Kyle Bailey – Medium

Jul 23, 2021

Detection-as-Code — Testing

Let’s talk about testing. The often overlooked and less loved sibling of development. Testing is something that most organizations do as they either build or receive (from a vendor or elsewhere) new detection logic. Testing has traditionally been done with an eye for false positives with the concern of overwhelming…

Infosec

6 min read

Infosec

6 min read

Apr 27, 2021

Detecting MacOS Gatekeeper Bypass (CVE 2021–30657)

Cedric Owens and Patrick Wardle released great research yesterday showcasing a novel method of bypassing MacOS Gatekeeper. I highly recommend reading both articles. Apple patched this vuln yesterday in their updated release of BigSur but have not done so in Catalina or older versions of OSX. …

Dfir

3 min read

Detecting MacOS Gatekeeper Bypass (CVE 2021–30657)

Dfir

3 min read

Apr 26, 2021

Detection Engineering Maturity Matrix

Update: I did a talk on this maturity matrix at the SANS Blue Team Summit 2021. If you want more context on each of the sections laid out below, I recommend watching the video. The recording can be found here (link). Detection engineering has long been a function of the…

Cybersecurity

5 min read

Cybersecurity

5 min read