Defenders, new C2 tooling to be on the lookout for... Found it in use by Aurora Ransomware group. github.com/XTLS/Xray-core

GitHub - XTLS/Xray-core: Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.

Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses. - XTLS/Xray-core

github.com

We are honored to have our "Threat Hunting & Incident Response with Velociraptor" course featured on the official @velocidex.com documentation site! #threathunting #incidentresponse #dfir #securityoperations #velociraptor docs.velociraptor.app/training/#co...

Sneak preview of what we're cooking up for this weekend 👀🔥 This is our 8th year teaching at @blackhatevents.bsky.social, and our Advanced Security Operations & Threat Hunting course is more fun than ever! 🤓 There are still a few seats left if you want to join us! blackhat.com/us-26/traini...

1 week til Black Hat! 🤯 Join @eric.zip, @whit.zip, and @nynir.bsky.social for our 4-day Advanced Security Operations & Threat Hunting course! There are still some seats available! 👇🤓 Course details and registration: blackhat.com/us-26/traini...

Most AI in security workshops end with a pitch. This one ends with something you built. We're hosting a free hands-on lab at Black Hat with @bhinfosecurity.bsky.social and @digitaldefenseinstitute.com. 6 hours. Real infrastructure. @whit.zip @eric.zip @nynir.bsky.social luma.com/black-hat-he...

Less than 3 weeks until Black Hat! 🤯 Join @eric.zip, @whit.zip, and @nynir.bsky.social in Vegas! Register for our 4-day Advanced Security Operations & Threat Hunting course 👩‍💻💙 Course details, outline, and registration here: blackhat.com/us-26/traini...

40 days until Black Hat! 🤯 Join @eric.zip, @whit.zip, and @nynir.bsky.social in August! Registration is open for our 4-day Advanced Security Operations & Threat Hunting course! 🔥 🤓 🙌 Course details, outline, and registration here: blackhat.com/us-26/traini...

Triage.zip now has support for macOS & Linux 🚀

2 months until Black Hat! 🤓 Join @eric.zip, @whit.zip, and @nynir.bsky.social for a 4-day training at @blackhatevents.bsky.social! Registration is open for our Advanced Security Operations and Threat Hunting course! 🔥👩‍💻🙌 Course outline and registration: blackhat.com/us-26/traini...

ATTN NERDS: Join @eric.zip, @whit.zip, and @nynir.bsky.social for a 4-day training at @blackhatevents.bsky.social! Registration is open for our Advanced Security Operations and Threat Hunting course! 🔥👩‍💻🙌 Early bird discount until 5/22 👀 Register: blackhat.com/us-26/traini...

I recommend this! I’ve done live course via antisyphon and I’m doing non-live version via coursestack right now. I had to DFIR semi-manually in the past and it was not fun. Velociraptor would’ve made life way easier.

DDI Training@digitaldefenseinstitute.com · 3mo ago

Learn to hunt and respond with Velociraptor with @eric.zip and @whit.zip at @wildwesthackinfest.bsky.social October 6-7, 2026 in Deadwood, SD! www.antisyphontraining.com/product/thre... #dfir #threathunting

Learn to hunt and respond with Velociraptor with @eric.zip and @whit.zip at @wildwesthackinfest.bsky.social October 6-7, 2026 in Deadwood, SD! www.antisyphontraining.com/product/thre... #dfir #threathunting

Threat Hunting & Incident Response with Velociraptor - Antisyphon Training

Master the art of threat hunting and incident response with Velociraptor, a rapidly emerging powerhouse in cybersecurity.

antisyphontraining.com

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA and registration is open for our Advanced Security Operations and Threat Hunting course! 🔥🤓 Join @eric.zip, @whit.zip, and @nynir.bsky.social for our 4-day training: Early bird discount until 5/22 👀 Details: blackhat.com/us-26/traini...

ATTN NERDS: We're returning to @blackhatevents.bsky.social USA and registration is now open for our Advanced Security Operations and Threat Hunting course! 💙🤓🚀 Join @eric.zip, @whit.zip, and @nynir.bsky.social for our 4-day training: blackhat.com/us-26/traini...

Are you a fan of Velociraptor and Claude Code? We have a gift for you! Our first of many Claude Code plugins is a VR Artifact generator, and it's quite good at it! Give it a try and let us know what you think... github.com/Digital-Defe... #dfir #velociraptor #claudecode @velocidex.com

Net-NTLMv1 is dead. Rainbow tables are now public, making cracking trivial. If it’s still lurking in your environment, now’s the time to root it out. Inventory, detect, and kill it before an attacker does. cloud.google.com/blog/topics/...

Releasing Rainbow Tables to Accelerate Protocol Deprecation | Google Cloud Blog

Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.

cloud.google.com

Obligatory blog post describing the detection methodology I used. blog.ecapuano.com/p/hunting-mo...

Hunting MongoBleed (CVE-2025-14847)

Detecting CVE-2025-14847 Exploitation with Velociraptor

blog.ecapuano.com

I have PR'd a new @velocidex.com Artifact to the Exchange to hunt for exploitation of #CVE-2025–14847. As far as I know, this is the only defensive signature for this CVE that exists currently. github.com/Velocidex/ve...

Create Linux.Detection.CVE202514847.MongoBleed.yaml by ecapuano · Pull Request #1161 · Velocidex/velociraptor-docs

Add Linux.Detection.CVE202514847.MongoBleed Artifact Summary This artifact detects evidence of CVE-2025-14847 (MongoBleed) exploitation on MongoDB servers by analyzing connection patterns in MongoD...

github.com

Friendly reminder to my #DFIR friends... If you ever need an offline triage collector in a pinch, @whit.zip and I maintain one for you! Powered by latest version of Velociraptor, preconfigured to get all the important pieces for investigation. 1. Download 2. Execute 3. Find bad guys triage.zip

Same awesome tool, new look -- triage.zip got a facelift! Also, updated to work with latest changes to Velociraptor's new Triage Targets: triage.velocidex.com This project made possible due to the epic team behind @velocidex.com 💙 We only aim to make it even more accessible to the masses. #DFIR

We are launching a Black Friday deal on our most popular course, Threat Hunting & Incident Response w/Velociraptor! From now until midnight (EST) 11/28, enjoy 40% off our best-selling on-demand course. Register: ddi.sh/thvr-bf-2025 Use Code: blackfriday2025 #DFIR #ThreatHunting

I have always wanted an app like Zimmerman's Timeline Explorer, but for macOS.... Sadly, nothing remotely close exists except Excel 🤮 Stoked to say, I am nearly done with the the MVP! 😎 Supertimelines on MBP! #dfir

Another THVR in the books! We had so much fun with this group of nerds this week. Thanks for the engaging chats and for choosing to hang with us for a couple days--until next time 🤓🦖💙 We hope everyone enjoyed the con! @wildwesthackinfest.bsky.social @antisyphontraining.bsky.social

If you’re interested in tinkering with LLMs to assist with incident triage, check out this demo I did with @limacharlie.io using Claude Code and the LC MCP: youtu.be/dSCmLIBkTdo?... I open sourced the Claude configs and context files for anyone that wants to try it out: github.com/Digital-Defe...

The unopinionated AI advantage: Building AI-powered SecOps on your terms

YouTube video by LimaCharlie

youtu.be

New blog post! PowerShell transcripts for threat hunting & IR 🚀 blog.ecapuano.com/p/dfir-artif...

DFIR Artifact: PowerShell Transcripts

The "flight data recorder" for PowerShell activity.

blog.ecapuano.com

a certain mr @timmedin.bsky.social made a guest appearance during ASOTH day 3 today to drop some kerberoasting knowledge bombs on our students love this guy. THANK YOU TIM 🤓🫶🔥🎟️ @blackhatevents.bsky.social

ATTN NERDS: 5 more days until it's go time at Hacker Summer Camp! 💙 There's still time to register: www.blackhat.com/us-25/traini... And if you can't join us at @blackhatevents.bsky.social, check out our on demand courses 🤓🦖🔥 academy.digitaldefenseinstitute.com/catalog

T-minus 12 days until my favorite humans - @eric.zip & @whit.zip - and I deliver our Advanced Security Operations and Threat Hunting training at @blackhatevents.bsky.social. If you're a SOC analyst and/or work in IR, we'd love to have you. Come level up with us :) www.blackhat.com/us-25/traini...

Black Hat

Black Hat

blackhat.com

Join us at the @antisyphontraining.bsky.social Blue Team Summit Aug 28 – Aug 29 for Threat Hunting & Incident Response with Velociraptor! www.antisyphontraining.com/course/threa...

1 month to go! 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip at hacker summer camp! Registration: www.blackhat.com/us-25/traini...

Black Hat

Black Hat

blackhat.com

DDI Training@digitaldefenseinstitute.com · last yr.

ATTN NERDS: We'll be at @blackhatevents.bsky.social USA again this year! Registration is now open for our Advanced Security Operations and Threat Hunting course 🤓🔥💙 Join @eric.zip, @bromiley.io, and @whit.zip for our 4-day training: www.blackhat.com/us-25/traini...