David J. Bianco

6.2K posts

David J. Bianco banner
David J. Bianco

David J. Bianco

@DavidJBianco

Threat Hunting, CTI, incident detection & response. SANS instructor. Special interest in helping newbies get started. He/Him. https://t.co/XcrBqQLUrP

Katılım Aralık 2009
827 Takip Edilen12.5K Takipçiler
Sabitlenmiş Tweet
David J. Bianco
David J. Bianco@DavidJBianco·
Are you maximizing your use of IOCs? Use the Pyramid of Pain to find out! goo.gl/Fwc08
English
7
46
127
0
David J. Bianco
David J. Bianco@DavidJBianco·
I read the bill's text. It doesn't actually stop sharks from eating fish. Instead, sharks must yell "You been SHARKED!" before eating, hoping to embarrass them into changing behavior.
David J. Bianco tweet media
English
1
0
1
830
David J. Bianco
David J. Bianco@DavidJBianco·
Everyone's looking at the sky, seeing things they never noticed before, getting quite alarmed. Just like a new SOC analyst. Everything's an anomaly if you look at it long enough.
English
0
1
8
873
David J. Bianco
David J. Bianco@DavidJBianco·
@JoelEsler Thanks, I did that already. Neither support x86_{32,64} running on ARM processors. Apparently, QEMU *might* be able to do it, but at such a substantial emulation penalty that the performance of the VMs makes it pointless (at least, according to those who have tried it).
English
0
0
0
31
David J. Bianco
David J. Bianco@DavidJBianco·
I had to replace my aging Intel MacBook Pro with something newer, but also x86. I first tried Linux (which, it should be noted, I've used an administered for > 30 years counting prior UNIX). (1/2)
English
1
0
2
942
David J. Bianco
David J. Bianco@DavidJBianco·
@JoelEsler Nah, last I checked, neither allows you to run x86 guest VMs on ARM hosts.
English
1
0
0
67
Joel Esler
Joel Esler@JoelEsler·
@DavidJBianco I'm confused. VMware and Parallels both do. What am I missing?
English
1
0
1
81
David J. Bianco
David J. Bianco@DavidJBianco·
@NickSmi59531224 Yes, but (for example) "forgot to patch X" results in an exploit which is just one step. If it's initial access, you don't stop there; you must still take other steps to achieve your goal. If it was later in the cycle, there were other steps ahead of it.
English
2
0
5
1.2K
Secret shadow
Secret shadow@NickSmi59531224·
@DavidJBianco I mean... Sam curry has dozens of talks on just getting lucky on dumb things. Most security i feel is getting lucky on dumb things. Forgot to patch X. Accidental wild card, accidental cred leak, etc. Usually it's the simple that causes issues in my experience.
English
1
0
2
1.4K
David J. Bianco
David J. Bianco@DavidJBianco·
I don't mean to be rude, but if you're out there talking about the Defender's Dilemma and how the #BlueTeam needs to be perfect everywhere and attackers only need to "get it right once", it just tells me that you don't know what you're talking about. #cybersecurity
English
24
19
164
32.6K
David J. Bianco
David J. Bianco@DavidJBianco·
@gleeda @furt_tech Sadly, "victim org doesn't have a security team" is common, but it doesn't mean the Defender's Dilemma is true. It just means they don't have defenders. There are still detection and intervention opportunities, even if the org isn't prepared to exploit them.
English
1
0
7
369
Jamie Levy🦉
Jamie Levy🦉@gleeda·
@DavidJBianco @furt_tech Most of our customers don’t have security teams. Tons of small businesses don’t. Lots of open RDP, bad configs, and other low hanging fruit. They don’t fit your model laid out here.
English
2
0
6
457
David J. Bianco
David J. Bianco@DavidJBianco·
@furt_tech I'm struggling to think of many scenarios where the attack was only a single event. Maybe I'm showing my Fortune 500 bias, but most orgs with security teams should be beyond the script kiddie phase.
English
2
0
4
1.1K
Furt_Tech
Furt_Tech@furt_tech·
@DavidJBianco I am gonna step in to disagree with you on this one and point out the thousands of occasions where a skiddy with a simple vulnerability destroyed entire corporations. But i probably dont know what im talking about so...
English
1
0
3
1.3K
David J. Bianco
David J. Bianco@DavidJBianco·
@slobtresix0 If the attacker is never detected throughout their entire lifecycle, they got it right a bunch of times, not just once.
English
2
0
33
1.8K
scot berner
scot berner@slobtresix0·
@DavidJBianco 100 percent this, but also, stating all your absolutes based on what is detected and ignoring the reality of adversarial operations that generate no detections...
English
1
0
7
2K
David J. Bianco
David J. Bianco@DavidJBianco·
There's nothing like a good data breach to remind you of all the subscriptions you forgot about.
English
0
1
5
809
David J. Bianco retweetledi
SANS DFIR
SANS DFIR@sansforensics·
🔎 Join us at the 2025 #CTISummit & Training where you'll hear from #CTI experts & have the chance to take FOR572, led by @DavidJBianco! This course teaches you to analyze network artifacts, improve #IncidentResponse effciency, & more. → Learn more: buff.ly/48Dku9K
SANS DFIR tweet media
English
0
1
8
2.2K