Podcasts about mitre att

Play Episode Listen Later Jun 5, 2026 30:31

Join us for this week's Defender Fridays as Bobby Ford, Chief Strategy and Experience Officer at Doppel, talks about open-source labs, MITRE ATT&CK, and real-world defender workflows.At Defender Fridays, we delve into the dynamic world of information security, exploring its defensive side with seasoned professionals from across the industry. Our aim is simple yet ambitious: to foster a collaborative space where ideas flow freely, experiences are shared, and knowledge expands.About Our GuestBobby is a globally recognized cybersecurity “geek” with almost three decades of experience, including the last 14 years as a CISO, protecting some of the world's most complex and operationally intensive enterprises. His career began in the military as a founding member of the Pentagon Computer Incident Response Team. Bobby built and led cybersecurity programs in the Aerospace and Defense industry. He was the first CISO at Exelis Inc. and was the architect of ITT's global cybersecurity audit function under DOJ oversight.Transitioning from public to private sector, Bobby served as the first CISO at Abbott Labs, was CISO for Unilever, and most recently was SVP and Chief Security Officer at Hewlett Packard Enterprise (HPE). Known for his collaborative style and empathetic leadership, Bobby fosters an inclusive culture that empowers entire security organizations to excel.Register for Live SessionsJoin us every Friday at 10:30am PT for live, interactive discussions with industry experts. Whether you're a seasoned professional or just curious about the field, these sessions offer an engaging dialogue between our guests, hosts, and you, our audience.Register here: https://limacharlie.io/defender-fridaysSubscribe to our YouTube channel and hit the notification bell to never miss a live session or catch up on past episodes on our website!Sponsored by LimaCharlieThis episode is brought to you by LimaCharlie, the Agentic SecOps Workspace (ASW), where AI agents operate security infrastructure using the same controls and authority as human analysts, with every action visible, governed, and auditable.Why LimaCharlie?Eliminate vendor sprawl and tool complexityDeploy and scale effortlessly on native multi-tenant architectureReduce costs with intelligent data routing and free 1-year retentionBuild custom solutions with 100+ security capabilities on-demandAccelerate response with agentic AI that acts directly within predefined workflowsTry the Agentic SecOps Workspace free: https://limacharlie.ioLearn more: https://docs.limacharlie.ioFollow LimaCharlieSign up for free: https://limacharlie.ioLinkedIn: / limacharlieioX: https://x.com/limacharlieioCommunity Discourse: https://community.limacharlie.com/Host: Maxime Lamothe-Brassard - Founder at LimaCharlieGuest: Charles Grandjean - CTO and Co-founder at Hexiagon AI

ai training defense practical skills transitioning register defenders eliminate svp using ai doj unilever assisted aerospace ciso ck itt chief strategy chief security officer doppel blue team experience officer mitre att hewlett packard enterprise hpe limacharlie bobby ford

Not every headhunter is hiring.

Dark Rhino Security Podcast

Play Episode Listen Later Jun 4, 2026 30:27

The Five Eyes issue a rare joint warning on China. Jen Easterly weighs in on Trump's AI EO. Researchers warn everyday notifications can become AI attack vectors. IronWorm is a sophisticated Rust-based infostealer targeting software developers. Cisco patches a critical vulnerability in its Unified Communications Manager platform. Anthropic maps AI-enabled cyber activity to the MITRE ATT&CK framework. Authorities dismantle an online counterfeit identity marketplace. Our guest is Jason Kikta, CTO from Automox, discussing AI vulnerabilities, real risk, and the speed problem. An extortion crew is forced to open a customer support ticket. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Today on our Industry Voices segment, we are joined by Jason Kikta, CTO from Automox, who is discussing AI vulnerabilities, real risk, and the speed problem. If you enjoyed this conversation, check out the full interview here. Selected Reading⁠ U.S. and intelligence allies issue rare joint warning about China (Washington Post) Safeguarding Our Secrets (MI5) Opinion | The Government Is Finally Taking A.I. Risk Seriously (New York Times) CISA directive for AI executive order to be released this week, Andersen says (The Record) Gemini Voice Assistant Hijacked via Messaging Notifications (SecurityWeek) IronWorm: Shai-Hulud's rustier cousin (JFrog Security Research) Cisco warns of critical Unified CM flaw with PoC exploit code (Bleeping Computer) Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator (Anthropic) Police dismantles fake ID marketplace used by migrant smugglers (Bleeping Computer) Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown (SecurityWeek) 'Dumbass' criminal breaks the 'first rule of ransomware club' (The Register) Share your feedback. What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show. Want to hear your company in the show? N2K CyberWire helps you reach the industry's most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

ai donald trump china hiring id researchers cto rust cisco poc authorities andersen anthropic headhunters ck five eyes daily briefing mitre att cyberwire automox

拡張子って何？必要なの？？？ #225

ゆるコンピュータ科学ラジオ

Play Episode Listen Later Apr 26, 2026 37:32

拡張子って何？機械オンチにその役割やおもしろさを話しつつ、「拡張子表示設定をすべき」と説きました。【目次】0:00 コンピュータ好きはアレを表示している2:28 拡張子って何？9:37 拡張子で解釈の仕方が違う23:36 ZipかZip以外か28:09 Wordが本当にZipか見てみよう32:46 CSVってなんでみんな使うの？34:47 なんとなく見るだけで発見があ【参考文献】◯PKWARE「APPNOTE.TXT - .ZIP File Format Specification（Version 6.3.10, 2022-11-01）」https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT◯Chromium Issue Tracker「Issue 172529: Saving a Twitter image results in "jpg-large" file extension」https://bugs.chromium.org/p/chromium/issues/detail?id=172529◯Google Developers Blog「WebP, a new image format for the Web」（2010-09-30）https://developers.googleblog.com/en/webp-a-new-image-format-for-the-web/◯MITRE ATT&CK「Masquerading: Double File Extension, Sub-technique T1036.007 - Enterprise」https://attack.mitre.org/techniques/T1036/007/【サポーターコミュニティへの加入はこちらから！】⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://yurugengo.com/support⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠【親チャンネル：ゆる言語学ラジオ】⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.youtube.com/@yurugengo⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠【実店舗プロジェクト：ゆる学徒カフェ】⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.youtube.com/@yurugakuto⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠【お仕事依頼はこちら！】info@pedantic.jp【堀元見プロフィール】慶應義塾大学理工学部卒。専攻は情報工学。理屈っぽいコンテンツを作り散らかすことで生計を立てている。Twitter→⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://twitter.com/kenhori2⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠noteマガジン→⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://note.com/kenhori2/m/m125fc4524aca⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠個人YouTube→⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.youtube.com/@kenHorimoto⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠【水野太貴プロフィール】1995年生まれ。愛知県出身。名古屋大学文学部卒。専攻は言語学。本業は雑誌編集者。著書に『会話の0.2秒を言語学する』（新潮社）などがある。Podcast「神保町で会いましょう」のパーソナリティも務める。Twitter→⁠⁠⁠⁠⁠⁠https://x.com/yuru_mizuno⁠⁠⁠⁠⁠⁠神保町で会いましょう→⁠⁠⁠⁠⁠⁠https://open.spotify.com/show/6cYkvDO0HnJKLPgDBGUjjS

saving web enterprise csv txt mitre att

Mit tud az a MITRE ATT&CK? [örökzöld]

Kibertámadás!

Play Episode Listen Later Apr 8, 2026 22:16

Ebben az epizódban a MITRE ATT&CK keretrendszerről beszélgetünk Rékával: arról, hogyan lehet valós támadói viselkedéseket taktikákra, technikákra és procedúrákra bontva elemezni. Szóba kerül a TTP-k szerepe, a detekció és az ATT&CK mitigációs lehetőségei, a MITRE D3FEND, valamint az is, hogyan segíti a framework a riportolást, a CTI-munkát és a red team / blue team együttműködést. Az adásban Réka a saját szakdolgozati témájáról is mesél, amelyben CTI-jelentésekből próbál TTP-ket automatikusan kinyerni NLP és mesterséges intelligencia segítségével.

nlp sz mitre cti ebben ttp mitre att mitre att ck

S19 E0 (VIDEO) How Hackers Exploit Hidden Vulnerabilities

Play Episode Listen Later Apr 2, 2026 40:06

#SecurityConfidential #DarkRhiinoSecurityDiyar Saadi Ali is a cybersecurity professional specializing in cybercrime investigations, SOC operations, and malware analysis. A contributor to the MITRE ATT&CK framework, Diyar has helped strengthen global threat intelligence efforts and defensive strategies. Diyar regularly speaks at international cybersecurity conferences including Arab Cyber Security, DeepSec, GISEC, BlackHat, and SulyCon, contributing to the advancement of the global cyber community.00:00 Intro02:26 Our Guest03:42 Learning Cybersecurity in Iraq07:40 The MITRE attack Framework: Is that all the knowledge we know? 11:30 There are still tons of unknown vulnerabilities13:30 You can't fake motivation17:00 Defenders are to blame19:16 Who is coming up with Malware?22:10 Every crime leaves a trace24:12 AI is making malware easy29:00 Governance and Trust38:02 Presentations and News from Diyar----------------------------------------------------------------------To learn more about Diyar visit https://www.linkedin.com/in/diyarsaadi/To learn more about Dark Rhiino Security visit https://www.darkrhiinosecurity.com

ai news hidden hackers defenders governance presentations exploit malware soc vulnerabilities black hat ck mitre mitre att diyar

S19 E0 How Hackers Exploit Hidden Vulnerabilities

Dark Rhino Security Podcast

Play Episode Listen Later Apr 1, 2026 40:06

Diyar Saadi Ali is a cybersecurity professional specializing in cybercrime investigations, SOC operations, and malware analysis. A contributor to the MITRE ATT&CK framework, Diyar has helped strengthen global threat intelligence efforts and defensive strategies. Diyar regularly speaks at international cybersecurity conferences, including Arab Cyber Security, DeepSec, GISEC, BlackHat, and SulyCon, contributing to the advancement of the global cyber community.00:00 Intro02:26 Our Guest03:42 Learning Cybersecurity in Iraq07:40 The MITRE attack Framework: Is that all the knowledge we know? 11:30 There are still tons of unknown vulnerabilities13:30 You can't fake motivation17:00 Defenders are to blame19:16 Who is coming up with Malware?22:10 Every crime leaves a trace24:12 AI is making malware easy29:00 Governance and Trust38:02 Presentations and News from Diyar

ai news hidden hackers defenders governance presentations exploit malware soc vulnerabilities black hat ck mitre mitre att diyar

AI vs. Vulnerabilities: Who Really Wins?

@BEERISAC: CPS/ICS Security Podcast Playlist

Play Episode Listen Later Mar 29, 2026 33:56

Podcast: Exploited: The Cyber Truth Episode: AI vs. Vulnerabilities: Who Really Wins?Pub date: 2026-03-26Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationArtificial intelligence is transforming cybersecurity but not in the way many expect. While defenders are using AI to accelerate detection, triage, and threat hunting, adversaries are leveraging the same tools to scale reconnaissance, automate exploit development, and dramatically increase the speed of attack. In this episode of Exploited: The Cyber Truth, host Paul Ducklin is joined by RunSafe Security CEO Joe Saunders and Joe Slowik, Director of Cybersecurity Alerting Strategy at Dataminr, to discuss one critical question: Does AI actually reduce vulnerability risk or just accelerate the conflict? With a background including MITRE ATT&CK, Dragos, Los Alamos National Laboratory, and U.S. government offensive operations, Slowik offers a dual-lens perspective on how AI is reshaping both sides of cybersecurity. Together, they explore: How AI is increasing the velocity of vulnerability discovery and exploitationWhy attackers may benefit from “good enough” AI outputs, while defenders require precisionThe rise in CVEs and why more vulnerabilities doesn't necessarily mean worse securityThe growing risk in OT, IoT, and unmanaged edge devicesWhy AI is a powerful tool—not a magic bullet—and what that means for defenders From enterprise security teams to critical infrastructure operators, this episode breaks down what security leaders must understand to stay ahead in an AI-accelerated threat landscape.The podcast and artwork embedded on this page are from RunSafe Security, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

director ai ot iot pub vulnerabilities ck listen notes los alamos national laboratory dragos cves mitre att securitythe dataminr paul ducklin

S3 Ep61: [LIVE] Guess Who: The Malware Edition

identifying malware ck mitre att

Play Episode Listen Later Mar 26, 2026 89:55

Can You Identify the Malware Family?Out of the Woods: The Threat Hunting Podcast returns with another live, interactive edition designed to test how you analyze malicious activity. This session will focus on a specific malware family, revealing its behavior in stages as our hosts walk through execution patterns, infrastructure clues, and operational tradecraft.Participants will examine how observed behaviors align to MITRE ATT&CK, how the malware evolves across campaigns, and how delivery methods and post-exploitation activity signal attribution. Before the final reveal, attendees will have the opportunity to submit their best guess on which malware family is responsible.What You'll Learn: Real-world malware behavior – A phase-by-phase breakdown of an active malware campaign MITRE ATT&CK in context – How techniques manifest during execution Behavioral fingerprinting – Identifying patterns across variants and infrastructure Delivery and objectives – What infection chains reveal about operator intent Interactive analysis – Submit your guess before the final reveal Watch the episode here: https://youtu.be/wo-Vy6okKVI

Coding for Security with Chris Ayers

.NET Rocks!

Play Episode Listen Later Mar 25, 2026 52:47

What does secure coding look like today? Carl and Richard talk to Chris Ayers about the MITRE ATT&CK matrix, a comprehensive breakdown of the tactics, techniques, and procedures black hats use to exploit your systems. Chris talks about the role of developers in creating more secure software, starting with logging - surfacing important data about the use of applications that can help indicate when a black hat is taking advantage of it. The conversation also digs into supply chain attacks, various techniques for resisting exploits being introduced through libraries, and the ever-expanding array of threats affecting software today!

microsoft security studio visual vista coding ck orcas asp vb mitre att chris ayers

Coding for Security with Chris Ayers

.NET Rocks!

Play Episode Listen Later Mar 25, 2026 52:47

What does secure coding look like today? Carl and Richard talk to Chris Ayers about the MITRE ATT&CK matrix, a comprehensive breakdown of the tactics, techniques, and procedures black hats use to exploit your systems. Chris talks about the role of developers in creating more secure software, starting with logging - surfacing important data about the use of applications that can help indicate when a black hat is taking advantage of it. The conversation also digs into supply chain attacks, various techniques for resisting exploits being introduced through libraries, and the ever-expanding array of threats affecting software today!

security coding ck mitre att chris ayers

Mastering the Red Team: Beyond Penetration Testing

InfosecTrain

Play Episode Listen Later Mar 24, 2026 67:36

In this episode, we break down the sophisticated world of Red Teaming. Moving past simple vulnerability scans, we explore the mindset of a determined adversary. We cover the entire attack chain from initial access via LLMNR poisoning to lateral movement using BloodHound and explain how these simulations help Blue Teams sharpen their detection and response capabilities.Key Topics Covered in This Episode:Defining Red Teaming: Why Red Teaming is "threat-oriented" rather than "vulnerability-centric," focusing on organizational resilience.Understanding APTs: The characteristics of Advanced Persistent Threats—sophisticated, long-term, and stealthy.The MITRE ATT&CK Framework: A breakdown of the 14 tactics used to map adversarial behavior from reconnaissance to impact.Red Team vs. Pentesting: A detailed comparison of scope, duration, and goals (Narrow vs. Broad, Goal-oriented vs. Threat-oriented).The Attack Life Cycle: Stepping through Reconnaissance, Initial Compromise, Persistence, Privilege Escalation, and Exfiltration.Live Demo: LLMNR Poisoning: How attackers exploit "link-local" protocols to capture password hashes using tools like Responder.Cracking Hashes: Using Hashcat to resolve captured NTLMv2 hashes into plain-text passwords.Visualizing the Path: Using BloodHound and Neo4j to map hidden relationships and attack paths within Active Directory.The Blue Team Perspective: How the Security Operations Center (SOC) uses Red Team findings to close detection gaps.

moving goal threats mastering persistence narrow broad responders visualizing reconnaissance red team bloodhounds active directory penetration testing red teaming key topics covered neo4j mitre att privilege escalation

The scareware rabbit hole. [Research Saturday]

The Azure Security Podcast

Play Episode Listen Later Mar 7, 2026 27:53

This week we are joined by Marcelle Lee, cybersecurity consultant and researcher, discussing "CTI tradecraft: Investigating a mobile scareware campaign." She details how a routine click on a Google News story led to a mobile scareware pop-up—and a deeper investigation into a broader campaign. Using free tools like Censys, URLScan, VirusTotal, and CyberChef, she pivoted from two domains to uncover more than 100 related domains, shared infrastructure, and links to questionable antivirus apps in the Google Play Store. The findings are mapped to the MITRE ATT&CK framework, showing how freely available resources can power meaningful, actionable threat intelligence. The research can be found here: ⁠CTI tradecraft: Investigating a mobile scareware campaign Learn more about your ad choices. Visit megaphone.fm/adchoices

research investigating rabbit hole google play store ck cti google news mitre att virustotal censys scareware

The scareware rabbit hole.

Research Saturday

Play Episode Listen Later Mar 7, 2026 27:53

This week we are joined by Marcelle Lee, cybersecurity consultant and researcher, discussing "CTI tradecraft: Investigating a mobile scareware campaign." She details how a routine click on a Google News story led to a mobile scareware pop-up—and a deeper investigation into a broader campaign. Using free tools like Censys, URLScan, VirusTotal, and CyberChef, she pivoted from two domains to uncover more than 100 related domains, shared infrastructure, and links to questionable antivirus apps in the Google Play Store. The findings are mapped to the MITRE ATT&CK framework, showing how freely available resources can power meaningful, actionable threat intelligence. The research can be found here: ⁠CTI tradecraft: Investigating a mobile scareware campaign Learn more about your ad choices. Visit megaphone.fm/adchoices

investigating rabbit hole google play store ck cti google news mitre att virustotal censys scareware

#257 Fischbecken, Jeep, Saugroboter - 3 Hacks, 1 Lesson: Zero Trust

Engineering Kiosk

Play Episode Listen Later Mar 3, 2026 60:07 Transcription Available

Du denkst, dein IoT-Kram ist harmlos: ein Thermometer, ein Staubsaugerroboter, ein bisschen Smart Home. Aber was, wenn genau diese Geräte der perfekte Tunnel aus deinem Netzwerk sind, weil sie selten sauber segmentiert werden, kaum jemand Egress Traffic prüft und Authentifizierung oft mit Autorisierung verwechselt wird?In dieser Episode nehmen wir drei Sicherheitsvorfälle auseinander und ziehen konkrete Learnings daraus:Den Aquarium-Thermometer-Case im Casino mit ungewöhnlichem Outbound Traffic, alternative Exfiltration Kanäle und die Frage, ob IoT wirklich das Einfallstor war oder eher der Exit. Ein Jeep Cherokee Hack von 2015, inklusive offenen Port 6667, DBus-Zugriff, Firmware ohne Signierung, CAN-Bus und einem Diagnosemodus, der plötzlich die Bremsen ausknipst. Ein MQTT Case rund um Staubsaugerroboter, Pub/Sub, Wildcards und fehlende ACLs, also Mandantenisolierung zum Weglaufen.Am Ende bleibt eine unbequeme, aber sehr praktische Checkliste: Segmentierung, Zero Trust, Least Privilege, Monitoring und Logging, Secure Boot und vor allem Egress Traffic als First Class Control.Und jetzt Hand aufs Herz: Was ist deine beste Ausrede, warum dein Netzwerk noch nicht segmentiert ist?Unsere aktuellen Werbepartner findest du auf https://engineeringkiosk.dev/partnersDas schnelle Feedback zur Episode:

man lesson washington post hacks exit hack gedanken port herz unsere casino tunnel monitoring iot am ende learnings kaffee gutes anregungen jeep netzwerk smart homes logging wild cards ausrede zero trust informatik thermometer cve firmware bremsen acls werbepartner erreiche jeep cherokee owasp top mitre att mqtt secure boot einfallstor weglaufen saugroboter pub sub staubsaugerroboter authentifizierung least privilege can bus autorisierung signierung

Episode 125: Origins of MITRE ATT&CK

Play Episode Listen Later Feb 27, 2026 34:39

In this episode Michael and Mark talk with guest Blake Strom about the origins of the MITRE ATT&CK framework, how it was developed, and how it has evolved over time. We also discuss how the framework is used in the industry and its impact on cybersecurity.We also discuss Azure Security news about Azure Monitor, Azure Application Gateway, AKS, Azure Front Door, AMD v6 Confidential VMs, and xxxhttps://aka.ms/azsecpod

origins amd ck aks mitre att mitre att ck

The Signal: The Real "Payment Meets Fraud" Journey with Brian Rust at Worldpay | Episode 467

Leaders In Payments

Play Episode Listen Later Feb 17, 2026 25:24 Transcription Available

Fraud hasn't disappeared - it got smarter. Organized rings now aim upstream at SaaS platforms and ISVs that embed payments, where a single gap in onboarding, transaction logic, or refund flows can be scaled into thousands of attacks overnight. We sit down with Brian Rust, SVP and Deputy Chief Information Security Officer at Worldpay, to map the real fraud journey (entry, action, exit) and the concrete moves product and security leaders can make right now to protect merchants and brand trust.We start with the why: platforms offer leverage. Brian explains how bots and AI generate convincing synthetic businesses that pass weak KYC, and what early signals still break the spell - impossible form completion times, IP and address mismatches, and brand-new domains claiming long histories. From there, we dive into the middle of the kill chain: card testing. You'll hear how velocity spikes, elevated decline rates, and geo anomalies betray large-scale testing and how adaptive limits for new merchants can contain losses and prevent network penalties. Then we confront refund abuse, where attackers exploit trust by refunding to different instruments or flooding high-value returns. The fix isn't blanket friction - it's precision: refund-to-original-card only, refund velocity caps, and targeted reviews that slow bad actors while keeping good customers moving.Brian lays out the layers that matter now: device fingerprinting, behavioral analytics, and transaction monitoring that can halt suspect money movement before funds leave your orbit. He also makes the case for a fraud-cyber fusion model, aligning teams and intelligence using frameworks like MITRE ATT&CK to anticipate tactics as cyber and financial motives blend. Finally, we close with three actions you can ship this quarter: audit onboarding with bot controls and threat modeling, enforce velocity controls that adapt as trust grows, and tap your processor's data and filters (AVS, CVV) to harden defaults.If you lead product, risk, or engineering for a payments-enabled platform, this conversation gives you a practical blueprint to raise attacker costs, protect your merchants, and guard your reputation.

ai fraud cybersecurity ip saas payments signal fintech svp rust organized avs ck kyc global payments isvs cvv worldpay mitre att

S3 Ep55: Threat Hunting Year in Review: 2025 Trends and What's Next

touch threats year in review ck threat hunting mitre att

Play Episode Listen Later Feb 4, 2026 90:52

*Threat Hunting Workshop: Hunting for Privilege Escalation - Level 2February 11, 2026 | 12:00 - 1:00 PM ETSign Up: https://www.intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-privilege-escalation-level-2----------Out of the Woods: The Threat Hunting Podcast returned with a live episode focused on the trends threat hunters saw repeatedly throughout 2025 and what those patterns point to next.This episode serves as a threat hunter's year in review. The discussion walks through the actors, malware, behaviors, tactics, and techniques that consistently surfaced over the year, ties those findings back to MITRE ATT&CK, and connects themes across recent episodes. The focus is on what stayed consistent, what mattered most during hunts, and what those signals reveal about where attention should remain.The conversation also looks ahead. Based on what emerged in 2025 and how hunts played out across environments, the panel shares perspectives on what is likely to continue, where focus is expected to remain in 2026, and what threat hunters should keep in mind going forward.Topics covered include: Threat actors, malware, and behaviors that appeared most often in 2025 Tactics and techniques that consistently surfaced across hunts, mapped to MITRE ATT&CK Common hunt themes observed across environments throughout the year What 2025 trends suggest about threat hunting focus in 2026 Behaviors and techniques likely to remain relevant moving forward Watch the episode here: https://youtu.be/GyYTTMNyjCE?si=WynwmHS1psGN9KqO----------Stay in Touch!Twitter: https://twitter.com/Intel471IncLinkedIn: https://www.linkedin.com/company/intel-471/YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkgDiscord: https://discord.gg/DR4mcW4zBrFacebook: https://www.facebook.com/Intel471Inc/

EP257 Beyond the 'Kaboom': What Actually Breaks When OT Meets the Cloud?

@BEERISAC: CPS/ICS Security Podcast Playlist

Play Episode Listen Later Jan 14, 2026 27:22

Podcast: Cloud Security Podcast by Google (LS 36 · TOP 2.5% what is this?)Episode: EP257 Beyond the 'Kaboom': What Actually Breaks When OT Meets the Cloud?Pub date: 2026-01-05Get Podcast Transcript →powered by Listen411 - fast audio-to-text and summarizationGuest: Chris Sistrunk, Technical Leader, OT Consulting, Mandiant Topics: When we hear "attacks on Operational Technology (OT)" some think of Stuxnet targeting PLCs or even backdoored pipeline control software plot in the 1980s. Is this space always so spectacular or are there less "kaboom" style attacks we are more concerned about in practice? Given the old "air-gapped" mindset of many OT environments, what are the most common security gaps or blind spots you see when organizations start to integrate cloud services for things like data analytics or remote monitoring? How is the shift to cloud connectivity - for things like data analytics, centralized management, and remote access - changing the security posture of these systems? What's a real-world example of a positive security outcome you've seen as a direct result of this cloud adoption? How do the Tactics, Techniques, and Procedures outlined in the MITRE ATT&CK for ICS framework change or evolve when attackers can leverage cloud-based reconnaissance and command-and-control infrastructure to target OT networks? Can you provide an example? OT environments are generating vast amounts of operational data. What is interesting for OT Detection and Response (D&R)? Resources: Video version Cybersecurity Forecast 2026 report by Google Complex, hybrid manufacturing needs strong security. Here's how CISOs can get it done blog "Security Guidance for Cloud-Enabled Hybrid Operational Technology Networks" paper by Google Cloud Office of the CISO DEF CON 23 - Chris Sistrunk - NSM 101 for ICS MITRE ATT&CK for ICS The podcast and artwork embedded on this page are from Anton Chuvakin, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

breaks cloud tactics ot procedures pub ck ics kaboom cisos listen notes stuxnet plcs mitre att technical leader

#263 - Stopping Attacks To Your Cloud Office Environment (with Rajan Kapoor)

CISO Tradecraft

Play Episode Listen Later Dec 15, 2025 44:38

In this episode of CISO Tradecraft, host G Mark Hardy welcomes special guest Rajan Kapoor, VP of Security at Material Security, to discuss critical topics in cloud workspace security. From discussing the increased attack surfaces in cloud environments like Google Workspace and Microsoft 365 to practical solutions for mitigating these risks, Rajan provides invaluable insights into creating a secure cloud office environment. Tune in for expert advice on improving security maturity, managing cloud security tools efficiently, and leveraging modern technology for enhanced protection and reduced dwell time. Whether you're a small enterprise or a large corporation, this episode has actionable insights to help you strengthen your security posture.Check out the Material Security Scorecard to measure your Cloud Office Securityhttps://material.security/workspace-security-scorecardRajan Kapoorhttps://www.linkedin.com/in/rajankkapoor/MITRE ATT&CK® Office Suite platform https://attack.mitre.org/matrices/enterprise/cloud/officesuite/

office microsoft security environment cloud stopping attacks kapoor rajan google workspace mitre att material security

S3 Ep49: Guess Who: The Adversary Edition - 2

sector interactive adversary ck mitre att

Play Episode Listen Later Nov 25, 2025 92:04

Can You Identify the Nation-State Actor?‌ ‍ ‍‍‌‍ ‌ ‍‌‍‍‌‌‍‌ ‌‍‍‌‌‍ ‍‍‍ ‍‍‍‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌‍‍‌‌‍ ‍‍‍ ‍‍‌‍‍‌ ‍‌‍‌‌‌‍‌‍‍‍ ‍‍‍‍‌‍‍‌ ‌‌ ‌‌ ‌ ‍‍‍ ‍ ‌‍‍‌‌‍ ‍‌ ‌‌‍‌‌‌‍ ‌ ‌ ‌‍ ‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌ ‌ ‌‌ ‌‌‌‍‌‌‍‍‌‌‍ ‍ ‌‍‍‌‌‍ ‍‌ ‌‌‍‌‌‌‍ ‍‌ ‌‍ ‌‍‌‌‌‍‌‌‍‍‌‌ ‌‍ ‌‍ ‌‌‍ ‌‍‌‌‍‌‌ ‌‌ ‌ ‍‌‍‌‌‌ ‌‍‌‌‌‍ ‍‌ ‌‌‍‌‌ ‌‌‍‍‌‌‍ ‌‍ ‍ ‍ ‌‍‍‌‌‍‌ ‌‌‍‌‍ ‍‌‍‌‍ ‌ ‌‌‍‍ ‍‌‌‍‌‍ ‌‌‍‌‍ ‍‌‍‌ ‌‌‍ ‌ ‌‌‍‌ ‍‌‍ ‌ ‍‌ Out of the Woods: The Threat Hunting Podcast returns for another special edition episode that challenges how you think about adversary behavior. This live, interactive session will focus on a nation-state actor, revealing one phase of their campaign at a time as our hosts provide tradecraft clues and analysis.‌ Participants will examine how observed techniques align to MITRE ATT&CK, how vertical-specific targeting shapes operational decisions, and how behavioral patterns emerge across campaigns. Before the final reveal, attendees will have the chance to submit their best guess on which nation-state threat actor is behind the activity.‌ What You'll Learn:‌ ‍ ‍‍‌‍ ‌ ‍‌‍‍‌‌‍‌ ‌‍‍‌‌‍ ‍‍‍ ‍‍‍‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌‍‍‌‌‍ ‍‍‍ ‍‍‌‍‍‌ ‍‌‍‌‌‌‍‌‍‍‍ ‍‍‍‍‌‍‍‌ ‌‌ ‌‌ ‌ ‍‍‍ ‍ ‌‍‍‌‌‍ ‍‌ ‌‌‍‌‌‌‍ ‌ ‌ ‌‍ ‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌ ‌ ‌‌ ‌‌‌‍‌‌‍‍‌‌‍ ‍ ‌‍‍‌‌‍ ‍‌ ‌‌‍‌‌‌‍ ‍‌ ‌‍ ‌‍‌‌‌‍‌‌‍‍‌‌ ‌‍ ‌‍ ‌‌‍ ‌‍‌‌‍‌‌ ‌‌ ‌ ‍‌‍‌‌‌ ‌‍‌‌‌‍ ‍‌ ‌‌‍‌‌ ‌‌‍‍‌‌‍ ‌‍ ‍ ‍ ‌‍‍‌‌‍‌ ‌‌‍‌‍ ‍‌‍‌‍ ‌ ‌‌‍‍ ‍‌‌‍‌‍ ‌‌‍‌‍ ‍‌‍‌ ‌‌‍ ‌ ‌‌‍‌ ‍‌‍ ‌ ‍‌ ‍‌‍‌‍ ‌ ‍ ‌ ‍ ‍‌ ‌‌‌‍‍‌‍‍‌‍‌‍‌‍‌‌ ‍‌‌‍‌‍ ‌ ‍ ‍‌ ‍ ‌ ‌‌ ‍‌‌ ‌‍‌‌ ‌‌ ‌‍ ‌‍‌‌‍ ‌‍‌‌ ‌ ‌ ‍ ‌ ‌‍‌‌ ‌‌‍‍ ‌‌ ‌‍‌‌‍‌ ‌‍‌‌‌‍‌ ‌‌‌‍‍‌‌‍ ‌‍‌‌‍‌‌‌ ‍‍‌‌ ‌‌‌‍‌‌ ‌‍‍ ‌‍‌‌‌ ‍‌‍‌‌ ‌‌‍‌‌ ‌‌‍‌‌ ‍ ‍‌‍‌‌‍‌‌‍‌‌ ‌‍‌‍ ‍‌‍ Real adversary behavior – A phase-by-phase look at a real nation-state campaign MITRE ATT&CK in context – How techniques appear in real incidents‌ ‍ ‍‍‌‍ ‌ ‍‌‍‍‌‌‍‌ ‌‍‍‌‌‍ ‍‍‍ ‍‍‍‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌‍‍‌‌‍ ‍‍‍ ‍‍‌‍‍‌ ‍‌‍‌‌‌‍‌‍‍‍ ‍‍‍‍‌‍‍‌ ‌‌ ‌‌ ‌ Recognizing tradecraft patterns – What links behaviors across operations‌ ‍ ‍‍‌‍ ‌ ‍‌‍‍‌‌‍‌ ‌‍‍‌‌‍ ‍‍‍ ‍‍‍‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌‍‍‌‌‍ Sector-specific targeting – How industries influence attacker decisions‌ ‍ ‍‍‌‍ ‌ ‍‌‍‍‌‌‍‌ ‌‍‍‌‌‍ ‍‍‍ ‍‍‍‍‌ ‌‍‌‌‍ ‍‌‍‍‌‌ ‌‌ ‍‌‍ ‍‌‍‍‌‌‍ ‍‍‍ ‍‍‌‍‍‌ ‍‌‍‌‌‌‍‌‍‍‍ ‍‍‍‍‌‍‍‌ ‌‌ Interactive analysis – Submit your guess before the reveal‌ Watch the episode here: https://youtu.be/GyYTTMNyjCE?si=WynwmHS1psGN9KqO

Ep. 87 - Code Crashes and Vinyl Scratches // Kevin Greene

Adventures of Alice & Bob

Play Episode Listen Later Sep 22, 2025 55:40

In this episode, James Maude sits down with Kevin E. Green, Chief Security Strategist at BeyondTrust, whose 25+ year career stretches from configuring Nokia firewalls in basements to shaping federal research initiatives. Kevin recalls how crashing systems during penetration tests at Ernst & Young was once considered a win - a “capture the flag” moment - and how he crossed paths with future industry leaders like Stuart McClure and George Kurtz, who went on to found Cylance. He shares his pivotal work in mapping NIST 800-53 controls to the MITRE ATT&CK framework, transforming static security catalogs into threat-informed heat maps that show which defenses light up against real-world attacks. Blending technical depth with cultural insight, Kevin also draws unexpected parallels between cybersecurity and hip-hop — from how attacker techniques echo rapper “signatures” to why his alter ego "Kevtorious" and his "Secure Coding by Nature" brand reflect the creativity and pattern recognition needed in both fields.

young nature code ernst vinyl blending nokia crashes ck nist scratches kevin greene mitre att cylance george kurtz beyondtrust chief security strategist

MITRE ATT&CK (noun) [Word Notes]

Hacking Humans

Play Episode Listen Later Sep 9, 2025 7:43

Please enjoy this encore of Word Notes. A knowledge base of adversary tactics, techniques, and procedures established and maintained by the MITRE Corporation. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/mitre-attck⁠ Audio reference link: “⁠Attack Frameworks - SY0-601 CompTIA Security+ : 4.2⁠,” Professor Messer, YouTube, 29 April 2021.

noun mitre att mitre corporation

MITRE ATT&CK (noun)

Word Notes

Play Episode Listen Later Sep 9, 2025 7:43

Please enjoy this encore of Word Notes. A knowledge base of adversary tactics, techniques, and procedures established and maintained by the MITRE Corporation. CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/mitre-attck⁠ Audio reference link: “⁠Attack Frameworks - SY0-601 CompTIA Security+ : 4.2⁠,” Professor Messer, YouTube, 29 April 2021. Learn more about your ad choices. Visit megaphone.fm/adchoices

noun mitre att mitre corporation

No Threat Intel Team? No Problem. Let's Pretend You Do! with Mike Kosak

Human-Centered Security

Play Episode Listen Later Aug 25, 2025 50:19

In this episode, Mike Kosak explains what threat intelligence really is (Mike's former boss said you have to “rub some thinking on it.”), how to define priority intelligence requirements (PIRs), how to treat model, where to find threat intel, and how to keep in actionable with tight feedback loops—not panic. Key takeaways:Threat intel ≠ data. It's analyzed info focused “walls-out” (what's outside your org), then shared clearly so people can act.Start with PIRs. Ask: What are we protecting? What is most valuable to our company? What might threat actors want? How do they operate? What do we need to know to defend? Do this with a broad set of stakeholders, not just the security team.Communicate clearly and with context. Intelligence is only valuable if it's shared in a way others can understand and act on. Avoid overwhelming people with raw data or inducing panic — provide actionable insights that are right-sized for the audience. Mike's advice: “As a threat intelligence analyst, if you're doing your job right, when somebody hears from you they know they need to act on it. You don't want to be the chicken little where you make everybody freak out about everything.”Start small and iterate. Even if you're a one-person team, you can make a big impact. Use free resources (like MITRE ATT&CK, open-source feeds, or even vendor reports), summarize what's relevant, and push that out. Then refine based on feedback—treat it as a continuous cycle, not a one-and-done project. Mike admits, “I always say it's like painting the Golden Gate Bridge. As soon as you get done, you gotta start back at the other end. That's basically what it is.”Mike Kosak is the Senior Principal Intelligence Analyst at Lastpass. Mike references a series of articles he wrote, including “Setting Up a Threat Intelligence Program From Scratch.” https://blog.lastpass.com/posts/setting-up-a-threat-intelligence-program-from-scratch-in-plain-language

threats intelligence cybersecurity communicate ux setting up no problem pretend user experience ck golden gate bridge information security lastpass mitre att threat intel pirs kosak

[183] Cyber-Snakes, ChaosRATs & AI Villains: Acronis CISO Tells All

TubbTalk - The Podcast for IT Consultants

Play Episode Listen Later Jun 29, 2025 75:47

In this episode, Richard speaks to Gerald Beuchelt. He's the Chief Information Security Officer at Acronis, a company protecting millions of endpoints across 54 data centres, many of them managed by MSPs just like you. He's led security through IPOs, a $5 billion merger, and now heads up the Acronis Threat Research Unit, or TRU. And that's a team uncovering wild cyber threats that potentially pose a risk to all MSPs and their clients.Richard asks Gerald to explain the role of a CISO in his own words, how he got into cybersecurity and how his background in mathematics helps him in his work today.They explore the Acronis Threat Research Unit (TRU) and what Acronis looks like in 2025, with Gerald talking through the changes they've made. He also offers suggestions on how MSPs can deal with vendor fatigue and how bringing everything into one place makes it easier.Richard asks Gerald to explain what a cyber snake and chaosRAT are and how MSPs can support clients using older systems, as well as cyber threats to be aware of and how to educate clients on them.Gerald shares his thoughts on what a security-first MSP is, why EDR and RMM are merging and how MSPs can prepare for that and how AI use by cyber criminals is getting ever more sophisticated.He gives one practical habit MSPs can use to improve their security posture, how to get started with Acronis and make the most of its features and what's coming next for the organisation. Mentioned in This EpisodeAcronisWindows domain networks directory: Active DirectoryComputer programme: KerberosThreat knowledge base: MITRE ATT&CK Verizon breach reportCRM software: SalesforceCyber threat: Sidewinder ATPSpeaker and author: Karl PalachukDark web: Digital UndergroundMSP event: MSP GlobalCyber event: Infosec LondonCloned Richard podcast

ai villains cyber snakes ipo ciso msp tru chief information security officer msps edr acronis mitre att rmm

Ep106: Building Secure and Agile AI Agents at Scale with Anthropic and AWS

AWS for Software Companies Podcast

Play Episode Listen Later Jun 10, 2025 37:20

Security leaders from Anthropic and AWS discuss how agentic AI is transforming cybersecurity functions to autonomously handle everything from code reviews to SOC operations.Topics Include:Agentic AI differs from traditional AI through autonomy and agencyTraditional AI handles single workflow nodes, agents collapse multiple stepsHigher model intelligence enables understanding of broader business contextsAgents make intelligent decisions across complex multi-step workflows processesEnterprise security operations are seeing workflow consolidation through GenAIOrganizations embedding GenAI directly into customer-facing production applicationsSoftware-as-a-service transitioning to service-as-software through AI agentsSecuring AI requires guardrails to prevent hallucinations in applicationsNew vulnerabilities appear at interaction points between system componentsAttackers target RAG systems and identity/authorization layers insteadLLMs hallucinate non-existent packages, attackers create malicious honeypotsGovernance frameworks must be machine-readable for autonomous agent reasoningAmazon investing in automated reasoning to prove software correctnessAnthropic uses Claude to write over 50% of codeAutomated code review systems integrated into CI/CD pipelinesSecurity design reviews use MITRE ATT&CK framework automationLow-risk assessments enable developers to self-approve security reviews40% reduction in application security team review workloadAnthropic eliminated SOC, replaced entirely with Claude-based automationIT support roles transitioning to engineering as automation replaces frontlineCompliance questionnaires fully automated using agentic AI workflowsISO 42001 framework manages AI deployment risks alongside securityExecutive risk councils evaluate AI risks using traditional enterprise processesAWS embeds GenAI into testing, detection, and user experienceFinding summarization helps L1 analysts understand complex AWS environmentsAmazon encourages teams to "live in the future" with AIInterview candidates expected to demonstrate Claude usage during interviewsSecurity remains biggest barrier to enterprise AI adoption beyond POCsVirtual employees predicted to arrive within next 12 monthsModel Context Protocol (MCP) creates new supply chain security risksParticipants:Jason Clinton – Chief Information Security Officer, AnthropicGee Rittenhouse – Vice President, Security Services, AWSHart Rossman – Vice President, Global Services Security, AWSBrian Shadpour – GM of Security and B2B Software Sales, AWSSee how Amazon Web Services gives you the freedom to migrate, innovate, and scale your software company at https://aws.amazon.com/isv/

amazon ai security scale secure agile aws anthropic amazon web services genai cloud computing soc rag ck l1 cloud services security services generativeai mitre att

MITRE ATT&CK Framework

CyberIntel - Talking Cybersecurity and Compliance (Presented by VikingCloud)

Play Episode Listen Later Jun 10, 2025 2:27

In this episode of VikingCloud's CyberIntel, Brian Odian discusses the MITRE ATT&CK Framework.

framework mitre att

S3 Ep28: [LIVE] Guess Who: The Adversary Edition

ITSPmagazine | Technology. Cybersecurity. Society

Play Episode Listen Later May 12, 2025 89:37

Clue by Clue: Can You Name the Threat Actor? Out of the Woods: The Threat Hunting Podcast returns with a special edition live episode built to sharpen how threat hunters think about adversary behavior. Our hosts will walk through a real-world threat actor's activity one phase at a time, revealing tradecraft clues as the investigation unfolds. Listeners will have the chance to analyze the behavior and submit their best guess before the final reveal. This live, interactive session is grounded in real tradecraft and practical threat hunting techniques. You'll see how MITRE ATT&CK techniques map to observed activity, how vertical-specific targeting shapes decisions, and how behavioral patterns can point to attribution faster. What We'll Cover: Real adversary behavior – A phase-by-phase walkthrough of a known threat actor's campaign MITRE ATT&CK in context – How techniques are applied in real incidents Recognizing tradecraft patterns – What links certain behaviors across threat actors Sector-specific targeting – How industry focus shapes attacker decisions Interactive analysis – Submit your guess before the threat actor is revealed live Engage with the Community! Join our Discord server during the episode to follow the clues, connect with other hunters, and share your thoughts in real time. Don't miss this chance to train your instincts and challenge your threat hunting perspective. Join the discussion here: https://discord.gg/DR4mcW4zBr ---- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/

community touch discord clue adversary ck mitre att

Detection vs. Noise: What MITRE ATT&CK Evaluations Reveal About Your Security Tools | A Conversation with Allie Mellen | Redefining CyberSecurity with Sean Martin

Play Episode Listen Later Mar 17, 2025 36:06

⬥GUEST⬥Allie Mellen, Principal Analyst, Forrester | On LinkedIn: https://www.linkedin.com/in/hackerxbella/⬥HOST⬥Host: Sean Martin, Co-Founder at ITSPmagazine and Host of Redefining CyberSecurity Podcast | On ITSPmagazine: https://www.itspmagazine.com/sean-martin⬥EPISODE NOTES⬥In this episode, Allie Mellen, Principal Analyst on the Security and Risk Team at Forrester, joins Sean Martin to discuss the latest results from the MITRE ATT&CK Ingenuity Evaluations and what they reveal about detection and response technologies.The Role of MITRE ATT&CK EvaluationsMITRE ATT&CK is a widely adopted framework that maps out the tactics, techniques, and procedures (TTPs) used by threat actors. Security vendors use it to improve detection capabilities, and organizations rely on it to assess their security posture. The MITRE Ingenuity Evaluations test how different security tools detect and respond to simulated attacks, helping organizations understand their strengths and gaps.Mellen emphasizes that MITRE's evaluations do not assign scores or rank vendors, which allows security leaders to focus on analyzing performance rather than chasing a “winner.” Instead, organizations must assess raw data to determine how well a tool aligns with their needs.Alert Volume and the Cost of Security DataOne key insight from this year's evaluation is the significant variation in alert volume among vendors. Some solutions generate thousands of alerts for a single attack scenario, while others consolidate related activity into just a handful of actionable incidents. Mellen notes that excessive alerting contributes to analyst burnout and operational inefficiencies, making alert volume a critical metric to assess.Forrester's analysis includes a cost calculator that estimates the financial impact of alert ingestion into a SIEM. The results highlight how certain vendors create a massive data burden, leading to increased costs for organizations trying to balance security effectiveness with budget constraints.The Shift Toward Detection and Response EngineeringMellen stresses the importance of detection engineering, where security teams take a structured approach to developing and maintaining high-quality detection rules. Instead of passively consuming vendor-generated alerts, teams must actively refine and tune detections to align with real threats while minimizing noise.Detection and response should also be tightly integrated. Forrester's research advocates linking every detection to a corresponding response playbook. By automating these processes through security orchestration, automation, and response (SOAR) solutions, teams can accelerate investigations and reduce manual workloads.Vendor Claims and the Reality of Security ToolsWhile many vendors promote their performance in the MITRE ATT&CK Evaluations, Mellen cautions against taking marketing claims at face value. Organizations should review MITRE's raw evaluation data, including screenshots and alert details, to get an unbiased view of how a tool operates in practice.For security leaders, these evaluations offer an opportunity to reassess their detection strategy, optimize alert management, and ensure their investments in security tools align with operational needs.For a deeper dive into these insights, including discussions on AI-driven correlation, alert fatigue, and security team efficiency, listen to the full episode.⬥SPONSORS⬥LevelBlue: https://itspm.ag/attcybersecurity-3jdk3ThreatLocker: https://itspm.ag/threatlocker-r974⬥RESOURCES⬥Inspiring Post: https://www.linkedin.com/posts/hackerxbella_go-beyond-the-mitre-attck-evaluation-to-activity-7295460112935075845-N8GW/Blog | Go Beyond The MITRE ATT&CK Evaluation To The True Cost Of Alert Volumes: https://www.forrester.com/blogs/go-beyond-the-mitre-attck-evaluation-to-the-true-cost-of-alert-volumes/⬥ADDITIONAL INFORMATION⬥✨ More Redefining CyberSecurity Podcast:

Miriam Wiesner on Identity Hygiene, Security Tools, and Finding Balance

The PowerShell Podcast

Play Episode Listen Later Dec 16, 2024 40:42

In this episode of the PowerShell Podcast, we sit down with Miriam Wiesner, a Senior Security Research Program Manager at Microsoft, to dive into the fascinating world of security and identity hygiene. Miriam shares her expertise on the GraphAPI and the critical importance of maintaining proper identity hygiene in today's digital landscape. We explore the day-to-day life of a security researcher and discuss how tools like script block logging can provide invaluable insights. Miriam also highlights the power of Kusto for analyzing data and solving complex challenges in the security space. In addition to technical insights, Miriam opens up about the challenges of maintaining a healthy work-life balance, offering a candid look at the human side of working in a demanding and impactful field. Guest Bio and links: Miriam C. Wiesner is a Sr. Security Research Program Manager at Microsoft with over 15 years of experience in IT and IT Security. She has held various positions, including Administrator/System Engineer, Software Developer, Premier Field Engineer, Program Manager, and Security Consultant and Pentester. She is also a renowned creator of open-source tools based in PowerShell, including EventList and JEAnalyzer. She was invited multiple times to present her research behind her tools at many international conferences like Black Hat (USA, Europe & Asia), PSConf EU, MITRE ATT&CK workshop, and more. Miriam is the author of the book "PowerShell Automation and Scripting for CyberSecurity: Hacking and Defense for Red and Blue Teamers." Outside of work, Miriam is a dedicated wife and mother, residing with her family near Nuremberg, Germany. Previous episode with Miriam - https://www.youtube.com/watch?v=0Csw8YYGyCg&pp=ygUObWlyaWFtIHdpZXNuZXI%3D Practical PowerShell Empowerment For Protectors - https://www.youtube.com/watch?v=JgqbR-7O7TI&pp=ygUObWlyaWFtIHdpZXNuZXI%3D Echoes of Intrusion: Demystifying commonly used MS Graph API Attacks - https://www.youtube.com/watch?v=YDK5xYx1rKg&t=677s&pp=ygUObWlyaWFtIHdpZXNuZXI%3D PowerShell ❤️ the Blue Team - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-power-of-data-collection-rules-detect-disabling-windows-defender-real-time-p/4236540 PowerShell Podcast Home page: https://www.pdq.com/resources/the-powershell-podcast/ Listen to the PowerShell Podcast: https://powershellpodcast.podbean.com/

Best Practices for Securing AWS Cloud with Eric Carter

Screaming in the Cloud

Play Episode Listen Later Nov 27, 2024 30:19

Eric Carter of Sysdig joins Corey to tackle the evolving landscape of cloud security, particularly in AWS environments. As attackers leverage automation to strike within minutes, Sysdig focuses on real-time threat detection and rapid response. Tools like Runtime Insights and open-source Falco help teams identify and mitigate misconfigurations, excessive permissions, and stealthy attacks, while Kubernetes aids in limiting lateral movement. Eric introduced the “10-minute benchmark” for defense, combining automation and human oversight. Adapting to constant change, Sysdig integrates frameworks like MITRE ATT&CK to stay ahead of threats. Corey and Eric also discuss Sysdig's conversational AI security analyst, which simplifies decision-making.Show Highlights(0:00) Intro(0:32) Sysdig sponsor read(0:51) What they do at Sysdig(3:28) When you need a human in the loop vs when AI is useful(5:12) How AI may affect career progression for cloud security analysts(8:18) The importance of security for AI(12:18) Sysdig sponsor read(12:39) Security practices in AWS(15:19) How Sysdig's security reports have shaped Corey's thinking(18:10) Where the cloud security industry is headed(20:03) Cloud security increasingly feeling like an arms race between attackers and defenders(23:33) Frustrations with properly configuring leased permissions(28:17) How to keep up with Eric and SysdigAbout Eric CarterEric is an AWS Cloud Partner Advocate focused on cultivating Sysdig's technology cloud and container partner ecosystem. Eric has spearheaded marketing efforts for enterprise technology solutions across various domains, such as security, monitoring, storage, and backup. He is passionate about working with Sysdig's alliance partners, and outside of work, enjoys performing as a guitarist in local cover bands.LinksSysdig's website: https://sysdig.com/Sysdig's AWS Cloud Security: https://sysdig.com/ecosystem/aws/Sysdig's 5 Steps to Securing AWS Cloud Infrastructure: https://sysdig.com/content/c/pf-5-steps-to-securing-aws-cloud-infrastructure?x=Xx8NSJSponsorSysdig: https://www.sysdig.com

amazon ai tools security cloud adapting best practices securing aws frustrations devops kubernetes falco ck mitre att aws cloud sysdig eric carter last week in aws

#169 - Intel Chat: Tools, N. Korean IT workers, GootLoader, FakeBat & Pacific Rim

Play Episode Listen Later Nov 15, 2024 37:42

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled. CVE2CAPEC is a tool developed by Galeax that automates the process of mapping Common Vulnerabilities and Exposures (CVEs) to Common Weakness Enumerations (CWEs), Common Attack Pattern Enumeration and Classification (CAPEC), and MITRE ATT&CK Techniques.This tool helps security researchers identify vulnerabilities within macOS's sandbox restrictions, particularly targeting XPC services in the PID domain marked as "Application" services, which often lack adequate protection.Zscaler's recent blog discusses how North Korean IT professionals are increasingly finding remote work in Western companies, often under disguised identities.In a recent campaign, GootLoader malware has been targeting Bengal cat enthusiasts in Australia using SEO poisoning tactics.After a multi-month absence, the malware loader FakeBat—also known as Eugenloader or PaykLoader—has resurfaced, distributing malware through Google Ads, with a recent campaign exploiting ads for the popular app Notion.Over the past five years, Sophos has been engaged in a complex battle against Chinese state-sponsored cyber adversaries targeting its firewall products. This prolonged engagement, detailed in Sophos' "Pacific Rim" report, reveals a series of sophisticated attacks aimed at exploiting vulnerabilities in internet-facing devices, particularly those within critical infrastructure sectors across South and Southeast Asia.

australia chinese tools western microsoft south seo korean workers application intel slack southeast asia mfa notion google ads macos pacific rim bengal pid powershell sophos zscaler mitre att common vulnerabilities limacharlie xpc

#152 - Intel Chat: sedexp, Volt Typhoon, Citrine Sleet, Clearview AI & RansomHub?

Play Episode Listen Later Sep 5, 2024 37:44

In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.A stealthy Linux malware named 'sedexp' has been evading detection since 2022 by using a persistence technique not yet included in the MITRE ATT&CK framework.The Black Lotus Labs team at Lumen Technologies have uncovered a group of hackers linked to the Chinese government which have exploited a previously unknown software vulnerability to target U.S. internet service providers.Earlier in August, a North Korean hacking group exploited a previously unknown bug in Chrome-based browsers, aiming to steal cryptocurrency, which was reported by Microsoft in a recent update.The Dutch Data Protection Authority, or Dutch DPA, has hit Clearview AI with a €30.5 million fine—about $33.7 million—for illegally collecting data using facial recognition, including photos of Dutch citizens.Energy giant Halliburton has confirmed that its systems were hacked, and intruders were able to steal information following a cyberattack last week.

energy chinese microsoft dutch intel slack chrome linux north korean typhoons ck halliburton clearview ai sleet citrine mitre att volt typhoon lumen technologies limacharlie

How do we patch the right things? - Josh Bressers - PSW #840

Paul's Security Weekly

Play Episode Listen Later Aug 22, 2024 178:57

Every week here on the show we talk about vulnerabilities and exploits. Typically we recommend that organizations remediate these vulnerabilities in some way. But how? And more importantly, which ones? Some tools we have to help us are actually not all that helpful at time, such as: Mitre Att&ck - Don't get me wrong, this is a great project and Adam and team is doing a great job. However, its not a complete picture as we can't possibly know about every attack vector (or can we?). People seem to think if they cover everything in the framework they will be secure. You can't cover everything in the framework because each technique can be utilized by an attack in a hundred different ways. CVSS - Anyone can apply a score, but who is correct? Good that we have a way to score things, but then people will just use this as a basis for what they patch and what they do not. Also, chaining vulnerabilities is a thing, but we seem to lack any way to assign a score to multiple vulnerabilities at once (different from a technique). Also, some things don't get a CVE, how are you tracking, assessing risk, and patching these? CISA KEV - Again, love the project and Tod is doing amazing work. However, what about things that do not get a CVE? Also, how do you track every incident of an attacker doing something in the wild? Also, there is frequency, just because something got exploited once, does that mean you need to patch it right away? How are we tracking how often something is exploited as it is not just a binary "yes, its exploited" or "no, it is not". EPSS - I do like the concept and Wade and Jay are doing amazing work. However, there seems to be a "gut reaction" thing going on where we do see things being exploited, but the EPSS score is low. How can we get better at predicting? We certainly have enough data, but are we collecting the right data to support a model that can tell us what the attackers will do next? This week: YAVD: Yet Another Vulnerable Driver, why bring your own when one already exists, backdoors in MIFARE Classic, wireless hacking tips, AMD sinkclose vulnerability will keep running, you down with SLDP yea you know me, Phrack!, IoTGoats, Pixel vulnerabilities, leaking variables, a DEF CON talk that was not cancelled, Telnet is still a thing, More CNAs, and the last thing Flint Michigan needed was a ransomware attack! Visit https://www.securityweekly.com/psw for all the latest episodes! Show Notes: https://securityweekly.com/psw-840

tod patch pixel amd defcon right things cve flint michigan mitre att telnet josh bressers

#145 - Exploring threat intelligence with Jamie Williams, Threat Intelligence Researcher at Unit 42

Play Episode Listen Later Jul 30, 2024 42:47

On this episode of the Cybersecurity Defenders podcast, we explore threat intelligence with Jamie Williams, Threat Intelligence Researcher at Palo Alto Networks' Unit 42.Jamie is a seasoned professional in the field of cybersecurity. Before joining Unit 42, he made significant contributions at the MITRE Corporation as a Senior Principal Cyber Operations Engineer. During his tenure at MITRE, Jamie led the development of MITRE ATT&CK® for Enterprise, focusing on adversary emulation and behavior-based detections.In addition to his full-time role, Jamie is also a member of the IANS Faculty, where he shares his extensive knowledge and experience with the cybersecurity community. With a rich background that includes time at the National Security Agency, Jamie brings a wealth of expertise to the podcast.Katie Nickels blog can be found here.Google Mandiant's article on requirement-driven intelligence can be found here.

threats researchers enterprise ck national security agency mitre palo alto networks threat intelligence mitre att mitre corporation jamie williams katie nickels

The current state of MITRE ATT&CK.

Play Episode Listen Later Jul 15, 2024 18:37

Rick Howard, The CSO, Chief Analyst, and Senior Fellow at N2K Cyber, discusses the current state of MITRE ATT&CK with CyberWire Hash Table guests Frank Duff, Tidal Cyber's Chief Innovation Officer, Amy Robertson, MITRE Threat Intelligence Engineer and ATT&CK Engagement lead, and Rick Doten, Centene's VP of Information Security. References: Amy L. Robertson, 2024. ATT&CK 2024 Roadmap [Essay]. Medium. Blake E. Strom, Andy Applebaum, Doug P. Miller, Kathryn C. Nickels, Adam G. Pennington, Cody B. Thomas, 2018. MITRE ATT&CK: Design and Philosophy [Historical Paper]. MITRE. Eric Hutchins, Michael Cloppert, Rohan Amin, 2010. Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains [Historic Paper]. Lockheed Martin Corporation. Nick Selby, 2014. One Year Later: The APT1 Report [Essay]. Dark Reading. Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [Book]. Goodreads. Rick Howard, 2020. Intrusion kill chains: a first principle of cybersecurity. [Podcast]. The CyberWire. Rick Howard, 2022. Kill chain trifecta: Lockheed Martin, ATT&CK, and Diamond. [Podcast]. The CyberWire. Rick Howard, 2020. cyber threat intelligence (CTI) (noun) [Podcast]. Word Notes: The CyberWire. Kevin Mandia, 2014. State of the Hack: One Year after the APT1 Report [RSA Conference Presentation]. YouTube. SAHIL BLOOM, 2023. The Blind Men & the Elephant [Website]. The Curiosity Chronicle. Sergio Caltagirone, Andrew Pendergast, and Christopher Betz. 05 July 2011. The Diamond Model of Intrusion Analysis. Center for Cyber Threat Intelligence and Threat Research.[Historical Paper] Staff, n.d. Home Page [Website]. Tidal Cyber. Learn more about your ad choices. Visit megaphone.fm/adchoices

strategy state medium diamond analysis att senior fellow current state goodreads chief innovation officer cso lockheed martin ck information security intrusion mitre cti blind men sahil bloom chief analyst centene mitre att cyber threat intelligence dark reading threat research rick howard curiosity chronicle cyberwire lockheed martin corporation kevin mandia nick selby amy robertson sergio caltagirone

Conspiracy theories in politics.

Play Episode Listen Later Jul 15, 2024 32:14

The assassination attempt on former President Trump sparks online disinformation. AT&T pays to have stolen data deleted. Rite Aid recovers from ransomware. A hacktivist group claims to have breached Disney's Slack. Checkmarx researchers uncover Python packages exfiltrating user data. HardBit ransomware gets upgraded with enhanced obfuscation. Threat actors can weaponize proof-of-concept (PoC) exploits in as little as 22 minutes. Google may be in the market for Wiz. Rick Howard previews his analysis of the MITRE ATT&CK framework. Blockchain sleuths follow the money. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. This Week on CSO Perspectives Dave chats with Rick Howard, The CSO, Chief Analyst, and Senior Fellow at N2K Cyber, about his latest episode of CSO Perspectives which focuses on the current state of MITRE ATT&CK. If you are a N2K Pro subscriber, you can find this installment of CSO Perspectives here. The accompanying essay is available here. If you're not a subscriber and want to check out a sample of the discussion Rick has with his Hash Table members about MITRE ATT&CK, you can find it here. Selected Reading Conspiracy theories spread swiftly in hours after Trump rally shooting (The Washington Post) AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records (WIRED) Pharmacy Giant Rite Aid Hit By Ransomware (Infosecurity Magazine) Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data (HackRead) Malicious Python packages found exfiltrating user data to Telegram bot (Computing) HardBit ransomware version 4.0 supports new obfuscation techniques (Security Affairs) Hackers use PoC exploits in attacks 22 minutes after release (Bleeping Computer) Google is reportedly planning its biggest startup acquisition ever (The Verge) Automotive SaaS provider CDK paid $25 million ransom to hackers (BeyondMachines.net) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

Episode 368: The Latest on MITRE ATT&CK with Cat Self

Mac Admins Podcast

Play Episode Listen Later Jun 18, 2024 68:17

In this episode, we'll talk about security, ATT&CK, and the changing landscape of Mac security with one of our favoritest guests, Cat Self. Hosts: Tom Bridge - @tbridge@theinternet.social Marcus Ransom - @marcusransom Guests: Cat Self - LinkedIn Links: MITRE ATT&CK® Getting Started with ATT&CK (video) ATT&CK Framework v15 Update Log What is STIX/TAXII? | Cloudflare Blog on pulling MITRE ATT&CK data sources with JuypterLab Malware Unicorn: Dylib Injection Attacks Atomic Red Team Tests I created Lutherans Atomic Test Harness zScaler Advisories https://x.com/Technop54777070/status/1788603343843074187 Claimed by hackers, Zscaler says there's no impact or compromise | Cybernews The ESF Playground – The Mitten Mac A Deep Dive into the OceanLotus Adversary Emulation for macOS & Linux https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/ocean_lotus/Emulation_Plan/OceanLotus_Scenario.md Sponsors: Kandji 1Password Watchman Monitoring If you're interested in sponsoring the Mac Admins Podcast, please email podcast@macadmins.org for more information. Get the latest about the Mac Admins Podcast, follow us on Twitter! We're @MacAdmPodcast! The Mac Admins Podcast has launched a Patreon Campaign! Our named patrons this month include Weldon Dodd, Damien Barrett, Justin Holt, Chad Swarthout, William Smith, Stephen Weinstein, Seb Nash, Dan McLaughlin, Joe Sfarra, Nate Cinal, Jon Brown, Dan Barker, Tim Perfitt, Ashley MacKinlay, Tobias Linder Philippe Daoust, AJ Potrebka, Adam Burg, & Hamlin Krewson

mac claimed zscaler william smith dan mclaughlin mitre att dan barker jon brown mitre att ck justin holt

Kingdom come, kingdom fall.