Top SOC Reads: January 2023

This post highlights three security concerns: (1) GitHub reconnaissance risks and a new OSINT tool (Octosuite) that can help defenders find exposed repos and leaked secrets; (2) attackers abusing legitimate, signed but vulnerable drivers (BYOVD) to obtain kernel write access and disable EDR—documented in real-world cases like Lazarus and BlackByte—and recommended mitigations such as driver blocklists and HVCI; and (3) advances in automated PowerShell de-obfuscation and behavior profiling that aid detection and analysis.