Today i'm releasing my approach for hunting and classifying the frontier of AI-integrated malware: CAIRN. Attacker innovation IS the threat surface.

I invite you to contribute, run your own instance and analysis, or simply follow along with mine!

blog.talosintelligence.com/introducing-ca…

CLOSEDQUORUM, discovered via CAIRN, demonstrates a fully autonomous command-and-control architecture. I see this malware as an early template for demonstrating constrained decision-making, steered by AI, in a way that can extend across the attack-chain.
blog.talosintelligence.com/the-closed-quo…

Fine-tuning IS representational drift. Security models can improve on evaluation metrics while drifting into susceptibility to common adversarial rewrites & evasion techniques.
📖 Blog: lnkd.in/eQTatVZe
📄 Paper: lnkd.in/e4MHb522
💻 Code: lnkd.in/eTFgVEJX

Mechanistic Interpretability lets us see into the transformer, as a decision like a security classification progresses. Aside from being wildly cool -- I'm interested in whether these techniques will continue to be useful in domains like monitoring agents: linkedin.com/pulse/applied-…

@AnthropicAI can you PLEASE acknowledge and try to correct reports around Claude making up filepaths and wasting customer time and money? It's burning my tokens and never happens with any other agents.

github.com/anthropics/cla…
github.com/anthropics/cla…
github.com/anthropics/cla…

It’s here! 🎉 @iknowuhack and I coauthored The Threat Hunter’s Cookbook and we’re thrilled to finally share it.

Built for defenders at every level with hunting methods from simple filtering to advanced clustering.

👉 Get the eBook: splunk.com/en_us/form/thr…

The Threat Hunter’s Cookbook drops at @BlackHatEvents!

Huge thanks to my co-author @iknowuhack for bringing this project to life and @meansec for the forward.

Come celebrate with #SURGe and grab a signed copy at @splunk’s After Party!

🖤 splunk.swoogo.com/splunkafterpar…

Due to high demand, the CFP deadline for CAMLIS 2025 is extended to next Friday, July 4. Submit your full-length paper or extended abstract here: camlis.org/call-for-papers.

The student scholarship deadline remains today!

LLMs offer improving capabilities to cyber-attackers. By pairing these capabilities with autonomous 'agents', attackers may soon be able to outsource key stages of their workflow to increase the speed, scale, or precision of their operations lnkd.in/g9YVpJvT @splunk #SURGe

New LLM honeypot just dropped from @splunk

➡️github.com/splunk/DECEIVE

Big thanks to @likethecoins and SANS for having the #PEAK #ThreatHunting team (@letswastetime and @iknowuhack) on their livestream today. What a fun conversation, and excellent audience questions too!

If you missed it, catch the recording at buff.ly/4iGANqR

🎯 Introducing PowerShell-Hunter: Your New Favorite Event Log Analysis Tool!

🔍 Tired of drowning in PowerShell logs? We've got you covered:
• Smart pattern detection for malicious behaviors
• Risk scoring to prioritize threats
• Export to CSV/JSON for your workflow
• hing

🚀 Perfect for:
• Incident Response
• Threat Hunting
• Forensics
• SOC Analysis

💡 Why PowerShell-Hunter?
• Process thousands of 4104 events in seconds
• Pre-configured detection patterns
• Catch encoded commands, suspicious downloads, and more
• Built by defenders, for defenders

🔥 Get started: github.com/MHaggis/PowerS…

#InfoSec #BlueTeam #PowerShell #ThreatHunting

The Innovation of the Year Award goes to the individual or team who uses unique approaches to succeed through innovation and risk-taking and/or creating an open-source tool of significant value.

This year's Community Winners are @DavidJBianco, @iknowuhack, and Sydney Marrone nting Framework"! Congratulations! 👏

#SANSDMA

I'm honored to share this SANS Difference Makers Award with my #PEAK #ThreatHunting framework co-authors @iknowuhack and @letswastetime. Thank you to everyone who voted for us and also to everyone using PEAK around the world!

So excited for tomorrow's Difference Makers Awards. I'm nominated in the "Innovation of the Year" category with my #PEAK #ThreatHunting Framework coauthors @iknowuhack and @letswastetime, and in the Team category for my entire #SURGe family.

buff.ly/4izlxfr

🚨JOB ALERT🚨 My team (#Splunk #SURGe) is looking for a mid- or senior-level researcher. The job involves participating and leading research teams, then publishing and speaking about what you learn for the benefit of the #cybersecurity community. We are a small team, but very supportive of each other and extremely collaborative. If this sounds like you, apply today!

splunk.com/en_us/careers/…

Earlier this month, I sat down with @dmonnier to talk about #ThreatHunting and #PEAK on the "Future of Threat Intelligence" podcast.

Check out the episode here: buff.ly/3YJpNBm

#futureofthreatintelligence #cybersecurity #threatintelligence

ATT&CK Tactics represent high-level adversary goals. It’s easy to dismiss these as broad categorization -- but what if we measure the spread, or concentration, of techniques, relative to the amount of attacker-options available to accomplish this goal? 🤔splunk.com/en_us/blog/sec…

ICYMI, I'm thrilled to announce that @iknowuhack, @letswastetime, and I have been nominated for a SANS Difference Makers award for the #PEAK #ThreatHunting Framework ("Innovation of the Year").

We'd love your support! Vote: buff.ly/4gEwVpv
🧵

I am excited to share that the #PEAK #ThreatHunting Framework, which I wrote with @iknowuhack and @letswastetime, has been nominated for a SANS Difference Maker award as "Innovation of the Year."

Vote here: sans.org/about/awards/d…