iiinova — where your digital self keeps evolving

techy

@techy.detectionengineering.net

1.6K followers 408 following 70 posts

Creator of Detection Engineering Weekly (detectionengineering.net), Sec Research/Intel/Detection @ Datadog

Posts Replies Media

techy @techy.detectionengineering.net · 27/04/2025

Found just outside Moscone North for RSA. Now I'm pumped for my talk tomorrow. #hacktheplanet

021

techy @techy.detectionengineering.net · 09/02/2025

@sekoia.io FYI your TLS cert is showing invalid due to date expiration for *.sekoia.io

120

techy @techy.detectionengineering.net · 22/12/2024

telling chatgpt my editor in a very blunt and snarky way, as all vim users do

010

techy @techy.detectionengineering.net · 17/12/2024

Today is not a good day. Our dog needed a vet visit because he was weak and not eating. Turns out he had blood and fluid throughout his abdomen due to cancer. He was an amazing friend and family member, and tomorrow’s issue will be somber but commemorative with lots of pupper pics. Hug your dogs!

6210

techy @techy.detectionengineering.net · 07/12/2024

If indeed the problem is pushing malicious code and publishing directly to PyPi itself, there's only one listed account owner (though there could be more): Glenn Jocher. Email listed directly on PyPi. If someone got access to this email, you could search for it inside infostealer or breach databases

110

techy @techy.detectionengineering.net · 07/12/2024

Quick guarddog scan found the offending code on one of the malicious versions. Unremarkably, its dropping cryptomining binaries for Linux and MacOS. An OSV entry for ultralytics malware still hasn't made it to the main osv database

110

techy @techy.detectionengineering.net · 07/12/2024

Ultralytics, a python package with close to 6.4 million downloads per month, was backdoored to run a cryptominer. Running theory from the reported GitHub issue is a GitHub action injection attack, but theres also evidence that the malicious code was published directly via PyPi and skipped CI/CD

1104

techy @techy.detectionengineering.net · 22/11/2024

New Datadog threat research just dropped! We found a cluster of activity publishing ~a ton~ of malicious packages across PyPi and npm. Leveraged GitHub to host two stealer binaries and exfiltrated data to Telegram. buff.ly/3Ol7bBu

083

techy @techy.detectionengineering.net · 20/11/2024

* Bastradamus 2 part series on creating a detection engineering lab * Manuel Arrieta masterclass on hunting in VTI for malicious LNK files to detection opportunities * JPCERT/CC's Shusei Tomonaga on Windows ETW internals

100