2024.08.20.News You Should Know

August 20, 2024 - 5 mins read

CISA warns of Jenkins RCE bug exploited in ransomware attacks (bleepingcomputer.com) - Jenkins vulnerabilities from January being used by threat actors for Remote Code Execution. Patches should be applied in every environment. Exploitation of this vuln and proof of concepts hit the web less than 48hrs after the issue was identified. GitHub Actions artifacts found leaking auth tokens in popular projects (bleepingcomputer.com) - GitHub breaks the principle of least astonishment/surprise by including tokens, api keys, other key material in artifacts download.

Alerting

June 6, 2024 - 2 mins read

So You Want To Build A SOC Or How To Lose Your Mind In 10 Weeks A number of companies I’ve worked for have security tools in place, but they’re almost always half-configured, half-utilized, and no one has a good idea what’s missing or what should be there. Luckily, there’s a solution, or at least a tool that can help us move towards a solution. The MITRE ATT&CK Framework Enter the MITRE ATT&CK Framework.

Troubleshooting

June 5, 2024 - 5 mins read

Troubleshooting A Quick Primer The Back Story A friend called and requested some assistance with her electrical. She had moved into a new (to her) house recently and she feared the electrical had gotten the landlord/flipper special. Spoiler turns out she was right, at least to a point. And now one of the circuits in the kitchen was no longer working. I don’t know if you’ve ever tried to cook in the dark but its not a pleasant experience.

Thoughts for a New Leader

May 10, 2024 - 8 mins read

Series: Management

What follows is a list of thoughts crafted in an airport terminal in San Jose, California hours after completing my first attendance at the RSA Conference. This also happens to be the anniversary of my first year as a people leader in the security engineering space. (I had previously mentored and led soldiers in the US Army and in various other civilian industries including Optical Lens Manufacturing and Operational Incident Response.

RSA Day 3

May 9, 2024 - 7 mins read

Series: RSAC 2024

(Posting this a day late as I was crazy exhausted yesterday after walking nearly ten miles! I literally laid down in the room at 22:30 and woke up at 04:30 still in my clothes, lights on, etc…. I think I was effectively conferenced out, and that was only Day 3!) Great tracks today and some exciting notes. Plus I got to hit the Expo floor. Here’s the talks I made it to:

RSA Day 2

May 6, 2024 - 7 mins read

Series: RSAC 2024

Today was a great opportunity to see what RSA was all about. We walked over early to get badges and get checked in. The conference provided us with a decent swag pack, an RSA branded bag, water bottle (something I hadn’t been able to find at any of the airports along the way), a notebook, a pen, a shirt, and for newbies, a “First Timer” pin. We stepped to grab breakfast and then hit up the talk track, I had stupidly “favorited” all my talks instead of “reserving” them so I had some quick choices to make.

RSA Day 1

May 5, 2024 - 6 mins read

Series: RSAC 2024

Today was a travel day to RSA 2024. It started off simple enough, boarding at my municipal airport, then a puddle jumper to the nearest metro-airport, Atlanta. Luckily, as if there wasn’t enough anxiety around Boeing aircraft, our initial plan was inoperable and a secondary plane had to be found delaying our flight. Considering Boeing’s in the business of killing whistleblowers this week, and they make roughly 90% in Delta’s fleet (Atlanta is Delta’s home turf) it didn’t look like I was going to make it west on a non-Boeing flight.

Hello_World

May 2, 2024 - 1 min read

Hello World Welcome to my little slice of internet freedom. I hope to start moving a number of my writings here and making this a comfortable place for musings, software configuration guides, security issues and the like. After all the fight I had to get Hugo, Alpine, Proxmox, Nginx, and LetsEncrypt configure, this better be worth the trouble. Then again, is anything ever really? If anything I learned a hundred ways to not do things and thats got to be worth something.

Email

December 22, 2023 - 3 mins read

300 Emails? It was 24 hours! I would have never thought as a front line manager of a small team that I could receive as much email as I do. It’s so overwhelming, I’ve taken to putting my Out of Office as “Due to the volume of email, I will be deleting all email received in my absence. Please hold important correspondence til my return on 3 January 2024”! So, how do we communicate to our peers and leaders if they’re also receiving this much email, or multitudes more?

Velociraptor Offline Collector

December 1, 2023 - 3 mins read

This is a living document and may be incomplete. Updated 1DEC2023 Locating Evidences of Execution using Prefetch, Velociraptor, and Zimmerman’s PECmd Prefetch is a common Windows artifact used for determining the first and last incidences of a program being executed. This file is a binary blob stored at $:\Windows\Prefetch and consists of a series of files named APPLICATION-GUID.pf. These files contain the name of the executable, the last n run date time groups a hash of the executable and path, and a list of files accessed by the .