@sherrod_im what are the assumptions in that model?
| Keybase | https://keybase.io/3141592f |
| https://twitter.com/3141592f | |
| LI | https://www.linkedin.com/in/3141592f/ |
Jason Craig
- 186 Followers
- 247 Following
- 77 Posts
full spectrum middle manager @ UmVtaXRseQ== .ex red team, blue team @ Pinterest, Dropbox , Facebook, Yahoo!, etc⚡️⚔️🛡🗝🤫
@riskybusiness Okta is lacking many controls that MS has as an IDP/SSO., independent the apps question.
I look forward to the snake oilers episode!
@riskybusiness you should redo today’s conversation with Ryan Kalember but talk about Okta instead of MS.
@alex I mean he does have a good staff for these topics.
@ckure 
i'm not sure i'd like to live forever hence all my retirement planning models assume i die at some future date.
Lunchtime threat hunt: map recent MS/Storm-0558 detections to Google Workpace/GMail. Summary: fail.
CISA noted that a US gov entity detected the incident via analysis of the `MailItemsAccessed` event type: "In Mid-June 2023, an FCEB agency observed MailItemsAccessed events with an unexpected ClientAppID and AppID in M365 Audit Logs." This event type was only available via more expensive E5 logging, which many/most don't pay for). MS changed this today to make available to more customers without paying extra, after pressure.
Maybe I'm missing something but I can't seem to find a Google Workspace equivalent event type in Security Center ( https://support.google.com/a/answer/11482175?sjid=7101640716602908317-NA , Enterprise Plus licensing). Does Google not log these types of events?
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a
This technique of infecting common file types on target networks for reinfection is under appreciated by defenders and under utilized by adversaries. It’s why we prepared so thoroughly for migration of an Aurora victim to a clean network back in 2010.
Thrunting file mods by process other than the default URI handler is a great starting query, especially PowersHell.exe.
"Another interesting aspect of Gamaredon infections is that the threat actors plant as many as 120 malicious infected files per week on the compromised system to increase the likelihood of re-infection."
@schwascore security keys easily wins top spot for me. CrOS is second.
This post brought to you by bitcoin.
https://apnews.com/article/north-korea-kim-icbm-nuclear-802a6a0719460463030c50429d27a087
Kim vows to boost North Korea's nuclear capability after observing new ICBM launch
North Korean leader Kim Jong Un has vowed to bolster his country’s nuclear fighting capabilities as he supervised the second test-flight of a new intercontinental ballistic missile designed to strike the mainland United States. North Korea's state media reported Kim’s comments a day after the launch of the Hwasong-18 missile. Kim was quoted as saying deepening U.S. and South Korean hostilities require "more intense efforts to implement the line of bolstering nuclear war deterrent.” The Hwasong-18 is made for road mobility and has built-in solid propellant, making it more difficult to detect than liquid-fuel models before launch.