-Yiannis- @Sec_GroundZero

Pentester / RnD / developer of the #WarBerryPi and sometimes just ¯\_(ツ)_/¯. https://t.co/VB1rHghqUx. Opinions and tweets represent me not my company. github.com/secgroundzero/… Joined October 2013

Tweets

2K
Followers

3K
Following

519
Likes

779

-Yiannis- @Sec_GroundZero

4 years ago

First post after a long long time. I had the opportunity to present at @EXNESS behind-the-code event at a unique setting. The interaction and networking at a physical event was refreshing.

1 18 8 0 0

View Details

It's Launch Day for #CloudBreach! Register for #BreachingAzure Lab and get 25% discount code using the promo code "LAUNCHDAY25". #BreachingAzure challenges students to utilise the latest offensive techniques in a realistic hybrid environment. Are you ready to breach the cloud?

0 21 7 0 1

View Details

Matt Eidelberg @Tyl0us

5 years ago

Shoutout to @GeorgePatsias1 for his very cool project github.com/GeorgePatsias/…. #netsec #infosec #redteam

0 66 101 0 15

View Details

-Yiannis- @Sec_GroundZero

5 years ago

@rpargman @DebugPrivilege @olafhartong Very happy to hear that. I learned a lot from the people sharing their work.

0 5 4 0 0

View Details

-Yiannis- @Sec_GroundZero

5 years ago

So i polished my KQL notes and ended up with a 70 page long pdf. You can find it here github.com/secgroundzero/… Thx and credits also go to @DebugPrivilege @rpargman @olafhartong as i rely a lot on their insights.

4 100 236 0 61

View Details

-Yiannis- @Sec_GroundZero

5 years ago

@arcanecode Thank you. I use notion for technical notes and obsidian for non tech research/book but i will check this out as well.

0 0 0 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

Switched from Evernote to Notion and finally my notes are starting to make visual sense.

2 0 27 0 6

View Details

-Yiannis- @Sec_GroundZero

5 years ago

@Max_Mal_ @olafhartong @falconforceteam This might be different as the PE header is also changed if i am reading this correct in order to bypass this detection.

0 2 1 0 0

View Details

-Yiannis- @Sec_GroundZero

5 years ago

Quick KQL query to hunt for renamed lolbins not running from c:\windows, \system32 or \syswow64. @olafhartong showed it in a more elegant way for MDE as part of the @falconforceteam FalconFriday. #threathunting (medium.com/falconforce/fa…) gist.github.com/secgroundzero/…

2 24 70 0 12

View Details

-Yiannis- @Sec_GroundZero

5 years ago

First attempt with standard dev in KQL based on @rpargman beaconing analysis to detect potential bruteforce attacks with EID4625. gist.github.com/secgroundzero/…

0 4 15 0 2

View Details

-Yiannis- @Sec_GroundZero

5 years ago

Discord bot cnc github.com/GeorgePatsias/… - @GeorgePatsias1

0 2 5 0 0

View Details

Monica @MonicaPolemitis

6 years ago

Last Tuesday I moderated an event organized by the Int'al Chamber of Commerce National Committee of CY,titled Digital Economy&the Importance of ICT for Business in a post-COVID environment. If you didn't have the chance to watch it, check out the recording lnkd.in/dhxHg2n

0 15 10 0 1

View Details

-Yiannis- @Sec_GroundZero

6 years ago

4 days of intense detection engineering training with @olafhartong done. So much info to ingest from the trainers and the great course participants. Now back to that detection cycle.

3 2 18 0 1

View Details

-Yiannis- @Sec_GroundZero

6 years ago

Day 1 of @falconforceteam detection engineering course done. Amazing content, tons of new learning and @olafhartong makes it easy. Looking forward for the next days.

2 1 11 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

@s4n7h0 @InfoSecCampus Any of the projects @olafhartong is working on

0 7 3 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

Answer is that they don't have to be normalized. EQL understands the schema and it can be queried directly.

-Yiannis- @Sec_GroundZero

6 years ago

Help needed: anyone normalized security logs with eqllib? Sysmon is fine and i see that security logs are supported but the format it not identified @EndgameInc

0 1 1 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

@0xffhh @DebugPrivilege Little bit of a hacky solution but I think i got it working working with milliseconds. gist.github.com/secgroundzero/…

0 0 1 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

Is there a way to do similar to EQL (sequence with maxspan) with KQL? Basically want to compare the time generated of 2 different events. #azure #Sentinel

1 2 3 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

1986 when my dad (center) was the distributor for the new North Star microcomputers (mainframes) in Cyprus.

0 0 8 0 0

View Details

-Yiannis- @Sec_GroundZero

6 years ago

@0xffhh @DebugPrivilege As you said it wont be elegant it seems. I dont think ago will do it but i will try with datetime_diff. went through @DebugPrivilege guide but couldnt find anything close to this. Probably do 2 let commands to hold each date from and then compare the two. Union & iif or something