Contemporaneous Notes: a forensicator's best friend
https://bitofhex.com/2018/08/02/contemporaneous-notes
@BlueTeamLibrary
https://bitofhex.com/2018/08/02/contemporaneous-notes
@BlueTeamLibrary
Bitofhex
Contemporaneous Notes: a forensicator's best friend
This post can actually be pretty short: write contemporaneous notes. There. Done. Finished.
Need more detail?
Writing contemporaneous notes is the smartest, best, and most important thing you will do in your DFIR career. They will help you, save you, protect…
Need more detail?
Writing contemporaneous notes is the smartest, best, and most important thing you will do in your DFIR career. They will help you, save you, protect…
PowerShell Injection Hunter: Security Auditing for PowerShell Scripts
https://blogs.msdn.microsoft.com/powershell/2018/08/03/powershell-injection-hunter-security-auditing-for-powershell-scripts
@BlueTeamLibrary
https://blogs.msdn.microsoft.com/powershell/2018/08/03/powershell-injection-hunter-security-auditing-for-powershell-scripts
@BlueTeamLibrary
Microsoft News
PowerShell Injection Hunter: Security Auditing for PowerShell Scripts
At the DEFCON security conference last year, we presented the session: "Get $pwnd: Attacking Battle Hardened Windows Server". In this talk, we went through some of the incredibly powerful ways that administrators can secure their high-value systems (for example…
Advanced hunting query best practices Windows Defender ATP
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection
@BlueTeamLibrary
Docs
Advanced hunting best practices in Windows Defender ATP
Learn about Advanced hunting best practices such as what filters and keywords to use to effectively query data.
Docker Reference Architecture: Securing Docker EE and Security Best Practices
http://success.docker.com/article/security-best-practices
@BlueTeamLibrary
http://success.docker.com/article/security-best-practices
@BlueTeamLibrary
Active Directory Best Practices That Frustrate Pentesters
https://register.gotowebinar.com/register/4918848176372744707
@BlueTeamLibrary
https://register.gotowebinar.com/register/4918848176372744707
@BlueTeamLibrary
Advanced hunting now includes network adapters information
https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/td-p/224402
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/td-p/224402
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
Advanced hunting now includes network adapters information
We would like to welcome a new table to the Windows Defender ATP Advanced hunting schema: MachineNetworkInfo. For each network adapter seen on onboarded machines, this table provides the configured IP addresses, gateways, DNS servers, and more. Sounds…
Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.
https://github.com/shellster/DCSYNCMonitor
@BlueTeamLibrary
https://github.com/shellster/DCSYNCMonitor
@BlueTeamLibrary
GitHub
GitHub - shellster/DCSYNCMonitor: Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.
Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events. - shellster/DCSYNCMonitor
TBAL: an (accidental?) DPAPI Backdoor for local users
https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor
@BlueTeamLibrary
https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor
@BlueTeamLibrary
VztekOverflow
TBAL: an (accidental?) DPAPI Backdoor for local users
a.k.a how a convenience feature undermined a security feature
w0rk3r's Blue team Library
TBAL: an (accidental?) DPAPI Backdoor for local users https://vztekoverflow.com/2018/07/31/tbal-dpapi-backdoor @BlueTeamLibrary
YouTube
TBAL: an (accidental?) DPAPI Backdoor for local users
The Data Protection API (DPAPI) provided by Windows is a way of protecting secrets used by a lot of popular software solutions, most famously by Google Chrome when storing passwords and cookies. A lot has been said recently about the security of this API…
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
BloodHound 2.0 released!
https://github.com/BloodHoundAD/BloodHound/releases/tag/2.0
@WindowsHackingLibrary
https://github.com/BloodHoundAD/BloodHound/releases/tag/2.0
@WindowsHackingLibrary
GitHub
Release BloodHound 2.0 · BloodHoundAD/BloodHound
This is a major feature release for BloodHound, introducing several new features, optimizations, and bugfixes. For a full changelog, see the blog post at https://blog.cptjesus.com/posts/bloodhound2...
BIOS Boots What? Finding Evil in Boot Code at Scale!
https://www.fireeye.com/blog/threat-research/2018/08/bios-boots-what-finding-evil-in-boot-code-at-scale.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2018/08/bios-boots-what-finding-evil-in-boot-code-at-scale.html
@BlueTeamLibrary
Trellix
BIOS Boots What? Finding Evil in Boot Code at Scale! | Trellix
This post details the challenges Trellix faced examining boot records at scale and our solution to find evil boot records in large enterprise networks.
Improve your defensive posture with Exploit Guard ASR
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Improve-your-defensive-posture-with-Exploit-Guard-ASR
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Improve-your-defensive-posture-with-Exploit-Guard-ASR
@BlueTeamLibrary
Protecting the protector: Hardening machine learning defenses against adversarial attacks
https://cloudblogs.microsoft.com/microsoftsecure/2018/08/09/protecting-the-protector-hardening-machine-learning-defenses-against-adversarial-attacks
@BlueTeamLibrary
https://cloudblogs.microsoft.com/microsoftsecure/2018/08/09/protecting-the-protector-hardening-machine-learning-defenses-against-adversarial-attacks
@BlueTeamLibrary
Microsoft Security
Protecting the protector: Hardening machine learning defenses against adversarial attacks - Microsoft Security
Harnessing the power of machine learning and artificial intelligence has enabled Windows Defender Advanced Threat Protection (Windows Defender ATP) next-generation protection to stop new malware attacks before they can get started – often within milliseconds.…
Detecting Malicious Use of .NET – Part 1
https://countercept.com/our-thinking/detecting-malicious-use-of-net-part-1
@BlueTeamLibrary
https://countercept.com/our-thinking/detecting-malicious-use-of-net-part-1
@BlueTeamLibrary
Netflix Cloud Security: Detecting Credential Compromise in AWS
https://medium.com/netflix-techblog/netflix-cloud-security-detecting-credential-compromise-in-aws-9493d6fd373a
@BlueTeamLibrary
https://medium.com/netflix-techblog/netflix-cloud-security-detecting-credential-compromise-in-aws-9493d6fd373a
@BlueTeamLibrary
Medium
Netflix Cloud Security: Detecting Credential Compromise in AWS
Will Bengtson, Netflix Security Tools and Operations
Microsoft Research Detours Package
Detours is a software package for monitoring and instrumenting API calls on Windows.
https://github.com/Microsoft/Detours
@BlueTeamLibrary
Detours is a software package for monitoring and instrumenting API calls on Windows.
https://github.com/Microsoft/Detours
@BlueTeamLibrary
GitHub
GitHub - microsoft/Detours: Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed…
Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form. - microsoft/Detours
Active Directory Firewall Ports – Let’s Try To Make This Simple
https://blogs.msmvps.com/acefekay/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple
@BlueTeamLibrary
https://blogs.msmvps.com/acefekay/2011/11/01/active-directory-firewall-ports-let-s-try-to-make-this-simple
@BlueTeamLibrary
Group Policy application rules for domain controllers
https://support.microsoft.com/en-ca/help/259576/group-policy-application-rules-for-domain-controllers
@BlueTeamLibrary
https://support.microsoft.com/en-ca/help/259576/group-policy-application-rules-for-domain-controllers
@BlueTeamLibrary
Making Sense of Microsoft’s Endpoint Security Strategy
https://zeltser.com/making-sense-of-microsofts-endpoint-security-strategy
@BlueTeamLibrary
https://zeltser.com/making-sense-of-microsofts-endpoint-security-strategy
@BlueTeamLibrary
Zeltser
Making Sense of Microsoft’s Endpoint Security Strategy
Microsoft is no longer content to simply delegate endpoint security on Windows to other software vendors. The company has released, fine-tuned or rebranded multiple security technologies in a wa