@shellcromancer Profile picture

Daniel Stinson

@shellcromancer

Threat Detection & Response @ Brex, xCloudflare. Hobbyist reverse engineer of things. Dogs are clearly better than people.

Similar User
Chris Beckett photo

@cbecks_2

Silas Cutler (p1nk) photo

@silascutler

Stairwell photo

@InsideStairwell

Greg Lesnewich photo

@greglesnewich

ACE Responder photo

@ACEResponder

Tony Lambert photo

@ForensicITGuy

Zack Allen photo

@techyteachme

Chuong Dong photo

@cPeterr

Bryce photo

@bryceabdo

J⩜⃝mie 🔜 CWC 🪖⌨️ photo

@jamieantisocial

Ramin Nafisi photo

@MalwareRE

avallach (@xorhex@infosec.exchange) photo

@xorhex

John photo

@BitsOfBinary

The Vertex Project photo

@vtxproject

AmitaiBs3 photo

@AmitaiBs3

Pinned

Check out audit-logs.tax - we want to crowdsource a list of vendors who don't prioritize high quality, widely available audit logs. We started with a list of apps we're focused on but happy to take issues/PRs for logs you're focused on: github.com/shellcromancer…

🧵 Have you ever been trying to ingest audit logs as a security engineer and been frustrated by the quality and cost of the logs? Well so were @shellcromancer and I, so here's an attempt to get them to prioritize the security engineer as a core customer: audit-logs.tax



Daniel Stinson Reposted

Today @RunReveal is announcing support for sigma detections and open sourcing our sigma rule evaluator, sigmalite. Read the blog, and check out the code! sigmalite.dev blog.runreveal.com/introducing-si…


Pretty 🔥 how Sigma v2 has a modifier for base64 now 👏 blog.sigmahq.io/introducing-si…

YARA has had obfuscation modifier like xor since 2018, and base64 in 2020 — 6 years later why don’t SIEMs or intermediate detection languages like Sigma support these??? It keeps detection logic more resilient to adversary changes and readable 🤔 github.com/VirusTotal/yar…



Daniel Stinson Reposted

my first blog post since starting at @HuntressLabs just dropped! 🔥 @stuartjash and I take a look at the recently discovered macOS #LightSpy variant and highlight some of the major differences between it and the iOS version!🍎 huntress.com/blog/lightspy-…


You asked, they delivered. MITRE ATT&CK has AI now! 🤣 attack.mitre.org/techniques/T15…


Great distinction on how the industry should look at threat actors like Sandworm/APT44 (🪱) , absolute🔥🧵 and report!

YARA has had obfuscation modifier like xor since 2018, and base64 in 2020 — 6 years later why don’t SIEMs or intermediate detection languages like Sigma support these??? It keeps detection logic more resilient to adversary changes and readable 🤔 github.com/VirusTotal/yar…



Daniel Stinson Reposted

#100DaysofYARA Final post on the challenge for this year, just wanted to share the awesome swag that I received today courtesy of @greglesnewich It was an absolute pleasure participating along side others 🐧 Catch you all next year, until then, stay frosty...

Tweet Image 1

Daniel Stinson Reposted

#100DaysofYARA I think this challenge was a huge success... Kudos to @greglesnewich for creating such an awesome initiative, @fr0gger_ for building YARA toolkit which was super handy, @stvemillertime for the motivation 🐧 I also wrote a Blog on it ⬇️ rustynoob-619.github.io/100-Days-of-YA…

Tweet Image 1

Daniel Stinson Reposted

#100DaysofYARA it’s the home stretch and we’ve got 3 participants charging towards the finish! @de3ev @RustyNoob619 @petermstewart Show them some love for taking this challenge head on and having the boldness to showcase their YARA journey in public!


Loading...

Something went wrong.


Something went wrong.