Threat Hunting Scenario: Monitoring for insider data exfiltration
https://www.brighttalk.com/webcast/15509/257877/threat-hunting-scenario-monitoring-for-insider-data-exfiltration
@BlueTeamLibrary
https://www.brighttalk.com/webcast/15509/257877/threat-hunting-scenario-monitoring-for-insider-data-exfiltration
@BlueTeamLibrary
Brighttalk
Threat Hunting Scenario: Monitoring for Insider Data Exfiltration
Industry statistics point to 1 in 5 enterprise breaches involve insider actions. Insider threats are often the costliest and most disruptive to an enterprise - even highly secure enterprises (think Ed...
Awesome Windows Domain Hardening
A curated list of awesome Security Hardening techniques for Windows.
https://github.com/PaulSec/awesome-windows-domain-hardening
@BlueTeamLibrary
A curated list of awesome Security Hardening techniques for Windows.
https://github.com/PaulSec/awesome-windows-domain-hardening
@BlueTeamLibrary
GitHub
GitHub - PaulSec/awesome-windows-domain-hardening: A curated list of awesome Security Hardening techniques for Windows.
A curated list of awesome Security Hardening techniques for Windows. - PaulSec/awesome-windows-domain-hardening
AppArmor: Say Goodbye to Remote Command Execution.
https://www.secjuice.com/apparmor-say-goodbye-to-remote-command-execution
@BlueTeamLibrary
https://www.secjuice.com/apparmor-say-goodbye-to-remote-command-execution
@BlueTeamLibrary
Magic Unicorn Tool
An Office 365 Activities API report parsing tool.
https://github.com/LMGsec/Magic-Unicorn-Tool
@BlueTeamLibrary
An Office 365 Activities API report parsing tool.
https://github.com/LMGsec/Magic-Unicorn-Tool
@BlueTeamLibrary
GitHub
LMGsec/Magic-Unicorn-Tool
Contribute to LMGsec/Magic-Unicorn-Tool development by creating an account on GitHub.
Out of the Box WMImplant Detection Opportunities
https://www.fortynorthsecurity.com/out-of-the-box-wmimplant-detection-opportunities
@BlueTeamLibrary
https://www.fortynorthsecurity.com/out-of-the-box-wmimplant-detection-opportunities
@BlueTeamLibrary
FortyNorth Security
WMImplant - Out of the Box Detection Opportunities - FortyNorth Security
This post documents multiple ways that defenders can look to detect default WMImplant usage within their environment.
Use Windows Event Forwarding to help with intrusion detection
https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
@BlueTeamLibrary
Docs
Use Windows Event Forwarding to help with intrusion detection
Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected.
Sysmon 8.0 launched, comes with ability to tag rules
https://docs.microsoft.com/en-us/sysinternals/
@BlueTeamLibrary
https://docs.microsoft.com/en-us/sysinternals/
@BlueTeamLibrary
Docs
Sysinternals - Sysinternals
Library, learning resources, downloads, support, and community. Evaluate and find out how to install, deploy, and maintain Windows with Sysinternals utilities.
What is it that Makes a Microsoft Executable a Microsoft Executable? An Attacker’s and a Defender’s Perspective
https://posts.specterops.io/what-is-it-that-makes-a-microsoft-executable-a-microsoft-executable-b43ac612195e
@WindowsHackingLibrary
@BlueTeamLibrary
https://posts.specterops.io/what-is-it-that-makes-a-microsoft-executable-a-microsoft-executable-b43ac612195e
@WindowsHackingLibrary
@BlueTeamLibrary
Medium
What is it that Makes a Microsoft Executable a Microsoft Executable?
What exactly is it that separates arbitrary code from code that originates from Microsoft? I would wager that the reaction of most people…
Detecting RDP Brute-Force with One Hand
https://security-storm.com/playbook/2018/3/5/detecting-rdp-brute-force-with-one-hand
@BlueTeamLibrary
https://security-storm.com/playbook/2018/3/5/detecting-rdp-brute-force-with-one-hand
@BlueTeamLibrary
The Storm
Detecting RDP Brute Force with One Hand — The Storm
One of the growing attacks we have seen has been Remote Desktop brute forcing, MITRE ATT&CK technique T1076(link https://attack.mitre.org/wiki/Technique/T1076 ), especially if you have laptops that connect directly to the internet when not at your office.…
Domain Controller Security Logs – how to get at them *without* being a Domain Admin
https://girl-germs.com/?p=1538
@BlueTeamLibrary
https://girl-germs.com/?p=1538
@BlueTeamLibrary
GirlGerms online
Domain Controller Security Logs – how to get at them *without* being a Domain Admin
So, was (semi)recently tasked with getting rid of service accounts out of our Domain Administrators group because, as you know, service accounts in Domain Admins group is BAAAAD! One of the account…
Building a Windows Defender Application Control Lab
https://www.fortynorthsecurity.com/building-a-windows-defender-application-control-lab/
@BlueTeamLibrary
https://www.fortynorthsecurity.com/building-a-windows-defender-application-control-lab/
@BlueTeamLibrary
FortyNorth Security
Building a Windows Defender Application Control Lab - FortyNorth Security
This blog post will cover the steps required to build out a Windows Defender Application Control lab in a test domain environment.
Protect Remote Desktop credentials with Windows Defender Remote Credential Guard
https://docs.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard
@BlueTeamLibrary
Docs
Remote Credential Guard
Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device.
Securing Domain Controllers to Improve Active Directory Security
https://adsecurity.org/?p=3377
@BlueTeamLibrary
https://adsecurity.org/?p=3377
@BlueTeamLibrary
Active Directory & Azure AD/Entra ID Security
Securing Domain Controllers to Improve Active Directory Security
Active Directory security effectively begins with ensuring Domain Controllers (DCs) are configured securely. At BlackHat USA this past Summer, I spoke about AD for the security professional and provided tips on how to best secure Active Directory. This post…
Windows Defender ATP EDR capability for Windows 7 SP1 and Windows 8.1 is now in public preview.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection
@BlueTeamLibrary
Docs
Onboard previous versions of Windows on Microsoft Defender ATP
Onboard supported previous versions of Windows machines so that they can send sensor data to the Microsoft Defender ATP sensor
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
Windows Event Logs Zero 2 Hero
Nate Guagenti & Adam Swan at Derbycon
https://www.youtube.com/watch?v=8AKxt-5RB6w
@SecTalks
Nate Guagenti & Adam Swan at Derbycon
https://www.youtube.com/watch?v=8AKxt-5RB6w
@SecTalks
YouTube
T317 Windows Event Logs Zero 2 Hero Nate Guagenti Adam Swan
These are the videos from Derbycon 7 (2017):
http://www.irongeek.com/i.php?page=videos/derbycon7/mainlist
http://www.irongeek.com/i.php?page=videos/derbycon7/mainlist
Top Ten Issues with Active Directory Trusts and Corporate Mergers
https://blogs.technet.microsoft.com/askpfeplat/2017/02/13/top-ten-issues-with-active-directory-trusts-and-corporate-mergers
@BlueTeamLibrary
https://blogs.technet.microsoft.com/askpfeplat/2017/02/13/top-ten-issues-with-active-directory-trusts-and-corporate-mergers
@BlueTeamLibrary
Get All AD Users Logon History with their Logged on Computers (with IPs)& OUs
https://gallery.technet.microsoft.com/scriptcenter/Get-All-AD-Users-Logon-9e721a89
@BlueTeamLibrary
https://gallery.technet.microsoft.com/scriptcenter/Get-All-AD-Users-Logon-9e721a89
@BlueTeamLibrary