**Brandon Dalton (**Sr. Security Researcher at Microsoft)

LinkedIn: https://www.linkedin.com/in/brandon-dalton/

GitHub: https://github.com/Brandon7CC

Twitter: https://x.com/PartyD0lphin

Blog content

Hi there 👋, here’s some more helpful resources

Some tools written by me

• 📱 Aura: iOS Mythic agent.
• 🔬 Mac Monitor: Behavioral dynamic research tool with ES as a primary data source.
• 📈 SimpleMacStats: Monitoring real time system performance on macOS.

Other blog content

• 👨‍💻 So you want to build an Endpoint Security app?
• 🔬 Endpoint Security Internals
• 🪞 T1620 Reflective Code Loading (Red Canary Threat Detection Report)
• 🍎 T1059.002 AppleScript (Red Canary Threat Detection Report)
• 🏰 T1553.001 Gatekeeper Bypass (Red Canary Threat Detection Report)

🔭 Endpoint Security Client Survey 2023

The following is a listing of known ES clients I was able to find with a VirusTotal RetroHunt. Vendor references and AWS S3 download links are included!

[https://docs.google.com/spreadsheets/d/18lPTHjrgKsfLWknGpHg_bCasF1G7KRQlw0j6xs0oKx4/edit?gid=0#gid=0](https://docs.google.com/spreadsheets/d/18lPTHjrgKsfLWknGpHg_bCasF1G7KRQlw0j6xs0oKx4/preview?gid=0#gid=0)

📰 RSS

Want to be notified via RSS when a new post is published?

About

For more information check out my home page at:

Swiftly Detecting | a cybersecurity research blog

Page covers and icons

• The images you see on the blog page headers are from the James Webb Space Telescope’s Observation gallery: https://webbtelescope.org/images.
• The icons for each page were generated by DALL·E 3.