Andrew Cook @whoisAndrewCook

Finding and stopping threats one day at a time, @Recon_InfoSec SecOps. Threat Hunting. Incident Response. reconinfosec.com Austin, TX Joined February 2009

Tweets

20
Followers

144
Following

156
Likes

43

Andrew Cook @whoisAndrewCook

3 years ago

@joevest @BSidesTampa I'll be there with a handful of @Recon_InfoSec folks, including @shortxstack and @eric_capuano!

0 0 4 25 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@intigriti Here's @OpenAI's attempt at becoming a bug bounty hunter. How do we think it did? It certainly threw out a bunch of valid looking guesses, but did any come close enough to claim a win?

1 0 1 0 1

View Details

@SiriusCyberntx In general, tune the source whenever possible. That said, the real trick is having a process to tune false positives quickly and with minimal friction, which may mean “tactically” tuning at the SIEM where the workflow can be centrally managed and controlled.

2 0 3 0 1

View Details

Andrew Cook @whoisAndrewCook

4 years ago

Join now! Not recorded and @rj_chap will be dropping some ransomware knowledge bombs!

Recon InfoSec @Recon_InfoSec

4 years ago

Join us TODAY @ 12:30pm CT (in 2 hrs!) for THURSDAY DEFENSIVE! Today's guest: @rj_chap, chatting about Ransomware. reconis.co/3SHqPYs #infosec #thursdaydefensive

0 2 4 0 0

0 2 3 0 0

View Details

Mark Tenenholtz @marktenenholtz

4 years ago

Python 3.11 is out! 🎉 This is one of the most exciting releases in a while, including significant speed upgrades and better error messages. Here's what's new:

93 2K 13K 0 2K

View Details

Andrew Cook @whoisAndrewCook

4 years ago

As we watch Basic Auth in O365 finally start to die off, I find myself reflecting on how ridiculously long we've lived with MFA Bypass as a thing. Those incident & pentest findings were brutal for orgs that thought their heroic efforts to roll out MFA had done some good.

0 0 2 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

I can hear my high school physics teacher sigh every time

0 0 3 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

I thought "hey, maybe #Linux🐧is ready for regular people" and got my wife all set up👍 Two weeks later she's stuck in a black initramfs boot loop and I'm scrolling linux forums like it's 2007 to intone the right CLI-magic to fix the thing👎 Guess I'll try again in 3 more yrs🤷

0 1 6 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

Starting now! Not recorded, so be there or be square! #infosec #blueteam

Recon InfoSec @Recon_InfoSec

4 years ago

Join us TODAY @ 12:30pm CT (in 2 hrs!) for THURSDAY DEFENSIVE! Today's guest: @_bromiley of @limacharlieio chatting about #DFIR , Blue Team, Defense, Giving Bad Guys Headaches. reconis.co/3rfZMIk #infosec #thursdaydefensive

0 8 8 0 1

0 0 0 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@tuckner @JimmyVo @OpenAI Veerrry interesting. When your automation is creating your automation we're getting scary close to the singularity.

1 0 2 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@JimmyVo you gave me an idea....will @OpenAI be writing our threat detections next? Here's a first attempt without any special training data; it seems to get the gist of it. Will we someday skip this human-centric step completely? #Blueteam #BlueteamAI

1 0 2 0 0

View Details

Recon InfoSec @Recon_InfoSec

4 years ago

0 8 8 0 1

View Details

Andrew Cook @whoisAndrewCook

4 years ago

First one to tell me how @OpenAI will replace my #infosec job wins my eternal gratitude. I've got a mortgage to pay and food to eat.

Andrew Cook @whoisAndrewCook

4 years ago

1 0 2 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

Aachccccccucjrdciiindrlhrkrtifidrvdcdiltgrteuhoooo! Gesundheit! If you suffer from chronic #Yubisneeze, ask your doctor if Swapping Slots™ is right for you: support.yubico.com/hc/en-us/artic… @Yubico

0 3 2 0 1

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@alexstamos Hilariously well said. Also, you can bypass that dumb virtual keyboard manually and automagically. Your “secure” design shouldn’t encourage users to install random scripts :/ reddit.com/r/Bogleheads/c…

0 0 0 0 0

View Details

Wes Lambert @therealwlambert

4 years ago

🦖Day 29 of the @velocidex #velociraptor #ArtifactsOfAutumn series Artifact: 'Exchange[.]Windows[.]Registry[.]NetshHelperDLLs' Author: @eric_capuano Link: docs.velociraptor.app/exchange/artif…

1 6 8 0 3

View Details

Andrew Cook @whoisAndrewCook

4 years ago

Messing around with @OpenAI looking for some interesting #BlueTeam use cases is like playing two truths and a lie: shocking accuracy followed complete fiction. Here's the (slightly modified) 2021 Kesaya attack as analyzed by a robot. Any lies? Try it out! beta.openai.com/playground/p/r…

2 3 10 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@eric_capuano @Recon_InfoSec Thanks for the nudge, Eric! Just had to remember the ol' password...Winter2009! did the trick.

1 0 6 0 0

View Details

Andrew Cook @whoisAndrewCook

4 years ago

@Recon_InfoSec....are we the baddies? @OpenAI seems convinced that we're on the wrong team. 🤔 I don't know who to believe any more 😬 youtu.be/hn1VxaMEjRU