Physical copy arrived and the print work is amazing @lcamtuf@infosec.exchange
Remote
Taylor Parizo
@taylorparizo@infosec.exchange
mastodon 4.8.0-alpha.3+glitchThreat Hunting and former Threat Intelligence | “Doubt is not a pleasant state, but certainty is a ridiculous one” - Voltaire
464 Followers
238 Following
40 Posts
Joined November 08, 2022
This might be the first vacation in a long time that I really avoided any cyber-related news. It helps when I was without service most of the week a national park. All I know is I'm glad my Mikrotik product doesn't run RouterOS.
The nightmare resumes tomorrow.
New rack arrived today. The audio setup is finally complete.
We got a little excited at the nursery. There’s spinach, bell pepper, jalepeno, cayenne, Carolina reaper, cinnamon basil, tomatoes and tomatillos. Cilantro is in its own pot because we ran out of space. #gardening
Starts a honeypot
Immediate ../
MOIST KEYCHAIN!? We cannot be serious 😂
In early February 2026, the Iranian state-aligned cyber espionage group MuddyWater (also tracked as Seedworm, MERCURY, Static Kitten, MOIST KEYCHAIN, and Mango Sandstorm)
https://krypt3ia.wordpress.com/2026/03/20/threat-intelligence-report-mango-sandstorm-indoor-fakeset-activity/
#ThreatIntel
@cR0w@infosec.exchange Or when the vendor feeds push any reference of an RFC1918 address into an indicator list. Yeah lemme enrich 192.168.2.134, see if any adversaries are using that IP and block it. I sure hope it doesn't appear in our logs or we're cooked 🙃🙃🙃
Looking for obfuscated IP-KVMs in your environment? Check for devices communicating with 178.62.55.152 (files.pikvm.org). It acts as a "phone home" website on DigitalOcean for PiKVM.
I've been habitually taking my camera with me when I go out so I take more photos. I thought I'd take more at the museum over the weekend but only ended up taking one. Not even mad because this is one of the more creative ones in a long time. Inside looking out a window so I metered the window light rather than the average room light.
#Fujifilm
I used to take apart electronics when I was very young mainly because it was cool to see what was inside these common electronics around the house. Kind of wish I stuck with that curiosity because lately I've been interested in hardware hacking and I realized I'm revisiting past interests from 15+ years ago. This post was very interesting to see what tools exist today but I was curious if anyone has their own recommended list? Anyone else do this as a hobby or career?
#HardwareHacking #IoT
https://www.redfoxsec.com/blog/getting-started-with-hardware-hacking
Nice list. Some tools have a lot of feature overlap which make enrichment much easier. I’m in Censys, Validin, and Hunt.io (didn’t see mentioned) almost daily. I need to familiarize myself with using BGP tables more though.
https://github.com/curated-intel/Attribution-to-IP
Someday I'll learn how to use a computer. Fought network issues for an hour until I rage quit and restarted the server. That was it. A restart literally fixed it.
Internet is down so it’s a perfect time to make use of my record collection
My ideal employer should learn how to accurately list a job posting.
I installed Rayhunter when it was first released. At the time, it seemed like a capture tool without a way to truly decipher captured traffic, especially if it "found something." Has the project gotten more user friendly with better heuristics? I see there are some but still leaves a lot of uncertainty.
https://cybernews.com/privacy/us-police-israeli-spy-vans-falconet-cognyte/
#spyware #surveillance
We got a Telnet vulnerability older than some GTA 6 developers.
A reminder to use google ads transparency center for a quick pivot on some phishing domains.
#phishing #clickfix #ThreatIntel
https://sakshamanand.com/blog/clickfix-google-ads-discovery/
Replying to
I went with fluent bit. Not a fan of having to write a custom XML parser for Windows events but Linux and Zeek logs were simple enough.
https://docs.fluentbit.io/manual #opensearch #ThreatHunting
Replying to
This has been a fun guide to learn from. Good information without getting too in-depth.
https://beej.us/guide/bgc/html/split/pointers.html
Replying to
I took the idea a step further and contracted some work to run Ethernet through the home. Primary ISP coax line used to run straight into my office from outside. Now it’s routed to the basement where the rack lives and Ethernet is terminated to the patch panel. Still need to get that Sliger chassis though but my wallet needs to heal first… #homelab
This just sounds like a Nuclei vuln scanner with extra steps ✨but make it AI so the industry freaks out✨
https://www.utoronto.ca/news/u-t-researchers-demonstrate-ai-worm-could-target-any-online-device
Time for coffee (decaf)
Might be time to sell my 32Gb of RAM for a network switch. #FCC
@cR0w@infosec.exchange Oh for sure I don't think you can vibe code any of this with an ounce of reproducibility. I don't have Cursor to test these prompts so I'm curious how close some of these claims even get.
New post where I explore Zeek, Arkime and JA4+.
#ThreatHunting
https://blog.axelarator.net/we-have-packet-capture-at-home/
Replying to
@apth Do something with it. We can send links all day but before pressing send, ask why you’re doing it, what you expect out of it, and share your own thought about it. In the large enterprise, “is this relevant to our org or customer?”, “what can we do with the Intel provided?” That’s the simple part. What’s not so easy is how to convey Intel to teams in a manner that makes sense and isn’t just another talking point to gloss over. This article was recently posted which provides a real example.
https://feedly.com/ti-essentials/posts/how-to-fuse-cti-with-threat-hunting
Replying to
One more for good measure because why not:
host.services.cert.parsed.issuer_dn="cgWUqATNuKVKop+/nRG88+u7AEo2ulPc/6DzDNJyq3Q"
#ThreatIntel #CTI #MuddyWater
I’ve gone down the hyprland rabbit hole. Doomscrolling has been replaced by modifying config files.
#Hyprland
Replying to
@apth work. Although I’ve dealt with Intel platforms that are more information panels than they are functional
Replying to
The second html_title query has been updated to:
host.services.endpoints.http.html_title={"McCluskey", "MotoGP Fans Deutschland"}
I'm not pirating, I'm training a local model on my Plex library
So happy to not only see GW3 is happening after 14 years since GW2 released but they also aren't killing any prior live services and will continue to update GW2 even after 3 releases. I created a new character in GW2 last night and bought the first 4 DLCs. I logged countless hours in this game a decade ago and this announcement brought me back.
https://www.guildwars2.com/en/news/future-of-the-guild-wars-franchise/
