Welch Sec

These were flagged with the reputation as 'Known Attacker' today. gist.github.com/welchsec/c616a… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

Emerging Threat signatures that were flagged for communicating with my honeypot today gist.github.com/welchsec/13e90… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

Threat Actors are "Bringing Their Own Forensics" In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (vol.py) directly on victim machines. Commonly a tool for defenders, the TAs are using it to:

Day 3 of #ClaudeForBlueTeam We'll stick with the ATT&CK theme - working with the data kind of sucks on the website alone. It's static, you can't really take any notes and there's no cool graph view. Prompt Claude to make you a backlinked & tag filled Obsidian vault containing the ATT&CK data - and specifically data sources. From here, you can do some powerful stuff like look at what data sources are required for SaaS type techniques. You can also visualize detection coverage for a particular technique.

Emerging Threat signatures that were flagged for communicating with my honeypot today gist.github.com/welchsec/0b99c… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

These were flagged with the reputation as 'Known Attacker' today. gist.github.com/welchsec/9e62f… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

💡 Threat Hunting in Splunk with Hunt's C2 Intelligence hunt.io/glossary/splun… Threat hunting in Splunk works best when logs are enriched with reliable intelligence, and using our Splunk Addon brings live C2 infrastructure and enriched IOC feeds directly into Splunk dashboards. Analysts can validate activity against curated intelligence, pivot on indicators, and run structured hunts without leaving their Splunk environment. With Splunk’s correlation engine and our high-fidelity feeds, teams can detect active attacker infrastructure faster and reduce noise in investigations. #ThreatHunting #ThreatIntelligence #CyberSecurity

BEC isn’t new. But the way it works today is. What used to be fake invoices and phishing emails... is now full-on identity abuse inside your environment. 👇🧵

Fresh *CLICKFIX* coffee brewing 😂 This one just showed up on my radar, defender you know what to do with it 🤭 coffeemaxusa[.]com #cybersecurity #clickfix #defender

Day 2 of #ClaudeForBlueTeam Building visuals and presentations using ATT&CK can be a pain. Prompt Claude to build an ATT&CK MCP for you - then load this ATT&CK MCP in Claude Desktop. Now you can ask Claude to generate executive briefings for you, using rich ATT&CK data.

Casting a Wider Net: ClickFix, Deno, and LeakNet’s Scaling Threat: reliaquest.com/blog/threat-sp… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

These were flagged with the reputation as 'Known Attacker' today. gist.github.com/welchsec/c94d8… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

Emerging Threat signatures that were flagged for communicating with my honeypot today gist.github.com/welchsec/f0419… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

The ransomware landscape is shifting. While profits appear to be declining, actors are adapting their TTPs. In 2025, 77% of intrusions included data theft, 43% targeted virtualization infrastructure, and attackers pivoted to smaller orgs. Learn more: bit.ly/3PHt9T1

RMM abuse surged 277% last year, making up nearly a quarter of the incidents we observed. (Huntress 2026 Cyber Threat Report). Not because people don't care. Because these tools are trusted by default. Attackers noticed. And built a playbook around it. 🧵

🎉 Excited to start my WebHacking journey with @HackingHub_io! Ready to learn, grow, and hack some web apps! 💻✨

Emerging Threat signatures that were flagged for communicating with my honeypot today . gist.github.com/welchsec/a882b… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

These were flagged with the reputation as 'Known Attacker' today. gist.github.com/welchsec/7da69… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec

A small business almost lost everything. Not to some advanced exploit... To a VPN login. Here’s how one overlooked security control nearly turned into a ransomware disaster. 🧵

Emerging Threat signatures that were flagged for communicating with my honeypot today . gist.github.com/welchsec/94654… #ThreatIntel #Infosecurity #Cybersecurity #IOC #Indicatorsofcompromise #Infosec