How to Enable Server Access Logging
To track requests for access to your bucket, you can enable server access logging. Each access log record provides details about a single access request, such as the requester, bucket name, request time, request action, response status, and an error code, if relevant
https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html#server-access-logging-overview
@BlueTeamLibrary
To track requests for access to your bucket, you can enable server access logging. Each access log record provides details about a single access request, such as the requester, bucket name, request time, request action, response status, and an error code, if relevant
https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerLogs.html#server-access-logging-overview
@BlueTeamLibrary
Amazon
Logging requests with server access logging - Amazon Simple Storage Service
Enable Amazon S3 server access logging to track requests for access to your S3 buckets.
Azure AD Password Protection: The Cloud Security Service your Active Directory Needs Now
http://www.longevitytech.us/2018/07/09/azure-ad-password-protection-the-cloud-security-service-your-active-directory-needs-now
@BlueTeamLibrary
http://www.longevitytech.us/2018/07/09/azure-ad-password-protection-the-cloud-security-service-your-active-directory-needs-now
@BlueTeamLibrary
Longevity Technology
Azure AD Password Protection: The Cloud Security Service your Active Directory Needs Now | Longevity Technology
Microsoft has finally provided a service that mitigates the single most critical password-related security risk in the enterprise today: common passwords. You should kick the tires on this new Active Directory capability today, so you can deploy it as soon…
Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph
@BlueTeamLibrary
Docs
Authorize reputable apps with the Intelligent Security Graph (ISG) (Windows) - Windows security
Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation.
Malicious PowerShell Detection via Machine Learning
https://www.fireeye.com/blog/threat-research/2018/07/malicious-powershell-detection-via-machine-learning.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2018/07/malicious-powershell-detection-via-machine-learning.html
@BlueTeamLibrary
Mandiant
Malicious PowerShell Detection via Machine Learning | Mandiant
Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
https://github.com/MHaggis/sysmon-dfir
@BlueTeamLibrary
https://github.com/MHaggis/sysmon-dfir
@BlueTeamLibrary
GitHub
GitHub - MHaggis/sysmon-dfir: Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
Sources, configuration and how to detect evil things utilizing Microsoft Sysmon. - MHaggis/sysmon-dfir
Azure Advanced Threat Protection suspicious activity guide
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide
@BlueTeamLibrary
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide
@BlueTeamLibrary
Docs
Azure ATP security alert guide
New #Sysmon configuration file is available: https://t.co/XFeHizA2TX
Main changes: Schema 4.1 support, and Mitre tagging added
@BlueTeamLibrary
Via: @Moti_b
Main changes: Schema 4.1 support, and Mitre tagging added
@BlueTeamLibrary
Via: @Moti_b
Active Directory Password Blacklisting
https://engineeringblog.yelp.com/2018/04/ad-password-blacklisting.html
@BlueTeamLibrary
https://engineeringblog.yelp.com/2018/04/ad-password-blacklisting.html
@BlueTeamLibrary
Yelp
Active Directory Password Blacklisting
Active Directory Password Blacklisting Leeren Chang, Software Engineer Apr 16, 2018 Many enterprise professionals use passwords that are weak and easily compromised. Equipped with this knowledge, as well as the...
Mining off the Land: Cryptomining Enabled by Native Windows Tools
https://redcanary.com/blog/cryptomining-enabled-by-native-windows-tools
@BlueTeamLibrary
https://redcanary.com/blog/cryptomining-enabled-by-native-windows-tools
@BlueTeamLibrary
Red Canary
Threat Detection #9643: Cryptomining Enabled by Native Windows Tools
A Red Canary detection engineer shows an example of cryptomining enabled by native windows tools. Learn detection strategies and prevention strategies.
Manage Windows 10 connection endpoints
https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints
@BlueTeamLibrary
Docs
Connection endpoints for Windows 10 Enterprise, version 2004 - Windows Privacy
Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 2004.
A new feature on Azure permits to set a list of banned passwords:
Deploy Azure AD password protection
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises
@BlueTeamLibrary
Deploy Azure AD password protection
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises
@BlueTeamLibrary
Docs
Deploy Azure AD password protection preview
Deploy the Azure AD password protection preview to ban bad passwords on-premises
Advanced Audit Policy – which GPO corresponds with which Event ID
https://girl-germs.com/?p=363
@BlueTeamLibrary
https://girl-germs.com/?p=363
@BlueTeamLibrary
GirlGerms online
Advanced Audit Policy – which GPO corresponds with which Event ID
I spent a good part of a day a few weeks ago searching around looking for a simple spreadsheet or table that lists the Advanced Audit GPO’s and what Event ID’s they correspond to. I cou…
Memtriage:
Allows you to quickly query a live Windows machine for RAM artifacts
https://github.com/gleeda/memtriage
@BlueTeamLibrary
Allows you to quickly query a live Windows machine for RAM artifacts
https://github.com/gleeda/memtriage
@BlueTeamLibrary
GitHub
GitHub - gleeda/memtriage: Allows you to quickly query a Windows machine for RAM artifacts
Allows you to quickly query a Windows machine for RAM artifacts - gleeda/memtriage
Using Administrative Actions logging in SharePoint Server 2016
https://docs.microsoft.com/en-us/SharePoint/administration/using-administrative-actions-logging-in-sharepoint-server-2016
@BlueTeamLibrary
https://docs.microsoft.com/en-us/SharePoint/administration/using-administrative-actions-logging-in-sharepoint-server-2016
@BlueTeamLibrary
Docs
Using Administrative Actions logging in SharePoint Server 2016
The Administrative Actions logging feature is included in the November 2016 Public Update for SharePoint Server 2016 (Feature Pack 1). This feature enables logging of SharePoint Server 2016 administrative actions.
Sysinternals Sysmon suspicious activity guide
https://blogs.technet.microsoft.com/motiba/2017/12/07/sysinternals-sysmon-suspicious-activity-guide
@BlueTeamLibrary
https://blogs.technet.microsoft.com/motiba/2017/12/07/sysinternals-sysmon-suspicious-activity-guide
@BlueTeamLibrary
Finding Metasploit’s Meterpreter Traces With Memory Forensics
https://articles.forensicfocus.com/2018/04/03/finding-metasploits-meterpreter-traces-with-memory-forensics/
@BlueTeamLibrary
https://articles.forensicfocus.com/2018/04/03/finding-metasploits-meterpreter-traces-with-memory-forensics/
@BlueTeamLibrary
Forensic Focus
Finding Metasploit’s Meterpreter Traces With Memory Forensics - Forensic Focus
by Oleg Skulkin & Igor Mikhaylov Metasploit Framework is not only very popular among pentesters, but is also quite often used ... Read moreFinding Metasploit’s Meterpreter Traces With Memory Forensics
AppLocker hardening policies (common bypasses mitigation):
https://github.com/MotiBa/AppLocker/
@BlueTeamLibrary
https://github.com/MotiBa/AppLocker/
@BlueTeamLibrary
GitHub
GitHub - MotiBa/AppLocker: AppLocker hardening policies
AppLocker hardening policies. Contribute to MotiBa/AppLocker development by creating an account on GitHub.