iiinova — where your digital self keeps evolving

tomchop

@tomchop.me

850 followers 381 following 132 posts

Cybersecurity nerd; #DFIR @ Google by day; FOSS, threat intel and malware analysis by night. Investigator, coder, terrible sense of humor. yeti-platform.io and more (github.com/tomchop) views are my own • he/him • tomchop.me

Posts Replies Media

tomchop @tomchop.me · 07/01/2025

I had a look at #OpenRelik last year and wrote a couple workers that might be useful: * github.com/tomchop/open...: Scan memory images using @volatilityfoundation.org plugins. Supports Yara rules * github.com/tomchop/open... - Run Yara rules on a directory. Supports third-party systems like #Yeti!

Demo of the Volatility 3 worker extracting files and plugin output

Demo of the Yara scanner worker showing matches for a dumb DarkComet rule

060

tomchop @tomchop.me · 27/11/2024

Looks like shit just got real @swiftonsecurity.com

180

tomchop @tomchop.me · 14/11/2023

The changes in the codebase have been massive (remember, it's only 2 people working on this): 480 commits to the API server. 139 commits to the frontend SPA.

100

tomchop @tomchop.me · 14/11/2023

This has been years in the making, literally. @Sebdraven and I are happy to announce the release of #Yeti 2.0 (after we promised an EOM release at @hack_lu last month) Website: yeti-platform.io Release: github.com/yeti-platform/yeti mini-🧵👇🏻 #DFIR #infosec #CTI #cybersec

Screenshot of Yeti showing information on the Scattered Spider intrusion set.

183

tomchop @tomchop.me · 16/10/2023

I haven't had time to talk about it, but @sebdraven and I are giving a talk this week at #HackLu about some cool new changes coming to Yeti: pretalx.com/hack-lu-2023... It's going to be fun to talk about this project that has been on my todo list for 10+ years! 😅 #DFIR #infosec #CTI

Screenshot of a Github PR page showing 301 files changed, and 10k lines of code added and 14k of code deleted

020

tomchop @tomchop.me · 12/08/2023

How your email finds me.

020

tomchop @tomchop.me · 20/07/2023

This is very exciting, and comes (in part) from direct pushback from the infosec community. Well done to everyone who was vocal about this!! #infosec www.microsoft.com/en-us/security/bl…