mastodon 4.8.0-alpha.3+glitch#Infosec, #CTI, and #ICS & Critical Infra Things
https://pylos.co
Also be on the alert for posts on heavy metal, sports ball (or black, cylindrical rubber object game 🏒), and various #shitposting.
Main job: analyzing the threats and doing the #CTI at Dataminr
Sidejob: #CTI and #ICS/#OT training and consulting through Paralus LLC (https://paralus.co)
Happy participant in TootFinder #tfr
Rare ITW Energetic|BerserkBear (Dragonfly/CrouchingYeti/Iron Liberty/Ghost Blizzard/Bromine) sighting
I FOUND WHERE THEY KEEP THE FURSONAS!!!
Thoughts on the meaning and implications of Mythos and Project Glasswing, what these mean for #informationsecurity, where these items are "right," and where they need to be pushed further for purposes of both security and safety:
https://pylos.co/2026/04/11/myth-mythos-where-do-we-go-from-here/
If you missed my #FIRSTCTI26 presentation on evaluating #CTI & threat intel at speed, a related blog is now available for review of the same concepts and argument:
https://www.dataminr.com/resources/blog/orienting-intelligence-for-real-time-alerting-response/
We're getting into "silly season" at the end of the year. With that in mind, I've thought about the things I did in 2022 that I found most interesting, helpful, or potentially impactful.
First, there's the paper on #CTI-driven #ThreatHunting I wrote and presented on at several events:
https://www.gigamon.com/content/dam/resource-library/english/white-paper/wp-intelligence-driven-threat-hunting-methodology.pdf
Then, there was my @VirusBulletin@infosec.exchange paper on the #XENOTIME actor responsible for the #Triton event, which I thought was neat as a deep-dive into organizational relationships that get masked in our tracking a single "adversary:"
https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Zeroing-in-on-XENOTIME-analysis-of-the-entities-responsible-for-the-Triton-event.pdf
On a personal front, I wrote up some prelimianry analysis on the #Industroyer2 attempted (?) #ICS #OT incident as part of the conflict in #Ukraine - and there are still some items raised there for which we don't have answers several months after the incident was discovered:
https://pylos.co/2022/04/23/industroyer2-in-perspective/
Finally, I wrote a blog for my employer diving into the idea of the #FalsePositive in #DetectionEngineering and #SecurityMonitoring that I think is helpful for analysts from #IR to the #SOC
https://blog.gigamon.com/2022/08/05/revisiting-the-idea-of-the-false-positive/
I need to think this over a bit, but look for something covering the most insightful work of others, from my perspective, from the past year!