JBR @_coeus

Security Engineer, building IR tooling joshfrogers.co.uk Joined April 2010

Tweets

232
Followers

279
Following

1K
Likes

2K

hoeem @hooeem

7 months ago

x.com/i/article/2041…

67 255 2K 1.2M 9K

View Details

JBR @_coeus

a month ago

@MattPRD @Meta 🙌

0 0 0 11 0

View Details

JBR @_coeus

2 years ago

@based_hardware 👍

1 0 2 480 0

View Details

Omi AI @omidotme

2 years ago

Introducing Friend. Watch the demo.

110 100 740 1.2M 346

View Details

JBR @_coeus

2 years ago

@binaryz0ne On a budget end - currently running an elite desk 800g3 & truenas. Under £100 from the chassis, then cost of drives

1 0 1 71 0

View Details

Will @BushidoToken

2 years ago

I am excited to introduce a new comprehensive CTI training repository - find it here: blog.bushidotoken.net/2024/06/the-ct… #CTI #threatintel #training

1 83 271 49K 234

View Details

Check out this awesome report by Sophos on Chinese APT threat actors. There is much to learn from this technical breakdown; it's not your ordinary threat actor. Reading this report, you will notice that they used tools like impacket for lateral movement, which provides an opportunity for detection. ➡️Interesting use of Living-Off-the-Land binaries that I personally haven't seen before - instsrv.exe and srvany.exe. ➡️Multiple defense evasion methods to hide their tracks and evade detection, including a clever way to read DNS traffic and block AV/EDR-related domains. (but still uses impacket 🤷‍♂️🤦‍♂️) ➡️Interesting choice of data being staged for exfiltration. Overall, this prolonged intrusion had everything, and the authors did an incredible job of laying out all the details for the rest of the community. 🙏👏 Check it out here 🔗: news.sophos.com/en-us/2024/06/…

4 108 301 33K 218

View Details

JBR @_coeus

2 years ago

Awesome end to the evening at #emfcamp

0 1 3 246 0

View Details

Cado @CadoSecurity

2 years ago

Cado Security is honored to be named in the Gartner® Emerging Tech: Emergence Cycle for Cloud Security as a Sample Vendor for Cloud Forensics Download a free copy of the report here: hubs.li/Q02yBRv50

0 2 5 720 0

View Details

Gerald Auger, Ph.D. @Gerald_Auger

2 years ago

@eric_capuano made a great beginner lab to learn Prefetch Analysis for #DFIR work. I made a simple walkthrough video showing you how to setup the lab and get started, so no need to feel overwhelmed. Get in there and start learning! youtu.be/xvUbJk4wNo8?si…

0 4 12 2K 4

View Details

Alkoholfreiday @Alkoholfreiday

3 years ago

Here we go!!!! #Freiday #giveaway once again!!!! Simply repost for your chance to #win!!! Winner announced at 5pm(ish) today - GOOD LUCK!!!

87 902 372 21K 1

View Details

Whitney Champion 🍪🚀 bluesky @whit.zip @shortxstack

3 years ago

ATTN NERDS 🤓 this week we released our new @limacharlieio plaso extension! 🔥 it will take a forensic artifact from an endpoint, or a zip of artifacts (like a KAPE triage from the @velocidex extension) and make a timeline of the data that can be imported into @TimesketchProj

3 8 32 5K 8

View Details

Traceix @usetraceix

3 years ago

@jonathandata1 Who are you?

6 4 73 4K 0

View Details

JBR @_coeus

3 years ago

@James_M_South 3 body problem on Netflix!

0 0 4 125 0

View Details

Mark Karayan @Mgkarayan

3 years ago

In 2014, @JohnHultquist named a Russian hacking group "Sandworm". Today, Mandiant graduates it to APT44 & reveals the online persona they created, CyberArmyofRussia, disrupted U.S. and Polish water utilities, as well as a dam in France. Full report: services.google.com/fh/files/misc/…

6 31 113 13K 10

View Details

Warhammer Official @warhammer

3 years ago

@Idk721252 Since the first of the Ten Thousand were created, there have always been female Custodians.

4K 1K 9K 4.5M 777

View Details

JBR @_coeus

3 years ago

@svch0st Keen to try out the icedid case!

0 0 0 29 0

View Details

Zach @svch0st

3 years ago

🎁 Today I'm giving away 3 of our DFIR Labs! 🎁 To enter: ✅Follow me ✅RT & Like this post ✅Reply with which case you'd like to take The winners will be selected in 24 hours. #Giveaway

The DFIR Report @TheDFIRReport

3 years ago

🎉 Announcing DFIR Labs! 🎉 Introducing our DFIR Labs based on real intrusions from our public reports and private threat briefs! Whether you're starting out or looking to deepen your skills, our labs can help. 1/2

1 126 482 133K 244

67 85 134 30K 19

View Details

JBR @_coeus

3 years ago

@tazwake I'd lean benign true positive, but I accept that it's not the most ideal detection. As a detection engineer I'd be looking to tweak the detection somewhat to reduce this from firing in this scenario.