PassFiltEx
A password filter for Active Directory that uses a blacklist of bad passwords/character sequences.
https://github.com/ryanries/PassFiltEx/blob/master/README.md
@BlueTeamLibrary
A password filter for Active Directory that uses a blacklist of bad passwords/character sequences.
https://github.com/ryanries/PassFiltEx/blob/master/README.md
@BlueTeamLibrary
GitHub
PassFiltEx/README.md at master · ryanries/PassFiltEx
PassFiltEx. An Active Directory Password Filter. Contribute to ryanries/PassFiltEx development by creating an account on GitHub.
Down the Rabbit Hole With Packaged PowerShell Scripts
https://dfir.it/blog/2018/05/08/down-the-rabbit-hole-with-packaged-powershell-scripts/
@BlueTeamLibrary
https://dfir.it/blog/2018/05/08/down-the-rabbit-hole-with-packaged-powershell-scripts/
@BlueTeamLibrary
dfir.it
Down the rabbit hole with packaged PowerShell scripts - dfir it!
Several weeks ago, during one of the investigations, I needed to triage a few potentially malicious Windows executables. One of them caught my …
Defending Against PowerShell Attacks
https://blogs.msdn.microsoft.com/powershell/2017/10/23/defending-against-powershell-attacks
@BlueTeamLibrary
https://blogs.msdn.microsoft.com/powershell/2017/10/23/defending-against-powershell-attacks
@BlueTeamLibrary
Microsoft News
Defending Against PowerShell Attacks
[Updated Feb 20th, 2020 with latest guidance] The security industry is ablaze with news about how PowerShell is being used by both commodity malware and attackers alike. Surely there’s got to be a way to defend yourself against these attacks! There absolutely…
Device Guard and Application Whitelisting on Windows - An Airing of Grievances
http://www.exploit-monday.com/2018/06/device-guard-and-application.html?m=1
@BlueTeamLibrary
http://www.exploit-monday.com/2018/06/device-guard-and-application.html?m=1
@BlueTeamLibrary
Exploit-Monday
Device Guard and Application Whitelisting on Windows - An Airing of Grievances
Introduction The purpose of this post is to highlight many of the frustrations I’ve had with Device Guard (rebranded as Windows Defender ...
The Endgame Guide to Threat Hunting
https://pages.endgame.com/rs/627-YBU-612/images/The%20Endgame%20Guide%20to%20Threat%20Hunting%20-%20ebook.pdf
@BlueTeamLibrary
https://pages.endgame.com/rs/627-YBU-612/images/The%20Endgame%20Guide%20to%20Threat%20Hunting%20-%20ebook.pdf
@BlueTeamLibrary
Microsoft Security Advisory 4056318
Guidance for securing AD DS account used by Azure AD Connect for directory synchronization
https://technet.microsoft.com/en-us/library/security/4056318.aspx
@BlueTeamLibrary
Guidance for securing AD DS account used by Azure AD Connect for directory synchronization
https://technet.microsoft.com/en-us/library/security/4056318.aspx
@BlueTeamLibrary
SANS Hunt Evil Poster
https://www.sans.org/security-resources/posters/hunt-evil/165/download
@BlueTeamLibrary
https://www.sans.org/security-resources/posters/hunt-evil/165/download
@BlueTeamLibrary
SANS Institute
Hunt Evil
Knowing what’s normal on a Windows host helps cut through the noise to quickly locate potential malware. Use the information below as a reference to know what’s normal in Windows and to focus your attention on the outliers.
Network access: Restrict clients allowed to make remote calls to SAM
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
@BlueTeamLibrary
Docs
Network access - Restrict clients allowed to make remote calls to SAM
Security policy setting that controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database.
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
Automated AD and Windows test lab deployments with Invoke-ADLabDeployer
https://outflank.nl/blog/2018/03/30/automated-ad-and-windows-test-lab-deployments-with-invoke-adlabdeployer/
@WindowsHackingLibrary
https://outflank.nl/blog/2018/03/30/automated-ad-and-windows-test-lab-deployments-with-invoke-adlabdeployer/
@WindowsHackingLibrary
w0rk3r's Blue team Library
Photo
Endpoint detection Superpowers on the cheap
Part 1 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-1-e9c28201ac47
Part 2 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-2-deploy-and-maintain-d06580329fe8
Part 3 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-3-sysmon-tampering-49c2dc9bf6d9
@BlueTeamLibrary
Part 1 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-1-e9c28201ac47
Part 2 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-2-deploy-and-maintain-d06580329fe8
Part 3 - https://medium.com/@olafhartong/endpoint-detection-superpowers-on-the-cheap-part-3-sysmon-tampering-49c2dc9bf6d9
@BlueTeamLibrary
Medium
Endpoint detection Superpowers on the cheap — part 1
In this blog series, I will talk about my endpoint detection stack focused on Windows environments and mostly based on Sysmon.
Investigating lateral movement paths with ATA
https://docs.microsoft.com/en-us/advanced-threat-analytics/use-case-lateral-movement-path
@BlueTeamLibrary
https://docs.microsoft.com/en-us/advanced-threat-analytics/use-case-lateral-movement-path
@BlueTeamLibrary
Docs
Investigate lateral movement path attacks with ATA
This article describes how to detect lateral movement path attacks with Advanced Threat Analytics (ATA).
Announcing the pre-release (0.9) of “AaronLocker”, robust and practical Application whitelisting for Windows
https://blogs.msdn.microsoft.com/aaron_margosis/2018/06/26/announcing-application-whitelisting-with-aaronlocker/
@BlueTeamLibrary
https://blogs.msdn.microsoft.com/aaron_margosis/2018/06/26/announcing-application-whitelisting-with-aaronlocker/
@BlueTeamLibrary
Threat Detection using Windows Defender Application Control (Device Guard) in Audit Mode
https://posts.specterops.io/threat-detection-using-windows-defender-application-control-device-guard-in-audit-mode-602b48cd1c11
@BlueTeamLibrary
https://posts.specterops.io/threat-detection-using-windows-defender-application-control-device-guard-in-audit-mode-602b48cd1c11
@BlueTeamLibrary
Medium
Threat Detection using Windows Defender Application Control (Device Guard) in Audit Mode
Note: I originally scrapped this post because I didn’t like that audit events were only logged once per boot due to caching, however…
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Architecting a Modern Defense usind Device Guard
Matt Graeber and Casey Smith at Troopers 17
https://youtu.be/b1VauGeKJGw
@SecTalks
Matt Graeber and Casey Smith at Troopers 17
https://youtu.be/b1VauGeKJGw
@SecTalks
YouTube
TR17 - Architecting a Modern Defense using Device Guard - Matt Graeber, Casey Smith
TROOPERS17 - Defense & Management - IT-Security Conference
Upcoming:
TROOPERS18 - 12th - 16th March 2018, Heidelberg, Germany. Find out more: https://www.troopers.de
Upcoming:
TROOPERS18 - 12th - 16th March 2018, Heidelberg, Germany. Find out more: https://www.troopers.de
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Demystifying the Windows Firewall – Learn how to irritate attackers without crippling your network
By Jessica Payne
https://channel9.msdn.com/Events/Ignite/New-Zealand-2016/M377/player
@SecTalks
By Jessica Payne
https://channel9.msdn.com/Events/Ignite/New-Zealand-2016/M377/player
@SecTalks
Channel 9
Demystifying the Windows Firewall – Learn how to irritate attackers without crippling your network
In 2016, host based firewalls are not optional in a Cybersecurity strategy. Windows comes with a built in and powerful firewall, however the Windows Firewall has a reputation for being difficult to tr
Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2
This document discusses Pass-the-Hash (PtH) attacks against the Windows operating systems and provides holistic planning strategies that, when combined with the Windows security features, will provide a more effective defense against pass-the-hash attacks.
https://www.microsoft.com/en-us/download/confirmation.aspx?id=36036
@BlueTeamLibrary
This document discusses Pass-the-Hash (PtH) attacks against the Windows operating systems and provides holistic planning strategies that, when combined with the Windows security features, will provide a more effective defense against pass-the-hash attacks.
https://www.microsoft.com/en-us/download/confirmation.aspx?id=36036
@BlueTeamLibrary
Microsoft
Download Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2 from Official Microsoft Download Center
This document discusses Pass-the-Hash (PtH) attacks against the Windows operating systems and provides holistic planning strategies that, when combined with the Windows security features, will provide a more effective defense against pass-the-hash attacks.