Notes from the field.
Cybersecurity, applied AI, and leadership.
Etendo Exposure of Sensitive Data in Cleartext via URL ↗
During a hunt for cleartext credentials in a client network searching for URL parameters matching to password=, pass=, psd=, etc., I discovered a url similar to:…
The RESPONDS Threat Hunting Framework ↗
Threat hunting is not simply about reacting to alerts; it’s about proactively searching for threats that have not yet been detected by technology. This typically involves…
Books Every Cybersecurity Leader Needs to Read ↗
There’s a flawed logic that exists within many tech and cyber teams. High-performing individual contributors are offered leadership opportunities, because there’s an assumption…
Insider Threat Training & Program Development ↗
Building an Insider Threat Program: Essential Resources Insider threats are often downplayed, but they pose a significant risk to organizations, as employees, contractors, and…
Insider Threat Hunting PRECEED Framework ↗
As I reflect on my early days learning about digital forensics and incident response, I recall a particularly challenging experience that had an impact on my approach to threat…
Threat Hunting: Hypothesis Chaining ↗
Hypothesis chaining is a method that enables threat hunters to narrow down search results during a hunt by appending or branching off of their original hypothesis. This…
Hunting Punycode IDNs Using Carbon Black EDR ↗
Running a “ipport:53” process search in Carbon Black has helped to locate hosts and/or processes performing an abnormal number of DNS queries, however recently I wanted to hunt…
Acquiring a Triage Image Using KAPE and Carbon Black Go Live ↗
Before starting, big shout out to Eric Zimmerman (https://github.com/EricZimmerman/) for creating so many great free DFIR tools. KAPE can be downloaded here:…
InfoSec Reading List ↗
I often get asked which books are worth reading for an aspiring InfoSec pro. While there are many great books out there, each serving a unique purpose, here are my general…
Intuit Lacerte Vulnerability and Data Exposure CVE-2018-11338 & CVE-2018-14833 ↗
NOTE: This vulnerability was discovered in early April of 2018. I immediately contacted Intuit support and their security team to responsibly disclose the vulnerability. I…
UltraTax CS Data Exposure Vulnerability CVE-2018-14608 & CVE-2018-14607 ↗
NOTE: This vulnerability was discovered in late July of 2018. I immediately contacted Thompson Reuter support, their sales team, and Tweeted to them to responsibly disclose the…