Mechanical Engineer turned Developer turned Pentester turned Red Teamer turned Blue-ish Purple. Instructor for Antisyphon Training. GIAC GSE Certification.
Meridian, Idaho
Joined October 2014
- Tweets1.5K
- Following407
- Followers4.6K
- Likes2K
Carrie Roberts retweeted
@Antisy_Training is Powered by BHIS!
Antisyphon Infosec Training is here to disrupt the traditional training industry by providing high-quality and cutting-edge education to everyone, regardless of their financial position.
They offer:
-Live Training
-On-Demand Training
-Weekly Anticast available live on YouTube at youtube.com/@AntisyphonTrain…
-Pay-Forward-You-Can Classes & Workshops
-Free Summits
-And more!
Keep up with all things Antisyphon Training at antisyphontraining.com/
Carrie Roberts retweeted
It's that time of year. We are pleased to bring you HackNWA Conference 2025: Sock Puppet Tycoon - Disposable Machine, Network, Server, Client and Identity;Make frens and influence ppl
Great speakers, activities, panelists, and afterparty concert in Bentonville
Get your tickets!
Carrie Roberts retweeted
Excited to share AtomicGen.io, a platform I’ve built to simplify #AtomicRedTeam test creation.
Discover more: atomicgen.io
Github Link: github.com/krdmnbrk/atomicge…
#detectionengineering #attacksimulation @redcanary
Carrie Roberts retweeted
This week I will be speaking @WWHackinFest Mile High!
I am really excited to share some tips, techniques, and resources regarding PowerShell for Linux.
If you are interested in attending you can more information here: sched.co/1tRKg
Carrie Roberts retweeted
**NEW** BHIS | Guest Blog
How did you prepare for your career in cyber security?
From Highschool to Cyber Ninja—for Free (Almost)!
by: @OrOneEqualsOne
Published: 6/19/2024
Learn more: blackhillsinfosec.com/from-h…
Carrie Roberts retweeted
@OrOneEqualsOne is teaching another run of her Pay-What-You-Can class, "MITRE ATT&CK Framework and Tools," March 5, 12-4 p.m. ET! Details and registration here: antisyphontraining.com/event…
Carrie Roberts retweeted
Another Anti-Dote Rx is ready for pickup --- Search PowerShell History and Repeat Commands with Ctrl+R and Ctrl+S | @OrOneEqualsOne
youtube.com/watch?utm_campai…
Be sure to check out Carrie's class, "PowerShell for InfoSec: What You Need to Know!" → antisyphontraining.com/on-de…
Carrie Roberts retweeted
As always, @TheDFIRReport brings receipts. Great thread on an unusually well-documented script full of capabilities.
Carrie Roberts retweeted
DarkGate emerged as the #6 threat in our Intelligence Insights last month. Our Intel team identified a detection opportunity for this new malware-as-a-service (MaaS). Read more: redcanary.com/blog/intellige…
Carrie Roberts retweeted
🛠️ Dive into our latest #LOLDrivers article where we unveil the meticulous process of adding a bulk of drivers, inspired by the excellent research from @cci_forensics 🧵 blogs.vmware.com/security/20…
Big shoutout to: @cci_forensics, @cyb3rops, @nas_bench, and @_josehelps!
🔗 And here's our piece on Medium for an exclusive behind-the-scenes tour: medium.com/magicswordio/a-be…
What's Inside:
The Carbon Black Threat Analysis Unit’s discovery of 34 vulnerable drivers.
Our Python-fueled journey from gathering MD5 hashes to enriching driver metadata.
From manual CSV/YAML conversion to full-blown automation with a side of YARA magic.
📈 From a handful to 200+ hashes, we show how scaling is more art than science, leveraging #automation and strategic tooling to turn complexity into simplicity.
👩💻 Peek into our Python scripts that churn through the data, standardizing file names and enriching YAML files with gusto.
🧙♂️ With the aid of @nas_bench's metadata-extractor, and @cyb3rops's YARA contributions, we're generating on the fly enrichment!
➡️ Swipe through the transformative steps:
1️⃣ Gather The Hash
2️⃣ Streamlining with Automation
3️⃣ YAML Generation Script Revealed
4️⃣ File Renaming - A Pythonic Twist
5️⃣ Metadata Enrichment – The Finishing Touch
🎯 Finally, the genesis of YARA rules and our site generation script that binds everything together, ensuring #LOLDrivers is as robust and accessible as ever!
The article is live NOW – Read, learn, and let’s secure our systems together! 🌐
medium.com/magicswordio/a-be…
Carrie Roberts retweeted
I've just released the next edition of the On Detection series. I investigate why detection rules based on Process Creation are often brittle or easily bypassed. I also provide a framework for discerning when it is appropriate and when it isn't.
posts.specterops.io/on-detec…
Carrie Roberts retweeted
Hands down my favorite conference of the year.
As @0sm0s1z said, it's more hugs than handshakes here.
I don’t say this lightly because there’s nothing light about this legacy but if you are missing the vibes of @DerbyCon (aren’t we all) you will find them and more @WWHackinFest. Make this a part of your travel plans next year.
Carrie Roberts retweeted
This is a great opportunity to work with an awesome team! And the salary is competitive as well. Check it out!
ATT&CK is looking for our next CTI lead! You'd be in charge of our Groups/Campaigns/Software, ATT&CK's CTI strategy, which reports we add, the team who adds/updates CTI in ATT&CK, and final review of procedures. You can check out the posting and apply at: mitre.wd5.myworkdayjobs.com/…
Carrie Roberts retweeted
Today's Anti-Dote Rx: PowerShell: Where Do Those Magic Variables Come From? with @OrOneEqualsOne ! youtube.com/watch?utm_campai…
Be sure to check out Carrie's On-Demand class, "PowerShell for InfoSec: What You Need to Know!": antisyphontraining.com/on-de…
Carrie Roberts retweeted
This week's Anti-Cast, "Exploring PowerShell Logging with TellTail," is with the one and only, @OrOneEqualsOne ! Join us this Wednesday at 12 p.m. EDT and of course, PreShow Banter™ at 11:30 a.m. EDT. Register here: blackhillsinfosec.zoom.us/we…
Carrie Roberts retweeted
10 Hacks to Bypass PowerShell History Log | @OrOneEqualsOne | Offensive Con 2023 youtube.com/watch?utm_campai…
Carrie will be teaching her "MITRE ATT&CK Framework and Tools" class Aug. 24 at our Antisyphon Blue Team Summit! Details and registration here: antisyphontraining.com/event…
Carrie Roberts retweeted
Couldn't find a better way to illustrate 'hunting naked' than this image from the talk @_josehelps and I gave at BsidesSplunk last year. Also, if you haven't tweaked your Sysmon config for better 'naked hunting', here you go: gist.github.com/MHaggis/66dd…
Carrie Roberts retweeted
Antisyphon Blue Team Summit 2023 presents:
"MITRE ATT&CK Framework and Tools" w/ @OrOneEqualsOne
4 hours | PWYC $25-150 | Aug. 24 | Register: antisyphontraining.com/event…
Carrie Roberts retweeted
This will be a unique one to listen 📺in on. Last year, how to hunt 🏹, this year with the release of #LOLDrivers and our next release of Bootloaders, this talk will be a great one for defenders to better understand how to gather and hunt both! 🛡️
Join us at #DFIRSummit when @M_haggis & José Hernandez will dive into the depths of #bootkits and #rootkits, exploring their inner workings and the techniques they employ to maintain a firm grip on their targets.
Don't miss out, register here: buff.ly/433Ls6x
#DFIR
