#dogops — Public Fediverse posts

Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering

Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering

Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering

Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering

Took Ada for a walk and pondered.

When I write detections, I start by thinking about low-level primitives and then worry about the varied motivations later. I ❤️ ATT&CK, but it seems inefficient that when we find a new adversary capability we don't map all the places it can be misused immediately. A good set of detections for OS Credential Dumping should also be capable of immediately flagging DRAM Collection also.

To that end, if you're a detection engineer, start by working out which data sources matter on which systems (and make sure you're collecting them) rather than get too het up by specific (sub-)techniques.

#dogops, #detection, #engineering

Sunset with Ada.

#dogops, #dogsofmastodon

Sunset with Ada.

#dogops, #dogsofmastodon

Sunset with Ada.

#dogops, #dogsofmastodon

Sunset with Ada.

#dogops, #dogsofmastodon

Sunset with Ada.

#dogops, #dogsofmastodon

Less noise, more signal version of https://twitter.com/timb_machine. #socialist & #antifascist.

#ATT&CK, #purpleteam, #blueteam, #threatmodelling, #Cisco, #redteam, #EMFCamp, #uncon, #kde, #OpenVAS, #Portcullis, #Perl, #Debian, #Indymedia, #AS28792, #Solaris, #RISCOS adjacent security researcher.

Also, #brentfordfc, #dogops, #microfiction fan.

Less noise, more signal version of https://twitter.com/timb_machine. #socialist & #antifascist.

#ATT&CK, #purpleteam, #blueteam, #threatmodelling, #Cisco, #redteam, #EMFCamp, #uncon, #kde, #OpenVAS, #Portcullis, #Perl, #Debian, #Indymedia, #AS28792, #Solaris, #RISCOS adjacent security researcher.

Also, #brentfordfc, #dogops, #microfiction fan.

Less noise, more signal version of https://twitter.com/timb_machine. #socialist & #antifascist.

#ATT&CK, #purpleteam, #blueteam, #threatmodelling, #Cisco, #redteam, #EMFCamp, #uncon, #kde, #OpenVAS, #Portcullis, #Perl, #Debian, #Indymedia, #AS28792, #Solaris, #RISCOS adjacent security researcher.

Also, #brentfordfc, #dogops, #microfiction fan.

Less noise, more signal version of https://twitter.com/timb_machine. #socialist & #antifascist.

#ATT&CK, #purpleteam, #blueteam, #threatmodelling, #Cisco, #redteam, #EMFCamp, #uncon, #kde, #OpenVAS, #Portcullis, #Perl, #Debian, #Indymedia, #AS28792, #Solaris, #RISCOS adjacent security researcher.

Also, #brentfordfc, #dogops, #microfiction fan.

Less noise, more signal version of https://twitter.com/timb_machine. #socialist & #antifascist.

#ATT&CK, #purpleteam, #blueteam, #threatmodelling, #Cisco, #redteam, #EMFCamp, #uncon, #kde, #OpenVAS, #Portcullis, #Perl, #Debian, #Indymedia, #AS28792, #Solaris, #RISCOS adjacent security researcher.

Also, #brentfordfc, #dogops, #microfiction fan.