Collect NTFS forensic information with osquery blog.trailofbits.com/2018/05/28/col…

Thank you @Kolideco for both the work to host such a great QueryConf as well as setting the tone of a frank AND positive gathering. & of course applause to the great speakers & viewpoints as well as the opportunity to present from a position of being the new person 🤩❤️☮️ x.com/dallendoug/sta…

Thank you DerbyCon for all the work that goes into #DerbyCon I appreciate the opportunity to present - subject is “Terminate & Stay Resident Redux”

It’s October! That means ATT&CK ATT&CKcon is right around the corner. I’m looking forward to presenting on the combo of osquery and ATT&CK and will sneak in a reference to filippo mottini and @polylogyx too!

Thank you ATT&CK for all the work that went into #ATTACKcon 2018. Many learnings and great people. Looking forward to what comes next!

The power of “bring your own [encryption] key” aka #byok is everything _other_ than the key. It forces a level of rigor around how, why, and by who data is accessed and how that access is audited. In short, it drives one to design with real respect for customer data.

The CFP for QueryCon19 ends in *one week*. Four speaking slots remain. Submit your abstract today, and join a great lineup of speakers! papercall.io/querycon19

The magic of Jimmy Sanders is that, to me, I can't help but feel that there is nothing that can't be done. #cbconnectlondon2019

Welcome Haim and the entire Octarine team to vmw_carbonblack! Security is a team sport and you are a great team - can't wait to get started! tcrn.ch/3cIVK1S

All of the alternatives, on balance, are worse. Even with it’s demonstrated downsides.

“Dominik Livaković (born 9 January 1995) is a Croatian professional footballer who plays as a goalkeeper for Prva HNL club Dinamo Zagreb and the Croatia national team. He is a destroyer of all nations' dreams representing Croatia.” — Wikipedia opening paragraph

🚀 Introducing ⭐️LOLDrivers 2.0 ⭐️! A milestone release that enhances user experience, threat detection, and much more. Check out the Yara Generator integration, a vast addition of 750+ new drivers and MUCH more! medium.com/magicswordio/l… Nasreddine Bencherchali Jose Enrique Hernandez

Everyone is risk averse. People just fear different things

Lives up to its name patty mccord - One hour to read, but many more to internalize. I’ve been passing them out! pattymccord.com/book/

Quote by Will Schroeder in Andy Robbins’s talk at #TR18

economist.com/news/britain/2… from The Economist My view: the analysis of the “open vs closed” idea is biting & very close to mark, both in UK & USA. The counterproposal “The Real Divide” is not fully baked but has legs. @JDVance1 I’d be interested in your view.

Love what you guys are doing - great for the industry and great for the community! x.com/mitreattack/st…

Windows HANDLE and base named objects enumeration example at github.com/scottlundgren/… - next step to integrate as a pair of virtual tables with osquery (github.com/facebook/osque…)