I've just about had it with the vagaries of true/false positive/negative. Humbly presented: a more descriptive alternative.
The Tyranny of False Positives
It's time to move beyond true/false, positive/negative.
taggart-tech.com
HGB
@hgb.crowstrike.zip
DE&TH I like playing with malware, writing Sigma rules, and hoarding combo lists.
We just translated a wave of our ICE coverage into Spanish. No paywall, no email signup necessary. From leaks about Palantir's work with ICE to ICE's new facial recognition app, we think there is a massive public interest in this info. Read why and support us here: www.404media.co/were-publish...
A reminder that you can get 50% off the new version of The Homelab Almanac with code OMGVERSIONTHREE until the end of June! I'm really happy with the new version, and I think you will be too. taggartinstitute.org...
The Taggart Institute: Master Your Craft
The Taggart Institute exists to provide low-cost, high-quality technology training to everyone in a welcoming, supportive community.
taggartinstitute.org
Some days on a thrunt, the TAs are indistinguishable from the engineer who is highly motivated to break the rules. Using a scheduled task to run net.exe to add yourself to the administrators group on every login is commitment.
I put together some thoughts on the mitigation advice regarding "ClickFix" attacks. taggart-tech.com/cli...
ClickFix Fixes Ranked
The cool thing about ClickFix remediation is nobody walks away happy.
taggart-tech.com
Superintendent Chalmers: fentanyl labs? Principal Skinner: yes Chalmers: that the law enforcement folks were leaving alone? Skinner: yes Chalmers: localized entirely in Canada? Skinner: yes Chalmers: may I see them? Skinner: ...no
Little known fact: Before the crowbar was invented. Crows simply drank at home.
Regex is how I imagine eldritch horrors work. You look at it and it makes no sense and it's scary. As you stare, for a split second there is understanding. The universe expands before your eyes, reality unraveling. Then the madness sets in.
The NSA being asked to delete the word "privilege" is so funny. Goodbye every DFIR report.
Tabletop scenario: Elon Musk walks in and pulls the big "Disable 802.1x" lever like that scene in Ghostbusters, what controls do you still have
www.reuters.com/world/us/tru... Wut
Trump pardons Silk Road founder Ulbricht for online drug scheme
U.S. President Donald Trump on Tuesday pardoned Silk Road founder Ross Ulbricht, who was serving a life sentence after being convicted of running an underground online marketplace that was used by thousands of drug dealers and others to conduct over $200 million worth of illicit sales using bitcoin.
reuters.com
I am so excited to finally show you the stable alpha of Venture, a cross-platform GUI for parsing Windows Event Logs! github.com/mttaggart... Venture was developed with support from my employer with the intent of creating an open source tool for all. Thank you, UCLA Health!
GitHub - mttaggart/venture: Venture: Cross-Platform GUI tool for parsing and analyzing Windows event logs
Venture: Cross-Platform GUI tool for parsing and analyzing Windows event logs - mttaggart/venture
github.com
My daughter today was sitting at my desk and said she was working. When I asked what her job was she said "oh, I just do work". I feel this in my core.
Hey Bsky! I'm writing a piece on Python package security, and I'd really like to interview someone involved with the Debian Python team or someone who's a Fedora package sponsor to talk about the process. If you or anyone you know would be up for a 30-minute interview, drop me a DM! Thank you!
Well it turns out InTune Device Compliance policies don't matter at all. labs.jumpsec.com/tokensmith-b... Thankfully you can still detect intrusions with some older detection techniques like risky sign ins and looking for Check My Sign In (cmsi) events from the InTune company portal ID
TokenSmith - Bypassing Intune Compliant Device Conditional Access | JUMPSEC LABS
Conditional Access Policies (CAPs) are the core of Entra ID’s perimeter defense for the vast majority of Enterprise Microsoft 365 (M365) and Azure environments. The core ideas of conditional access ar...
labs.jumpsec.com