@rcegann Profile picture

rcegan

@rcegann

Microsoft Sentinel Practice Lead @ MSSP. Defender, Detection Engineering, Threat Emulation. Blog-haver. Hack the planet.

Similar User
Connected photo

@LucyIsOpal

Joe photo

@trk_rdy

Peter Ngugi photo

@dronethem

Teresa Wilson photo

@TeresaWils23375

J⩜⃝mie 🔜 CWC 🪖⌨️ photo

@jamieantisocial

Polito Inc photo

@politoinc

Shlok Yadav 💙 photo

@lordhorcrux_

Ean Meyer - @eanmeyer.bsky.social photo

@EanMeyer

NEOMED Project ECHO photo

@neomedecho

Alex Phillips photo

@Aphillips1209

Dave photo

@_davewm_

Dr. Cville Cyber photo

@CvilleCyber

simon simonsen photo

@ssimonsen0202

Shepard photo

@ManSh3p

Big🔥 De Patico🧑🏻‍💻 photo

@BigCrazyPorras

rcegan Reposted

I wanted to search for specific keywords or tools mentioned in all the available threat intelligence reports. So I extracted the text from almost 10000 Threat Intelligence reports, including PDFs. I'm preparing an index with a set of predefined searches and their results. Would…

Tweet Image 1

Posted a lil article to detect.fyi about using @elastic's new maturity model for measuring success in your deteng team. Give it a read if you like 🧵 detect.fyi/from-zero-to-e…


rcegan Reposted

From a detection perspective, you can always learn something from opendir. Take this recent opendir, the bash history is exposed... create a quick timeline, can you detect these behaviors with your network and endpoint logs if the tools were used in your environment ?

Tweet Image 1

attack observed! coming from 27.25.151.236 target.txt exposes the targetted site. hxxp://ejt.myjjzd.com urlhaus.abuse.ch/host/27.25.151…

Tweet Image 1
Tweet Image 2
Tweet Image 3
Tweet Image 4


rcegan Reposted

I'll bite

Tweet Image 1

There is an over engineering red team implant analogy somewhere in here

Tweet Image 1
Tweet Image 2


Possibly the handiest menu feature Microsoft added to Sentinel. IYKYK

Tweet Image 1

rcegan Reposted
Tweet Image 1

rcegan Reposted

Detect successful exploitation of CVE-2024-36991 in Splunk

Tweet Image 1

POC for CVE-2024-36991: This exploit will attempt to read Splunk /etc/passwd file. github.com/bigb0x/CVE-202… #exploit #pentest #CyberSecurity

Tweet Image 1


Can anyone point me to some good resources about building out SIEM and specifically log data resiliency + monitoring? Wondering how others tackle monitoring their SIEM data (the data itself, not threat detections) and don't see a ton of discussion on the topic tbh.


I wrote up a new detection engineering blog post on Detect.Fyi about building and structuring a knowledge base that works best for your engineers and your SOC :) Check it out here: medium.com/detect-fyi/the…


rcegan Reposted

Look what has just arrived! 🐙 Giving away one of those to the first 3 authors on the team submitting a story to our Medium publication! 🔥 Not a writer yet? Want your story published? Send me a DM! #DetectionEngineering

Tweet Image 1

Can't say enough good things about #ludus by @badsectorlabs I've used a lot of Cyber Range management tools and none come close to how refined and reliable ludus is. Kudos to the team 👏👏👏


rcegan Reposted

You wouldn’t last an hour in the asylum where they raised me.

Tweet Image 1

Anyone have any up to date books on red team tactics/operations? Particularly anything that gets technical or hands on 😇


Loading...

Something went wrong.


Something went wrong.