Threat Research at SnapAttack now part of Splunk now part of Cisco / Detection Engineering / Dad | #DetectionEngineering #ThreatHunting #PurpleTeam | Header art from http://art.vx-underground.org.https://bsky.app/profile/ajking.iohttps://bsky.app/profile/ajking.io/post/3lgqi7e5ets2mReminder: Don't neglect ESXi logging! SSH Tunneling is being used for persistence on ESXi servers. https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/ I'll just put this here: https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec2127 Jan 2025 17:38 +0000at://did:plc:ngdvb2v5ptbdsdudlpltvkvs/app.bsky.feed.post/3lgqi7e5ets2mhttps://bsky.app/profile/ajking.io/post/3lgggytuc522mTIL there is a LOLESXi project. lolesxi-project.github.io/LOLESXi/ Great post by @n-burns.bsky.social on ESXi logging! It includes a tool he made to make running adversarial tests against ESXi easier. It also includes some detections! https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec2123 Jan 2025 17:50 +0000at://did:plc:ngdvb2v5ptbdsdudlpltvkvs/app.bsky.feed.post/3lgggytuc522m