem is it, really?
QR codes are disproportionately effective at bypassing most anti-spam filters. Talos discovered two effective methods for defanging malicious QR codes, a necessary step to make them safe for consumpti...
cs.co
Russian spies—likely Russia's GRU intelligence agency—used a new trick to hack a victim in Washington, DC: They remotely infected another network in a building across the street, hijacked a laptop there, then breached the target organization via its Wifi. www.wired.com/story/russia...
Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack
In a first, Russia's APT28 hacking group appears to have remotely breached the Wi-Fi of an espionage target by hijacking a laptop in another building across the street.
wired.com
The 2025 Snort Calendar has arrived 🎉 This year’s theme is Video Games! To get your copy of the 2025 Snort Calendar, fill out our short survey here: cs.co/6018sNeKi Calendars will begin shipping in December 2024. U.S. shipping only, available while supplies last. #cybersecurity #snort #talosthings
New edition of the Talos Threat Source Newsletter is out. Drums, leadership communications, and the intersection between. Good stuff although I wouldn't say Travis Barker is "easy".. those hands are fast. #cybersecurity #threatintel #talosthings
Bidirectional communication via polyrhythms and shuffles: Without Jon the beat must go on
The Threat Source Newsletter is back! William Largent discusses bidirectional communication in the SOC, and highlights new Talos research including the discovery of PXA Stealers.
blog.talosintelligence.com
Topics covered with the kids: - What is cybersecurity? (high level) - How does the Internet work? - Underwater sea cable map - How technology can be used for bad - Stranger danger - Password security hands-on - Don't click random things #cybersecurity #education #teachin
Chris DiSalle@chrisdfir.updatex64.zip · 2y agoSpeaking at the elementary school teach-in tomorrow. Building a small cyber army one class room at a time. It's the long game... #cybersecurity
Speaking at the elementary school teach-in tomorrow. Building a small cyber army one class room at a time. It's the long game... #cybersecurity
Hey #infosec and #cybersecurity folks. I have a couple thinky questions I'd like to get perspective on: - What makes a "good" cybersecurity partner in this day and age? - What services or capabilities are table stakes for you? always curious what you folks are seeing or would like to see
Random Monday thoughts… As most of us have come here to find a safe haven from extremism, I feel it’s important not to use this sanctuary to intentionally sow further division. Paraphrasing Ram Dass, “individualism leads to war, anger, insecurity, and fear.”
Securing a #web server? Consider using CSPBypass to check your HTTP headers for flaws in your Content Security Policies (CSP). Designed for ethical hacking, this is can be multi-purpose. Protect ya neck! #cybersecurity #blueteam #websecurity #http github.com/renniepak/CS...
renniepak@renniepak.nl · 2y agoSome cool new additions at CSPBypass.com by omidxrz For example: cspbypass.com#onetrust <3
This git is full of resources for event logs/auditing. Covers everything from tool configs to audit cheatsheets to event attack chains and data samples. In #DFIR visibility is key. This is a solid resource for those responding to an incident or trying to prevent one. #grc github.com/stuhli/aweso...
GitHub - stuhli/awesome-event-ids: Collection of Event ID ressources useful for Digital Forensics and Incident Response
Collection of Event ID ressources useful for Digital Forensics and Incident Response - stuhli/awesome-event-ids
github.com
Beastie Boys - License To Ill "Now here's a little story I've got to tell about three bad brothers you know so well"
Black Aziz Anansi@blackazizanansi.blacksky.app · 2y agoWhat was the first album that you bought?
Vulnerabilities from 2021 still haunt orgs. When I respond to attacks where these have been exploited I commonly hear "We were just about to upgrade that server next quarter." Yesterday's threats may still present risks today. Focus on asset and vulnerability management.. among other things.
Chris Wysopal@weld.bsky.social · 2y ago3 years later log4j vuln is #8 most exploited. The hype was justified. Also, why are people still using vulnerable versions and still not updating? www.cisa.gov/news-events/...
Digging deck.blue for the ability to add columns for lists and hashtags. This helps keep the posts most important to me from getting lost in the sauce.
MemProcFS is a GREAT Memory Forensics tool. Sharing here in case you have not checked this before! #DFIR #MemoryForensics #MemProcFS github.com/ufrisk/MemPr...
GitHub - ufrisk/MemProcFS: MemProcFS
MemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.
github.com
It's no surprise, credential reuse from infostealers is fueling authentication attacks. Our researchers at Talos detailed findings around a new campaign targeting education and government orgs, PXA Stealer. blog.talosintelligence.com/new-pxa-stea... #threatintel #infostealer #talosthings
New PXA Stealer targets government and education sectors for sensitive information
Cisco Talos discovered a new information stealing campaign operated by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia.
blog.talosintelligence.com
