Jamie Levy🦉 @gleeda Twitter profile

Last Seen Profiles

@AmyFaulkner2020

@cWGmalYcQ38ZyNa

@kevinrod81

@NidhiTanejaa

@SoVerySweetDiva

@Pine1990

@meerkat_intern

@OladotunRauf

@A_shot_of_Ri

@Krohmatt

@Joubert2024

@EnGraViTY1

@christinestrela

@yotsuba0408

@taylorswetcooch

@bokeplokalmalam

@Alex_Schrier

@MalditaDilsexia

@SukaIbuIbuTua2

@bokeplokalmalam

@AnwarjanMarri

@PartidStef

@alvincrpt

@Luishrnandez

@ToonersWuff

@syd51214

@jandakembangstw

@fatimah_almunif

@iinaifsa

@bokeplokalmalam

@idare

@Cathal_Dennehy

@RTii76gh67TRuTR

@Rudi_Simalaka

@Sherighttt

@no1likeateez

Jamie Levy🦉

@gleeda

5 years

It’s alive!!! #dfir #memoryforensics

GitHub - volatilityfoundation/volatility3: Volatility 3.0 development

Volatility 3.0 development. Contribute to volatilityfoundation/volatility3 development by creating an account on GitHub.

github.com

4

140

270

Jamie Levy🦉

@gleeda

1 year

This is why people stop releasing open source projects: predatory companies ripping off projects and calling them “their own”. At least give an acknowledgment and abide by the license. 🤬🤬🤬 Original:

Matthé Smit on LinkedIn: So excited about this one: Microsoft 365 management in Datto RMM is…

So excited about this one: Microsoft 365 management in Datto RMM is rolling out now! You can now manage all your tenants and Azure AD users from our console…

www.linkedin.com

6

41

138

Jamie Levy🦉

@gleeda

1 year

I'm giving a training on #memoryforensics at @BlueTeamCon on August 25th! Sign up soon if you don't want to miss it! #DFIR #malware

0

20

83

Jamie Levy🦉

@gleeda

3 years

Come take a FREE #dfir #cybersecurity HANDS-ON training with one of the threat researchers at @HuntressLabs next Tuesday!

2

25

81

Jamie Levy🦉

@gleeda

22 days

I can't believe it's been 10 years since we published this. A little piece of trivia: it was written in ~6 months as we were trying to get it done in time for Black Hat. So many edits, reviews, so much blood, sweat and tears... we didn't get rich, but ooh was it worth it.

volatility

@volatility

22 days

1/ To celebrate the 10th anniversary of The #ArtOfMemoryForensics , we are giving away 1 seat at the upcoming in-person Malware & Memory Forensics Training on #Volatility3 with a pass to From The Source #FTSCon ! Just post a pic of your book & tag @volatility !

5

17

52

8

9

79

Jamie Levy🦉

@gleeda

8 months

I’m looking to hire a Principal Threat Intelligence Analyst here at @HuntressLabs . You’ll get to build a new program focused on the small business space (those that fall below the cybersecurity poverty line). Please feel free to reach out to me if you have questions or think

1

38

74

Jamie Levy🦉

@gleeda

6 years

I'm releasing an updated version of memtriage today. It has the newest winpmem drivers and yarascan added: #DFIR

Release v0.2-alpha Release · gleeda/memtriage

Adding new Winpmem drivers Adding yarascan plugin Some minor code fixes

github.com

1

45

69

Jamie Levy🦉

@gleeda

1 year

I am happy to announce that I will be giving a training at @defcon this summer on Windows Memory Forensics! #dfir #memoryforensics

DEF CON

@defcon

1 year

#defcontraining Las Vegas Spotlight Join @gleeda for "Windows Memory Forensics" for info and registration From the abstract: "This class demonstrates the importance of including Volatile memory in your investigations by covering several attack

3

8

38

2

10

63

Jamie Levy🦉

@gleeda

3 years

We recently had an investigation that involved #babyshark malware which was targeted against members of a national security think tank: #DFIR #malware #infosec cc: @HuntressLabs @_JohnHammond @DaveKleinatland @calebjstewart @MaxRogers5

4

14

61

Jamie Levy🦉

@gleeda

2 years

We're looking for an Incident Responder to join our R&D team here at @HuntressLabs Please feel free to reach out to me if you're interested! DMs are open #DFIR #malware #infosecjobs #memoryanalysis

1

27

58

Jamie Levy🦉

@gleeda

2 months

Wait… WAT? 🤣😂

17

4

51

Jamie Levy🦉

@gleeda

2 years

Don't miss today's #TradecraftTuesday with @Purp1eW0lf and @MaxRogers5 Today's topic is: Quick Forensics for the Lazy Investigator. Don't miss it! #DFIR #malware #infosec @HuntressLabs

Tradecraft Tuesday | Huntress

Join us for monthly hacking demonstrations, malware analysis, cybersecurity headlines and more. View previous episodes and register for future sessions.

www.huntress.com

6

18

46

Jamie Levy🦉

@gleeda

3 months

So here’s a genuine question to those of you who actually run detective engineering teams: What do you consider as good inputs to that team? We could consider these as tickets, but what should those tickets contain? There seems to be a question of whether or not things should

20

8

45

Jamie Levy🦉

@gleeda

1 year

What we currently know about the #MOVEit Transfer Critical #Vulnerability Great work by @_JohnHammond @nosecurething @Purp1eW0lf @jfslowik Anthony Smith, Sharon Martin and others here at @HuntressLabs #DFIR #ThreatIntel

MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response | Huntress

Our team is tracking in-the-wild exploitation of a zero-day vulnerability against Progress' MOVEit Transfer web application that allows for escalated privileges and unauthorized access.

www.huntress.com

1

13

44

Jamie Levy🦉

@gleeda

6 years

The initial release of Memtriage can be found here: #DFIR Note that you should test it out before deploying it in your environment.

GitHub - gleeda/memtriage: Allows you to quickly query a Windows machine for RAM artifacts

Allows you to quickly query a Windows machine for RAM artifacts - gleeda/memtriage

github.com

2

33

44

Jamie Levy🦉

@gleeda

2 years

Getting ready for tomorrow @attrc and I are teaching our Tactical #DFIR class starting tomorrow @BlackHatEvents !! See you tomorrow! #malware #memoryforensics

1

7

44

Jamie Levy🦉

@gleeda

8 years

ever have a pcap and wondered what an attacker has done over RDP ? this should help: #DFIR

GitHub - ctxis/RDP-Replay: Replay RDP traffic from PCAP

Replay RDP traffic from PCAP. Contribute to ctxis/RDP-Replay development by creating an account on GitHub.

github.com

0

38

45

Jamie Levy🦉

@gleeda

4 months

@lizgallo @moorehn The whole “ask for forgiveness” mentality ☹️

0

45

Jamie Levy🦉

@gleeda

2 years

Out of curiosity, for those of you who do Threat Hunting, how many "hunts" do you conduct a week / month / quarter? What's a good cadence? #DFIR #malware #ThreatHunting

11

9

43

Jamie Levy🦉

@gleeda

2 years

Do you like hunting for active threats? We currently have a Threat Hunting role open here at @HuntressLabs ! Join the R&D team and work with talented people like @_JohnHammond @calebjstewart @DaveKleinatland and @GregAke #DFIR #malware #ThreatHunting

0

12

42

Jamie Levy🦉

@gleeda

9 years

there is more to come: #DFIR

5

28

36

Jamie Levy🦉

@gleeda

6 months

@jamieantisocial * When the job becomes boring * when you’re not listen to * when you’re doing something you no longer enjoy *when there’s a better opportunity for more growth elsewhere *when your career path is limited *when the culture has changed beyond what was tolerable * when the company

2

36

Jamie Levy🦉

@gleeda

1 month

I can’t believe we are at 400 people now (and continuing to grow!)!! 😮😮😮 @HuntressLabs 💙

0

2

36

Jamie Levy🦉

@gleeda

1 year

A nice sum up of Everything We Know About CVE-2023-23397 by @_JohnHammond from @HuntressLabs #DFIR #CVE #outlook #0day #vulnerability #vulnresearch #SIGMA #detectionengineering #threathunting

Everything We Know About CVE-2023-23397 | Huntress

Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.

www.huntress.com

0

16

35

Jamie Levy🦉

@gleeda

10 years

this blog is awesome: Of Filesystems and Other Demons: http://t.co/IkO3BsWu7f #DFIR #memoryforensics #malware

1

20

35

Jamie Levy🦉

@gleeda

2 years

Awesome work @_JohnHammond @DaveKleinatland @KyleHanslovan @GregAke Matthew Brennan et al!! I’m so proud to work with you guys ❤️ #dfir #malware

0

7

33

Jamie Levy🦉

@gleeda

6 years

@IanColdwater Rare that you will get an answer on this though

3

0

32

Jamie Levy🦉

@gleeda

1 year

There are various slack channels, discord channels, chats etc for topics on #dfir / #CyberSecurity but do we have something like that dedicated for leadership topics in these fields? How to build and maintain teams, KPIs, etc? Would that be worthwhile, or not?

7

4

33

Jamie Levy🦉

@gleeda

2 years

I'll be giving a talk next week over my journey into #DFIR and give some tips to help others find their way into this space! #memoryforensics #malware #infosec #infosecurity

Women in CyberSecurity (WiCyS)

@WiCySorg

2 years

The journey into Cybersecurity is not one-size-fits-all but can vary from person to person. In this webinar with @HuntressLabs , Jamie Levy will cover how she found her way into this field and give tips for choosing the right path for you. #WiCyS

1

13

28

1

11

32

Jamie Levy🦉

@gleeda

1 year

. @_JohnHammond spilling the beans on the qakbot “vaccine” we used to prevent the spread of qakbot in our customer base: #dfir #malware #qakbot #edr #mdr

Qakbot Malware Takedown and Defending Forward | Huntress

With the FBI's takedown of Qakbot malware, we're sharing how the Huntress team developed our own Qakbot vaccine and our commitment to defend forward.

www.huntress.com

1

14

30

Jamie Levy🦉

@gleeda

2 years

I’ve been listening to @MagnetForensics podcast DF IRL (Digital Forensics in Real Life) lately. So far it’s been absolutely fabulous. Love hearing the details of various cases #dfir

1

3

30

Jamie Levy🦉

@gleeda

2 years

Linux is also getting some love ❤️

1

3

28

Jamie Levy🦉

@gleeda

3 months

@vxunderground @LinusTech “Does it bother you that it’s just like here and that someone could do something with it?” 🤣⁉️ what does he think is going to happen? 🤣

4

0

29

Jamie Levy🦉

@gleeda

2 years

This was a wild ride! Can't wait to see the detailed breakdown by @_JohnHammond and @calebjstewart next week! cc @HuntressLabs #DFIR #vulnerability #RCE

Kyle Hanslovan

@KyleHanslovan

2 years

Whelp, wasn’t expecting this ConnectWise RCE to become public today. Guess we’ll publish on Monday how @HuntressLabs went from a researcher’s tweet to the ability to push ransomware through ~5,000 R1Soft servers that are exposed on Shodan. #staytuned

10

117

348

0

2

29

Jamie Levy🦉

@gleeda

8 years

I love working in #dfir and helping out fellow investigators

0

19

28

Jamie Levy🦉

@gleeda

3 years

The #OSDFCon agenda is now out! I'll be giving a talk on #MemoryForensics at this free #DFIR virtual conference on December 1st :-D Don't forget to register! #infosec #volatility #malwareanalysis #malware #memoryanalysis

2021 Agenda - OSDFCon

www.osdfcon.org

1

15

29

Jamie Levy🦉

@gleeda

10 years

First @volatility community blogpost of the year: Hunting and Decrypting Communications of Gh0st RAT in Memory http://t.co/BEzNQwlTAa #DFIR

0

32

29

Jamie Levy🦉

@gleeda

7 months

@bbaskin LOL have you taken a look at it to see what it was? 🤣🤣

1

0

26

Jamie Levy🦉

@gleeda

1 year

Another great blogpost on #ThreatHunting for Business Email Compromise Through User Agents written up by @Purp1eW0lf here at @HuntressLabs #DFIR #BEC #M365 #Microsoft365 #CTI

Threat Hunting for Business Email Compromise Through User Agents | Huntress

Can we use anomalous user agents to detect potential business email compromise (BEC) in Microsoft 365? Explore what we found through threat hunting for BEC.

www.huntress.com

0

6

27

Jamie Levy🦉

@gleeda

1 year

We've already started finding interesting incidents for our customers on @HuntressLabs MDR for Microsoft 365 Have a look at 3 such cases: #DFIR #m365 #microsoft365 #BEC

One MSP, Three Microsoft 365 Compromises, 72 Hours | Huntress

Discover how Huntress MDR for Microsoft 365 identified three business email compromise (BEC) attacks within 72 hours of each other.

www.huntress.com

0

12

26

Jamie Levy🦉

@gleeda

1 year

this is so true! People don't realize how beaten down you can get, how you start to believe that you deserve to be treated poorly. You probably will never truly understand unless you've experienced it yourself.

Natalia Antonova 🇺🇸🇺🇦

@NataliaAntonova

1 year

“Why do you talk about domestic abuse, how embarrassing, no one needs to know this stuff.” Nah. Because here’s the thing: When it was happening to me I had no idea that I didn’t deserve it, that no one deserves it, and that it’s possible to walk away and rebuild your life.

14

33

318

2

3

26

Jamie Levy🦉

@gleeda

1 month

It’s been a little while since I’ve gone around the island, but it was great to get the chance to do it again with great people! @HuntressLabs

0

1

26

Jamie Levy🦉

@gleeda

2 years

As usual, the 30 page whitepaper does not disappoint! Great job @attrc @nolaforensix et al! New Memory Forensics Techniques to Defeat Device Monitoring Malware: #DFIR #memoryforensics @volatility

0

13

26

Jamie Levy🦉

@gleeda

8 years

a new version of Forensic Acquisition Utilities (FAU) has been released, which includes a new SignTool #DFIR

0

26

25

Jamie Levy🦉

@gleeda

7 years

Setting up for our largest @BlackHatEvents training so far @attrc #dfir

1

5

25

Jamie Levy🦉

@gleeda

4 years

Come participate in the @tanium CTF and Threat Response Workshop, online this Saturday (June 6th)! Also I'll be giving a talk on Memory Forensics! #DFIR #infosec #memoryforensics

1

14

25

Jamie Levy🦉

@gleeda

8 years

BTW, If you're ever looking for a good CTF platform, this is very easy to setup and use:

1

12

24

Jamie Levy🦉

@gleeda

2 months

could this finally be the year of the Linux laptop? 😅

4

1

24

Jamie Levy🦉

@gleeda

2 years

There’s still a line outside the door and people are still filtering in due to a traffic jam after the keynote, but @attrc ‘s talk has just started

2

4

24

Jamie Levy🦉

@gleeda

2 years

We’re currently looking to hire someone with Windows Internals knowledge and golang development experience here at @HuntressLabs . Feel free to reach out to me for any questions regarding the position! #dfir #malware #golang #windows #edr

1

8

24

Jamie Levy🦉

@gleeda

1 year

This is what we currently know about the #3cx compromise. Awesome job @_JohnHammond @embee_research @GregAke and team at @HuntressLabs ! #DFIR #malware #3CXpocalypse #supplychain #voip

3CX VoIP Software Compromise & Supply Chain Threats | Huntress

The 3CX VoIP Desktop Application has been compromised to deliver malware via legitimate 3CX updates. Huntress has been investigating this incident and working to validate and assess the current...

www.huntress.com

0

8

23

Jamie Levy🦉

@gleeda

2 years

Awesome work by @jfslowik and @nosecurething at @HuntressLabs digging into a recent incident involving the recent GoAnywhereMFT exploit! #dfir #malware #exploit #infosec #threatintel

Investigating Intrusions From Intriguing Exploits | Huntress

On 02 February 2023, an alert triggered in a Huntress-protected environment. We dive into triaging the threat in this blog.

www.huntress.com

0

10

23

Jamie Levy🦉

@gleeda

2 months

So much to unpack here…. I’ll have to come back to it later, but I disagree with a lot of it. Especially this part, as if it’s a silver bullet: “Look into goat farming instead.” I do both, and they are BOTH a shit ton of work. Bottom line is: if you aren’t willing to put in

C:\hristina

@divinetechygirl

2 months

While it may not be a popular perspective, this author is absolutely right about the reality of a career in cybersecurity- information security. Spot on.

45

97

502

6

0

22

Jamie Levy🦉

@gleeda

1 year

. @Huntresslabs researchers have fully recreated the abused #MOVEit exploit and it turns out, the #payload possibilities aren't limited to web shells. Watch @_JohnHammond demo the vulnerability and add a #ransomware payload demonstration. #dfir #cl0p

MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response | Huntress

Our team is tracking in-the-wild exploitation of a zero-day vulnerability against Progress' MOVEit Transfer web application that allows for escalated privileges and unauthorized access.

www.huntress.com

1

6

23

Jamie Levy🦉

@gleeda

3 months

This is a huge milestone! We're celebrating our Series D funding at @HuntressLabs 📷🥳🎉 We'll continue crushing more bad guys, and empowering essential businesses. Huge thanks to everyone who got us here: our customers, partners, investors, and the legendary badasses at

3

2

23

Jamie Levy🦉

@gleeda

9 years

quick and dirty bash script for using fresponse from a linux machine feel free to expand #DFIR

2

10

22

Jamie Levy🦉

@gleeda

5 years

There's going to be so much @volatility at #OSDFCon this year- including my workshop! #DFIR #memoryanalysis 🥳🥳

volatility

@volatility

5 years

We are honored that so many of you voted for our presentation in the #OSDFCon 2019 Survey. We can now officially tell you that we will be presenting "Volatility 3 Public Beta: The Insider’s Preview" -- more details to follow! #dfir #memoryforensics

5

72

142

0

6

23

Jamie Levy🦉

@gleeda

21 days

this is seriously messed up. @Apple should do better! a thread 🧵

Cory Doctorow NONCONSENSUAL BLUE TICK (AFK)

@doctorow

22 days

Every performer and creator on Patreon is about to get screwed out of 30% of their gross earnings, which will be diverted to Apple, the most valuable company on Earth. Apple contributes nothing to their work, but it can steal a third of their wages: 1/

7

341

586

1

8

23

Jamie Levy🦉

@gleeda

3 months

We've come a long way, even in the short time since I have joined. When I first started we only focused on autoruns. Now we have EDR for both Windows and macOS, Managed M365, SAT, SIEM... and what's coming next is going to be huge!

Jamie Levy🦉

@gleeda

3 months

This is a huge milestone! We're celebrating our Series D funding at @HuntressLabs 📷🥳🎉 We'll continue crushing more bad guys, and empowering essential businesses. Huge thanks to everyone who got us here: our customers, partners, investors, and the legendary badasses at

3

2

23

2

1

22

Jamie Levy🦉

@gleeda

8 years

Currently working on the online @volatility course content. so much fun :-D #DFIR

3

5

22

Jamie Levy🦉

@gleeda

2 years

No. Why the hell would I? No one should feel guilty for taking a lunch even if they’re working from home.

Recruiter Jenn

@jennica_lobo

2 years

Work from home people, do you feel guilty for taking a lunch?

332

9

368

2

0

22

Jamie Levy🦉

@gleeda

9 years

you can dump registry hives using the dumpregistry plugin in @volatility #DFIR

0

20

22

Jamie Levy🦉

@gleeda

1 year

Episode 3 of Behind the Hunt is up now! You'll see some discussion by @_JohnHammond @calebjstewart @MaxRogers5 @keydet89 and @KingCrtz from @HuntressLabs and others #DFIR #ThreatHunting #BehindTheHunt

Episode 3: Trust the Process

What does it take to be a threat hunter? In the third and final episode of Behind the Hunt, explore the methodical and rigorous process of real-world threat ...

www.youtube.com

0

3

20

Jamie Levy🦉

@gleeda

9 years

a @volatility tip: if the memory sample appears broken, try to use psscan and if that works, pass a process --dtb on the commandline #DFIR

0

15

20

Jamie Levy🦉

@gleeda

4 months

We’ve got some open job reqs for SOC Manager positions in the US, UK and AU, as well as some SOC analyst positions open here at @HuntressLabs #dfir

2

11

20

Jamie Levy🦉

@gleeda

9 years

OMFW 2014 slides on one way to hunt/profile w/memory: builds off of code coming #DFIR

1

19

Jamie Levy🦉

@gleeda

2 months

Fake Browser Updates Lead to BOINC Volunteer Computing Software, and ultimately SocGholish by @nosecurething @birchb0y and @Laughing_Mantis #DFIR @HuntressLabs

Fake Browser Updates Lead to BOINC Volunteer Computing Software | Huntress

Huntress has observed new behaviors in conjunction with the malware SocGholish. Read on to understand the implications of this threat and how you can better protect yourself.

www.huntress.com

0

9

20

Jamie Levy🦉

@gleeda

3 months

I had a random horse show up on my property today. How’s your day going? 🤣

5

0

20

Jamie Levy🦉

@gleeda

11 years

awesome blogpost by @bbaskin : Dumping Malware Configuration Data from Memory with @Volatility http://t.co/WaE7DDbvIv #DFIR

0

31

19

Jamie Levy🦉

@gleeda

27 days

watching @attrc give an awesome talk at @defcon #DFIR #memoryforensics @volatility @Volexity

7

8

19

Jamie Levy🦉

@gleeda

5 years

We're looking for some talented Linux devs @Tanium If you might be interested in building some cool stuff, (and working with me ;-) ) feel free to reach out! You can even work in your pajamas at home (remotely) #DFIR #infosec

Careers at Tanium

Tanium is one of the 100 Best Companies to Work For ranking by Great Place to Work® and Fortune magazine. Boost your career by joining Tanium.

www.tanium.com

0

7

19

Jamie Levy🦉

@gleeda

9 months

@blackroomsec I’m so sorry to hear about this. We’re hiring for several positions at @HuntressLabs if you see anything that might be a fit, I’m willing to answer any questions you may have about them Please pass these along to anyone else who is effected and might be interested as well:

1

0

19

Jamie Levy🦉

@gleeda

1 month

Come check out the @HuntressLabs booth at @BlackHatEvents !! You'll get to hear some talks by @_JohnHammond @GregAke @birchb0y and @jsecurity101

John Hammond

@_JohnHammond

1 month

badass hype video from @HuntressLabs to get pumped up for Blackhat and Hacker Summer Camp 😎🔥

6

67

0

3

19

Jamie Levy🦉

@gleeda

7 years

LOL

Kaspersky

@kaspersky

7 years

How strong is your #password ? Use our free password checker & find out! #onlinesafety #security

35

39

90

2

13

18

Jamie Levy🦉

@gleeda

4 years

Nice to see that people are looking more at AV hooks. I covered a possible way to whitelist them at OMFW in 2013:

volatility

@volatility

4 years

New @volatility Blog Post: When Anti-Virus Engines Look Like Kernel Rootkits — #DFIR #infosec

0

67

108

1

3

18

Jamie Levy🦉

@gleeda

10 years

if you are running @volatility against Win8/2012 x64 samples, it's best to use --kdbg to speed things up: #DFIR

1

23

18

Jamie Levy🦉

@gleeda

2 years

We’ve really seen an uptick in Qakbot activity as of late. @embee_research has been looking into some of these and has extracted out some IOCs. In addition, we’ve added some good hygiene advice #dfir #malware #qakbot cc @HuntressLabs

Threat Advisory: Qakbot Activity Is Rising | Huntress

We're seeing a rise in Qakbot activity. Here's what you need to know to keep your environments safe.

www.huntress.com

0

4

17

Jamie Levy🦉

@gleeda

10 years

stop talking about E01 containers (really boring) and focus on GPU malware research (exciting++)!! http://t.co/kGULmhn6Yt #DFIR #malware

0

27

17

Jamie Levy🦉

@gleeda

6 years

The new @DFRWS challenge looks like fun! #DFIR #IoT It'd due March 20, 2019 so there's plenty of time to work on it :-D

0

14

12

Jamie Levy🦉

@gleeda

2 years

So far I’m really enjoying the talk by Allison Wikoff and Sveva Vitoria Scenarelli on spoofed companies and people. #blackhat2022

3

18

Jamie Levy🦉

@gleeda

1 year

./ @keydet89 discussing Artifact Constellations during today's #TradecraftTuesday cc @HuntressLabs #DFIR #malware #CTI #constellations #EDR #MDR

2

4

17

Jamie Levy🦉

@gleeda

2 years

I gave a talk for @WiCySorg about how I got into #dfir as well as some tips for people who are newly trying to break into this field you can still watch it on demand: #memoryforensics #infosec #malware

Stairway to DFIR: My Journey into Cybersecurity

The journey into Cybersecurity is not one-size-fits-all but can vary from person to person. There are also several subfields within Cybersecurity that one may concentrate on, leaving many opportuni...

www.brighttalk.com

1

15

16

Jamie Levy🦉

@gleeda

7 years

I found the interrogation rooms #BlackHatUSA

1

17

Jamie Levy🦉

@gleeda

2 years

What are your favorite #dfir / #infosec podcasts? 😀 looking for some good recommendations

8

1

15

Jamie Levy🦉

@gleeda

2 years

Nicole Beckwith says that @volatility is one of her “hands-down favorites” in her IR go-bag on @DarknetDiaries ‘s The Police Station Incident #dfir #memoryanalysis #malware #ransomware

The Police Station Incident

Nicole Beckwith wears a lot of hats. She’s a programmer, incident responder, but also a cop and a task force officer with the Secret Service. In this episode sh

podcasts.apple.com

1

6

17

Jamie Levy🦉

@gleeda

9 years

a @volatility tip: use the kdbgscan plugin to determine the Windows profile since it's quicker than imageinfo #DFIR

0

20

16

Jamie Levy🦉

@gleeda

1 year

Yay! some cool things about to come from @HuntressCTI 🥳🎉

1

5

17

Jamie Levy🦉

@gleeda

4 years

@Teck923 @keydet89 @jackcr @Hexacorn @HECFBlog @attrc @bbaskin @hacks4pancakes @0xAmit @B1N2H3X @shortxstack @iamevltwin @jared703 @d1r4c @binaryz0ne @maddiestone @maridegrazia @candicenonsense @malwareunicorn

8

0

17

Jamie Levy🦉

@gleeda

2 years

Ever wonder what it's like working as a Threat Analyst here at @HuntressLabs ? Our very own @Purp1eW0lf has written up a great blog detailing some of the very things they do in a day: P.S. We're hiring! DM me! #DFIR #infosec #malware #ThreatHunting

A Day in the Life of a Threat Analyst | Huntress

Hop behind the proverbial shoulders of one of our ThreatOps analysts and vicariously experience a day in his life.

www.huntress.com

1

4

17

Jamie Levy🦉

@gleeda

4 months

We just released our Threat Intel report! Come see some stats on some of the threats we've encountered over the last year in the SMB space 🥳 #DFIR #CTI #ThreatIntel

2024 Cyber Threat Report | Huntress

Dive into the latest tradecraft, tactics, and trends to stay a step ahead of adversaries targeting businesses like yours with Huntress' 2024 Cyber Threat Report.

www.huntress.com

2

3

17

Jamie Levy🦉

@gleeda

3 months

@FrankMcG There are a few reasons, including: * unknown availability: plans may change at work or personally * unknown agenda: is the content going to be worth my time? * slow approval process: am I willing to pay out of pocket if work doesn’t cover?

1

0

16

Jamie Levy🦉

@gleeda

4 months

I’m not going to be at #RSAC but there will definitely be a @HuntressLabs booth there. Come by the booth and see @_JohnHammond , @birchb0y , @GregAke and others 🥳🎉

1

5

16

Jamie Levy🦉

@gleeda

8 years

Made the mistake of using EnCase v8 today. WTF is this crap? v6 made sense, this REALLY doesn't :'-( #DFIR

3

5

16

Jamie Levy🦉

@gleeda

4 months

@jstrosch YOLO 🤣

0

16

Jamie Levy🦉

@gleeda

7 years

how have I lived without pbcopy until now? #DFIR $ head -n 1 gigantic_ass_encoded_data.txt | pbcopy

1

6

16

Jamie Levy🦉

@gleeda

2 years

We’re looking to hire a Sr Manager for the R&D team here at @HuntressLabs ! Feel free to reach out to me for details! #dfir #malware #infosec #infosecjobs

0

5

16

Jamie Levy🦉

@gleeda

6 years

Think you should have more processes in your mac_pslist output? Try the more robust mac_tasks @volatility plugin instead!: #DFIR #DFIRtips

1

9

16

Jamie Levy🦉

@gleeda

9 years

Have a memory sample in encase format, but no encase? Don't convert, use ftk imager to mount it for free: #dfir

0

20

16

Jamie Levy🦉

@gleeda

4 months

Proud to announce that I will be teaching a course on Windows Memory Forensics at @defcon in Vegas this summer! 🥳

2

4

16

Jamie Levy🦉

@gleeda

6 years

@IanColdwater That’s interesting. I didn’t realize that

1

0

16