Nate Guagenti

3.5K posts

Nate Guagenti

Nate Guagenti

@neu5ron

Columbus, OH Katılım Haziran 2011
1.2K Takip Edilen2.5K Takipçiler
Sabitlenmiş Tweet
Nate Guagenti
Nate Guagenti@neu5ron·
@therealwlambert @anton_chuvakin 💯 enhance, enable, help, uplift, expedite, alleviate, move forward, etc.. any other words that are absolutes are a red flag.. only a snake oil vendor deals in absolutes
GIF
English
1
0
4
0
Nate Guagenti
Nate Guagenti@neu5ron·
@ateixei @TheRealShiroe I ❤️ single threaded applications. especially when a task max’s out a whole core.. all the other task threads on that core sit and queue for a very very long time (aka till that task is done).. and dream that any of those tasks aren’t important 🥳
English
0
1
1
0
Alex Teixeira
Alex Teixeira@ateixei·
@TheRealShiroe This is how most SIEM users still develop a 'detection' today: a rule throws out 1 (atomic) alert, usually linked to a single indicator. Now, imagine implementing over three-hundred of those. It's unmanageable, if not, impossible given that each query will keep one cpu core busy.
English
2
0
2
0
Nate Guagenti
Nate Guagenti@neu5ron·
@HackingLZ has to be submission and they approve and write it. alert fatigue is really not the big issue, poor rules can mean poor performance. performance costs money not to mention worst case downtime. there isn’t a databse/siem that will truly prevent a poorly written rule or correlation
English
0
0
0
0
Justin Elze
Justin Elze@HackingLZ·
If you have a managed/monitored SIEM by some MSSP should they accept and monitor detections you add? should they only have a process where you submit detention criteria and they write it?
English
37
4
60
0
Nate Guagenti
Nate Guagenti@neu5ron·
@subTee lucky if anybody implements it right. and most java applications (half+ of siems/logging solutions built upon) have no ability for CRL. so just grab any cert from a compromised host and do your bidding. granted this isn’t evasion, but I don’t feel you need to evade
English
0
0
2
0
Nate Guagenti
Nate Guagenti@neu5ron·
@subTee 100. if you hash the entire scheduled task XML block, filter on that. it’s absolutely minimal/easy. @acalarch and I presented on that almost 5 years ago
English
0
2
12
0
Anton
Anton@Antonlovesdnb·
@subTee .@neu5ron is/was years ahead of us defenders. What a legend.
English
1
0
2
0
Nate Guagenti
Nate Guagenti@neu5ron·
@HackingDave micro level changes.. but since this isn’t a macro change, people lose heart or say nothing will ever change.
English
0
0
0
0
Nate Guagenti
Nate Guagenti@neu5ron·
@HackingDave highschool alone could change a lot.. teaching kids how to use google in and of itself would be life changing for so many and across many industries. Schools got rid of lifeskills for whatever godforsaken reason, but think of a lifeskills w/ google & credit cards & so on…
English
1
0
1
0
Dave Kennedy
Dave Kennedy@HackingDave·
Long thread but serious talk. Seeing a massive problem in the security industry today. We have brand new candidates lacking "hands on" experience coming into the workforce and finding it extremely difficult to find a job. 1/10
English
161
407
1.9K
0
Nate Guagenti
Nate Guagenti@neu5ron·
@Antonlovesdnb “need more than prevention, use xdr” - vendor “we prevent everything” - same vendor
English
0
0
1
0
Anton
Anton@Antonlovesdnb·
Does this even add any value to customers ?
Anton tweet media
English
5
1
5
0
Nate Guagenti
Nate Guagenti@neu5ron·
@jaredcatkinson love it. quantifying intent/action in relation to the importance/role of an asset/entity in relation to the possibility is nothing short of incredibly difficult.
English
0
0
0
0
Nate Guagenti
Nate Guagenti@neu5ron·
@blubbfiction example for mac addresses, one model/log/siem uses ":" while another uses "." while another has no seperator. aa:bb:cc:dd:ee:ff vs aabb.ccdd.eeff vs aabbccddeeff
English
1
0
2
0
Nate Guagenti
Nate Guagenti@neu5ron·
@blubbfiction in laymen terms (for myself), this alleviates/solves value transformations then yes? ie: field mappings aren’t enough, as different vendors log values and or parse/normalize values differently, not change field names.
English
1
0
1
0
Thomas Patzke
Thomas Patzke@blubbfiction·
The new capabilities of pySigma allow conversions of Sigma rules that were hard to implement in sigmac. Example: CrowdStrike data contains only the file name in ParentBaseFileName while ParentImage in Sigma rules contains the path. The new transformations solve this problem.
Thomas Patzke tweet mediaThomas Patzke tweet media
English
3
19
66
0
Nate Guagenti
Nate Guagenti@neu5ron·
@ionstorm @cyb3rops absolutely! i think only reason hasn’t caught on is usually peoples lack of imagination or more so like with so much in this - due to their siem/tools being so specific time to check something else out almost feels like a waste.
English
1
0
0
0
ɯɹoʇsuoı
ɯɹoʇsuoı@ionstorm·
You have Multiple SIEM's, which data model did you choose and why? Every vendor has their own Data model, Splunk CIM, Microsoft ASIM, Elastic ECS, Google UDM, ArcSight CEF, QRadar LEEF, Cloud Information Model (CIM). Anyone else see a problem here?
ɯɹoʇsuoı tweet media
English
3
7
17
0
Nate Guagenti
Nate Guagenti@neu5ron·
@ionstorm @cyb3rops the best solution is Sigma coupled with a project documenting log sources original fields with value examples. after that universal schema is just a matter of creating a sigma translator to the original source
English
1
2
2
0
Nate Guagenti
Nate Guagenti@neu5ron·
@ionstorm @cyb3rops example, one data source had been mapped to a vendors schema for 2 years, they knew it. only to then created their own w/ no regard. or how about the other vendor who left comments such as “original source of theft” in their initial code release.
English
1
0
0
0