Chainkit cyber integrity automation

New open source tool for defenders to detect when attackers try to tamper with Event Tracing for Windows (ETW) to suppress the logs of their actions on endpoints: github.com/nccgroup/DetectWi… thanks to @NCCGroupInfosec for publishing this!

one time i made a suggestion to a vendor for more logging to be possible in their tool and they responded, “we’re a security company, not a logging company” and my colleague quickly quipped back with “you cannot be a good security company if you’re not a great logging company”.

This took almost a year to get through the disclosure approval process, but here's the @NetSPI blog that covers the privilege escalation issue (now fixed) that we found with the Azure Log Analytics Contributor role - netspi.com/blog/technical/cl…

I like the idea of storing logs for at least 6 months. Storing netflow for at least a month. And storing full pcaps for the last week. This gives you a good set of data to do investigations with if you need to.

Not just @azure. This is about a critical point of failure in cloud’s #SharedResponsibility model, present in @awscloud & @googlecloud as well When logs can be tampered with - quis custodiet ipsos custodes? With digital ⛓Chains of Custody⛓ you can finally guard the guardians

ever wanted to fake sign a binary, but didn't want to install additional dependencies? well now you can using my super 1337 automation github.com/jfmaes/LazySign this tool was very hard to create, I swear! I may or may not have been inspired by Conti.