Lazysecurity on the hellsite and infosec.exchange. Secops geek. Detection engineering, threat hunting & IR mostly. Occasionally helps out with some analysis or testing pens. Former BSidesLondon organiser.https://bsky.app/profile/paulbatson.bsky.socialhttps://bsky.app/profile/paulbatson.bsky.social/post/3lpg5m4yyfc2zI don’t think I’ll ever get tired of the sunsets in the Philippines18 May 2025 03:48 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lpg5m4yyfc2zhttps://bsky.app/profile/paulbatson.bsky.social/post/3ljvoaxn4bk2yThink I’ll be having a play with this today and see what detection opportunities are in there #linux #ttp #detectionengineering https://github.com/Aegrah/PANIX/releases/tag/panix-v2.1.008 Mar 2025 23:25 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3ljvoaxn4bk2yhttps://bsky.app/profile/paulbatson.bsky.social/post/3lhwdxll32s2jDo any of my followers have any contacts at Snapchat? A close friend has been phished but realised a couple of mins later and reset her creds. The email she has received afterwards isn't clear if the attempted auth was successful or not. She is fraught with worry. Please repost for visibility.11 Feb 2025 19:03 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lhwdxll32s2jhttps://bsky.app/profile/paulbatson.bsky.social/post/3lbzt772ock26https://www.welivesecurity.com/en/eset-research/bootkitty-analyzing-first-uefi-bootkit-linux/28 Nov 2024 19:43 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lbzt772ock26https://bsky.app/profile/paulbatson.bsky.social/post/3lbq7y2rsgf2zFor anyone just getting into detection engineering or hunting, I’d strongly recommend starting out by making sure you’re collecting process events (with full command lines), persistence locations (eg. scheduled tasks, services, reg run keys, cron, etc) and process network connections.25 Nov 2024 00:05 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lbq7y2rsgf2zhttps://bsky.app/profile/paulbatson.bsky.social/post/3lblfq2vvmk2qWhilst helping someone out with their gmail security, I’ve just realised they offer darkweb/leak monitoring. How did I not know about this already?23 Nov 2024 02:04 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lblfq2vvmk2qhttps://bsky.app/profile/paulbatson.bsky.social/post/3lbft3aen6227🧵1/5 For anyone wondering why they put up with the stress of a role in infosec (I know I have wondered sometimes in the past) please consider the following. We all know ransomware TAs affect companies and their bottom line. And there’s an understanding that it affects individuals too..20 Nov 2024 20:47 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lbft3aen6227https://bsky.app/profile/paulbatson.bsky.social/post/3lbbfp6fow42qThis is a really interesting read from a Russian IR company on some pretty stealthy nix malware. (Hat tip to @patrick.risky.biz / Risky Business for highlighting it). Some good detection opportunities in there. Russian language but Google translate does a great job. https://rt-solar.ru/solar-4rays/blog/4861/19 Nov 2024 02:37 +0000at://did:plc:ugdcdmi26ihdpqk4ahraf3vu/app.bsky.feed.post/3lbbfp6fow42q