I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
While @JBeanDesign appreciates everything I’ve been getting done around the house, somebody PLEASE pull me in on some interesting casework! #DFIRMrMom
2
Corporate InfoSec is vastly more complicated than locking a car door, and is not a core business function for most companies. They’ll never get pro-active about security to any meaningful level. Maybe they shouldn’t have to.
Hal Pomeranz retweeted
Welcome back to #TipTuesday! We figure everyone needs tips about #Powershell so check it out and share with your friends!
4
4
I'm getting extremely fed up with the victim-blaming in InfoSec. Nobody has a security budget that exceeds their attack surface, and few companies have sufficient staffing. So who's "fault" is that breach exactly?
3
2
25
Hal Pomeranz retweeted
It's not always possible to scan every device in your network for crypt mining malware (Linux boxes, IOT, App containers)
But you could check your DNS & firewall logs for connections to the limited number of mining pools
I've compiled a list for you
nextron-systems.com/2021/10/…
24
460
18
1,500
Upgrade to a new iPhone for "free" with trade-in... as long as you agree to the 36-month installment plan during which your phone is carrier locked (inluding the eSIM). I'm calling BS on you @ATT.
1
8
Hal Pomeranz retweeted
I don't think the @debian folks get enough praise.
11.1 is just about perfection. What a rocking platform!
Thanks for all the hard work you do!
3
8
Coming soon to WWHF training— a two-day course full of Linux Command-Line goodness. And oh yes, there will be sed and awk!
1
3
Hal Pomeranz retweeted
1\ Threat actors leave behind traces on disks that end up incriminating them or giving away that they are Russian/Ukranian.
If you ever see RDP events, you should parse out the RDP bitmap cache. It maps out bitmap images of a user's RDP session.
#DFIR
15
393
22
1,452
Hal Pomeranz retweeted
I found some private keys on VT, enabling all of us to decrypt C2 traffic from a subset of all the malicious Cobalt Strike servers that are out there on the Internet. More details: "Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1" blog.nviso.eu/2021/10/21/cob…
4
269
12
633
Wow, I wrote this 10 years ago. A friend used it today to mount an encrypted Linux image. Evergreen content. deer-run.com/users/hal/CEIC-…
3
19