Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Active Directory Best Practices That Frustrate Pentesters
https://www.youtube.com/watch?v=SdNPUhzYTUc
@Sectalks
https://www.youtube.com/watch?v=SdNPUhzYTUc
@Sectalks
YouTube
Active Directory Best Practices That Frustrate Pentesters
Join us in the Black Hills InfoSec Discord server here: https://discord.gg/BHIS to keep the security conversation going!
Reach out to Black Hills Infosec if you need pentesting, threat hunting, ACTIVE SOC, incident response, or blue team services -- ht…
Reach out to Black Hills Infosec if you need pentesting, threat hunting, ACTIVE SOC, incident response, or blue team services -- ht…
Protecting the modern workplace from a wide range of undesirable software
https://cloudblogs.microsoft.com/microsoftsecure/2018/08/07/protecting-the-modern-workplace-from-a-wide-range-of-undesirable-software
@BlueTeamLibrary
https://cloudblogs.microsoft.com/microsoftsecure/2018/08/07/protecting-the-modern-workplace-from-a-wide-range-of-undesirable-software
@BlueTeamLibrary
Microsoft Security
Protecting the modern workplace from a wide range of undesirable software - Microsoft Security
Security is a fundamental component of the trusted and productive Windows experience that we deliver to customers through modern platforms like Windows 10 and Windows 10 in S mode. As we build intelligent security technologies that protect the modern workplace…
Threat Hunting – Simplifying The Beacon Analysis Process
https://www.activecountermeasures.com/threat-hunting-simplifying-the-beacon-analysis-process
@BlueTeamLibrary
https://www.activecountermeasures.com/threat-hunting-simplifying-the-beacon-analysis-process
@BlueTeamLibrary
Active Countermeasures
Threat Hunting - Simplifying The Beacon Analysis Process - Active Countermeasures
In part one of this two-part series, I described what is involved with performing a beacon analysis and why it is so important […]
Connecting servers without Internet access to Windows Defender ATP
https://techcommunity.microsoft.com/t5/What-s-New/Connecting-servers-without-Internet-access-to-Windows-Defender
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/What-s-New/Connecting-servers-without-Internet-access-to-Windows-Defender
@BlueTeamLibrary
Perform a MitM attack and extract clear text credentials from RDP connections
https://github.com/SySS-Research/Seth
@BlueTeamLibrary
https://github.com/SySS-Research/Seth
@BlueTeamLibrary
GitHub
GitHub - SySS-Research/Seth: Perform a MitM attack and extract clear text credentials from RDP connections
Perform a MitM attack and extract clear text credentials from RDP connections - SySS-Research/Seth
Interpreting Exploit Guard ASR audit alerts
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Interpreting-Exploit-Guard-ASR-audit-alerts/ba-p/228366
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Interpreting-Exploit-Guard-ASR-audit-alerts/ba-p/228366
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
Interpreting Exploit Guard ASR audit alerts
In my previous blog, I talked about how you can leverage Windows Defender ATP’s Advanced hunting to monitor Attack Surface Reduction (ASR) alerts in audit mode and dig a little deeper into the potential application compatibility impact of enforcing more rules.…
Forensics: Monitor Active Directory Privileged Groups with PowerShell
https://blogs.technet.microsoft.com/ashleymcglone/2014/12/17/forensics-monitor-active-directory-privileged-groups-with-powershell
@BlueTeamLibrary
https://blogs.technet.microsoft.com/ashleymcglone/2014/12/17/forensics-monitor-active-directory-privileged-groups-with-powershell
@BlueTeamLibrary
Basic Blue Team Registry monitoring with Splunk...
https://www.cyberzombi3.co.uk/home/basic-blue-team-registry-monitoring-with-splunk
@BlueTeamLibrary
https://www.cyberzombi3.co.uk/home/basic-blue-team-registry-monitoring-with-splunk
@BlueTeamLibrary
Introducing Windows Defender System Guard runtime attestation
https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation
@BlueTeamLibrary
https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation
@BlueTeamLibrary
Microsoft Security
Introducing Windows Defender System Guard runtime attestation - Microsoft Security
At Microsoft, we want users to be in control of their devices, including knowing the security health of these devices. If important security features should fail, users should be aware.
BSidesLV 2018 - ATT&CKing the Status Quo: Improving Threat Intelligence and Cyber Defense with MITRE ATT&CK
https://www.slideshare.net/mobile/slideshow/embed_code/key/jbou6bLVvh1Mdz
@BlueTeamLibrary
https://www.slideshare.net/mobile/slideshow/embed_code/key/jbou6bLVvh1Mdz
@BlueTeamLibrary
Network access: Restrict clients allowed to make remote calls to SAM
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
@BlueTeamLibrary
Docs
Network access - Restrict clients allowed to make remote calls to SAM
Security policy setting that controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database.
Hardening PowerShell Script Block Logging Log
http://community.idera.com/powershell/powertips/b/tips/posts/hardening-powershell-script-block-logging-log
@BlueTeamLibrary
http://community.idera.com/powershell/powertips/b/tips/posts/hardening-powershell-script-block-logging-log
@BlueTeamLibrary
IDERA Community
Hardening PowerShell Script Block Logging Log
When you enable ScriptBlockLogging, PowerShell logs all PowerShell code that is executed on your machine. Even if it is disabled, any security-relevant code...
It’s Time for Token Binding
https://cloudblogs.microsoft.com/enterprisemobility/2018/08/21/its-time-for-token-binding
@BlueTeamLibrary
https://cloudblogs.microsoft.com/enterprisemobility/2018/08/21/its-time-for-token-binding
@BlueTeamLibrary
Microsoft 365 Blog
It’s time for token binding - Microsoft 365 Blog
The last few months have been some very exciting times in the world of identity and security standards. Due to the efforts of a broad set of experts across the industry, we've made incredible progress in finalizing a broad set of new and improved standards…
Respond to threats faster with Security Center’s Confidence Score
https://azure.microsoft.com/en-us/blog/respond-to-threats-faster-with-security-center-s-confidence-score
@BlueTeamLibrary
https://azure.microsoft.com/en-us/blog/respond-to-threats-faster-with-security-center-s-confidence-score
@BlueTeamLibrary
Microsoft
Respond to threats faster with Security Center’s Confidence Score
Azure Security Center provides you with visibility across all your resources running in Azure and alerts you of potential or detected issues. The volume of alerts can be challenging for a security…
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Privilege Escalation & Post-Exploitation Docs
https://rmusser.net/docs/Privilege%20Escalation%20&%20Post-Exploitation.html
@WindowsHackingLibrary
https://rmusser.net/docs/Privilege%20Escalation%20&%20Post-Exploitation.html
@WindowsHackingLibrary
Forwarded from Security papers (Jonhnathan Jonhnathan Jonhnathan)
Which YARA Rules Rule: Basic or Advanced?
YARA rules, if used effectively, can be a powerful tool in the fight against malware. However, it appears that the majority of individuals who use YARA write only the most basic of rules, instead of taking advantage of YARA’s full functionality. Basic YARA rules, which focus primarily on identifying malware signatures via detection of predetermined strings within the target file, folder, or process, can be evaded as malware variants are created. Advanced YARA rules, on the other hand, which often include signatures as well, also focus on the malware’s behavior and characteristics, such as size and file type. While it is not uncommon for strings within malware to change, it is much rarer that its primary behavior will. After analyzing multiple samples of two different malware strains within the same family, it became clear that using both basic and advanced YARA rules is the most effective way for users and analysts to implement this powerful tool. As there are a large number of advanced capabilities contained within YARA, this paper will focus on easy-to-use, advanced features, including YARA's Portable Execution (PE) module, to highlight some of the more powerful aspects of YARA. While it takes more time and effort to learn and utilize advanced YARA rules, in the long run, this method is a worthwhile investment towards a safer networking environment.
https://www.sans.org/reading-room/whitepapers/tools/yara-rules-rule-basic-advanced-38560
@CyberWhitePapers
YARA rules, if used effectively, can be a powerful tool in the fight against malware. However, it appears that the majority of individuals who use YARA write only the most basic of rules, instead of taking advantage of YARA’s full functionality. Basic YARA rules, which focus primarily on identifying malware signatures via detection of predetermined strings within the target file, folder, or process, can be evaded as malware variants are created. Advanced YARA rules, on the other hand, which often include signatures as well, also focus on the malware’s behavior and characteristics, such as size and file type. While it is not uncommon for strings within malware to change, it is much rarer that its primary behavior will. After analyzing multiple samples of two different malware strains within the same family, it became clear that using both basic and advanced YARA rules is the most effective way for users and analysts to implement this powerful tool. As there are a large number of advanced capabilities contained within YARA, this paper will focus on easy-to-use, advanced features, including YARA's Portable Execution (PE) module, to highlight some of the more powerful aspects of YARA. While it takes more time and effort to learn and utilize advanced YARA rules, in the long run, this method is a worthwhile investment towards a safer networking environment.
https://www.sans.org/reading-room/whitepapers/tools/yara-rules-rule-basic-advanced-38560
@CyberWhitePapers
Establishing a Networking Baseline to Identify Lateral Movimetation leveraging Remote Desktop Protocol
https://www.fireeye.com/blog/threat-research/2018/04/establishing-a-baseline-for-remote-desktop-protocol.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2018/04/establishing-a-baseline-for-remote-desktop-protocol.html
@BlueTeamLibrary
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-UNKNOWN)
https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html
@BlueTeamLibrary
https://blog.0patch.com/2018/08/how-we-micropatched-publicly-dropped.html
@BlueTeamLibrary
0patch - Better Security Patches
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-2018-8440)
Tiny reboot-less security patches for critical vulnerabilities in Windows, Microsoft Office, and other Windows products