DefSecSentinel @DefSecSentinel

Staff Threat Detection Engineer @Chainalysis and 179CPT Cyber Operations Technician 170A @MOARNG Joined April 2017

Tweets

621
Followers

2K
Following

1K
Likes

16K

Jared Wilson @JWilsonSecurity

4 weeks ago

🏈 Calling the infosec community! We had a spot open up to round out Year 4 of the "Secure the Ball" fantasy football league. If you love to talk shop, ball, and trash - join us! ⚠️ There are punishments 🙋🏻‍♂️ DM me for details #infosecfantasyfootball #fantasyfootball

Jared Wilson @JWilsonSecurity

3 years ago

Calling all football fans! I'm thinking of running an infosec fantasy football league. I know it's cutting it close, we would need to draft before Thursday. Is anyone interested? DM me your email if you want in.

9 1 7 13K 0

3 3 4 1K 0

View Details

Objective-See Foundation @objective_see

a month ago

Just announced: talks for #OBTS v9 🥳 Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more! Check out the full lineup: objectivebythesea.org/v9/talks.html Which one(s) are you most looking forward to!? 🤔

3 16 53 25K 12

View Details

Ruben Groenewoud @RFGroenewoud

2 months ago

Elastic Defend 9.5.0 now carries the taint state on Linux kernel module loading events. I loaded Singularity (the stealthiest open source rootkit I know). On load, it hides from lsmod, /proc/modules, and /sys/module, resets the kernel taint mask to 0, and filters "taint" and its own name out of dmesg, journalctl -k, and klogctl. Even though the system looked clean, detecting the tainted flag on the loading event already exposed it. What is even more suspicious? The endpoint recorded this module loading out-of-tree and unsigned. The live host says the mask is 0, and taint is sticky by design, so that needs explaining and is a good hunting reference. One caveat, because this is not a rule to switch on blind: OE is also what a DKMS build, an out-of-tree GPU driver, or a third-party filesystem module produces. Baseline the modules you load on purpose, then investigate what is left. Enforcing module signatures shrinks it further, since an unsigned module then fails to load. Rule PR and references in the reply. #Linux #DetectionEngineering #ThreatDetection #DFIR #Rootkits

4 8 42 3K 11

View Details

Ruben Groenewoud @RFGroenewoud

3 months ago

Seen in the wild in REF6138. Full teardown, including the kernel-process masquerade and the detections: elastic.co/security-labs/… Rules that fire: • Executable Masquerading as Kernel Process: github.com/elastic/detect… • Process Masquerading as Kernel Process (Defend): github.com/elastic/protec… • Network Activity Detected via Kworker: github.com/elastic/detect…

0 3 6 513 2

View Details

Terrance DeJesus @_xDeJesus

4 months ago

@SBousseaden and I did some investigations into Tycoon 2FA recently. Focused on the infrastructure, how the kit works for not only M365, but Google Workspace as well. Made a few detections for each platform. Give it a read. Hope you enjoy. #phishing #threatdetection Happy Hunting! elastic.co/security-labs/…

1 7 23 5K 18

View Details

Samir @SBousseaden

4 months ago

MiniPlasma LPE exploit works perftectly. Elastic Defend behavior protection catches the exploit primitives involved in the chain, providing detection coverage even against fresh public exploit. github.com/Nightmare-Ecli…

2 43 207 15K 96

View Details

Ruben Groenewoud @RFGroenewoud

5 months ago

We just posted some additional detection guidance for #CopyFail and #DirtyFrag using EQL, ES|QL and Auditd detection rules/hunts + mitigations. Find them below! elastic.co/security-labs/…

Ruben Groenewoud @RFGroenewoud

5 months ago

New DirtyFrag PoC is also detected by our previously released Linux privilege escalation detection👀 That’s the advantage of focusing on the underlying privilege escalation pattern instead of a single exploit. You can find the rule here: github.com/elastic/detect…

0 13 59 13K 44

0 7 37 4K 27

View Details

Samir @SBousseaden

5 months ago

Detection guidance for CopyFail (CVE-2026-31431) and DirtyFrag (ITW Linux page cache LPE): EQL, ES|QL, and auditd detection rules and hunts included: elastic.co/security-labs/…

0 22 100 7K 57

View Details

DefSecSentinel @DefSecSentinel

5 months ago

Yesterday was my last day at @elastic. It was an incredible run. I’m grateful for the opportunity I was given to help build Elastic’s #macOS endpoint agent and endpoint/SIEM detections from the ground up, work that delivered real impact for customers and made life harder for the adversaries. It was truly an honor to work alongside so many talented people, and I’m very proud of everything we built together. Wishing Elastic and everyone there nothing but the best. I’ll be looking for my next adventure soon. Stay tuned!

4 3 52 3K 8

View Details

Samir @SBousseaden

5 months ago

good to see EXISTING Elastic generic privesc behavior detection/protection triggering on the RedSun LPE exploit with no prior knowledge of the vuln-details. github.com/elastic/protec…

Samir @SBousseaden

3 years ago

New blog post is up, exploring detection options for some recent In- the- Wild Windows LPE 0- days elastic.co/security-labs/…

6 93 291 55K 129

0 5 38 4K 14

View Details

Terrance DeJesus @_xDeJesus

5 months ago

google workspace logs from reports API... here's a simple query (Elastic) to check for the vercel 3rd-party OAuth app auth event: ``` data_stream.dataset: "google_workspace.token" and event.action: "authorize" and google_workspace.token.client\.id: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent\.com ``` from there, the same app ID shows up in a few other GWS fields/datastreams: - token\.app_name -> human-readable app label - drive.originating_app_id: 110671459871 -> every file the app viewed/downloaded/copied (prefix only, it's typically the GCP project number IIRC) - admin.oauth2.application\.id / .name -> admin-side OAuth approvals + domain-wide delegation grants for everything else (gmail, login, meet, chat, calendar, groups, DLP rules) I'd try actor pivot on source.user.\email + a time window around the consent event (reports API can lag up to 3 days, so go wide and check ingestion). good luck hunters! #Vercel #GoogleWorkspace #threathunting

0 5 12 2K 3

View Details

Elastic Security Labs @elasticseclabs

5 months ago

Attackers in containers don't leave persistent artifacts. No files on disk. No post-incident logs. Just short-lived runtime behavior. Traditional detection approaches weren't built for this. Defend for Containers is. @RFGroenewoud published a deep-dive on how D4C captures runtime signals inside containerized Linux workloads, and how to build detection logic on top of it. The key things D4C gives you that you don't get elsewhere: - process.interactive flags hands-on-keyboard activity in production containers — rare and high-signal - Linux capability fields (effective + permitted) let you assess actual exploit potential, not just process names - Every event enriched with pod name, namespace, cluster, and privilege context - Policy wildcards let you scope detections to specific images, namespaces, or directory trees go.es.io/48sPCtC

0 10 36 3K 17

View Details

DefSecSentinel @DefSecSentinel

5 months ago

You are going to want to check out this awesome new research write-up from the team. Very interesting and somewhat creative initial access method. Includes a @macos piece as well. Shout out to @soolidsnakee, @SBousseaden and team working hard to get this out.

Elastic Security Labs @elasticseclabs

5 months ago

3 42 115 15K 58

0 1 9 655 1

View Details

SolidSnake @soolidsnakee

5 months ago

New #research together with @SBousseaden and @DanielStepanic at @elasticseclabs. We uncovered a campaign abusing Obsidian plugins and vault feature to deliver multi-platform payloads targeting both #Windows and #macOS. The final stage is #PHANTOMPULSE, an AI-built RAT that resolves its #C2 from Ethereum blockchain transactions and its loader #PHANTOMPULL A deep dive into the RAT internals is coming next. Stay tuned. elastic.co/security-labs/…

1 14 47 8K 19

View Details

Elastic Security Labs @elasticseclabs

5 months ago

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

3 42 115 15K 58

View Details

KL4R10N (Previously S4T4N) @KL4R10N

5 months ago

Not every “old” GitHub repo is actually old. I break down DPRK-linked repo tradecraft abusing commit-date spoofing to fake legitimacy, while hiding obfuscated loaders in trusted config files. One sample had 100+ stars. Research: kl4r10n.tech/blog/when-git-… Thanks @pcaversaccio for recreating the spoofed commit and helping validate the technique.

0 10 28 2K 12

View Details

Jaron Bradley @jbradley89

6 months ago

It seems possible that clickfix malware is already switching tactics to evade the new Terminal copy/paste security feature in macOS 26.4.

Jamf Threat Labs @JamfThreatLabs

6 months ago

ClickFix techniques are evolving. Instead of copy and paste instructions to Terminal, newer variants are using Script Editor to execute payloads on macOS. Read more about this delivery technique in our latest blog post. jamf.com/blog/clickfix-… #clickfix #malware #threathunting