Forging Trusts for Deception in Active Directory
https://www.labofapenetrationtester.com/2018/10/deploy-deception.html
@BlueTeamLibrary
https://www.labofapenetrationtester.com/2018/10/deploy-deception.html
@BlueTeamLibrary
Labofapenetrationtester
Forging Trusts for Deception in Active Directory
Home of Nikhil SamratAshok Mittal. Posts about Red Teaming, Offensive PowerShell, Active Directory and Pen Testing.
Automating investigation and response for memory-based attacks
https://techcommunity.microsoft.com/t5/What-s-New/Automating-investigation-and-response-for-memory-based-attacks/m-p/276354
@BlueTeamLibrary
https://techcommunity.microsoft.com/t5/What-s-New/Automating-investigation-and-response-for-memory-based-attacks/m-p/276354
@BlueTeamLibrary
TECHCOMMUNITY.MICROSOFT.COM
Automating investigation and response for memory-based attacks
As the threat landscape evolves, we continue to see a rise in evasive memory-based, or as they are also know - fileless attacks. This shift in attacker techniques requires security tools to gain new optics. It requires security analysts to enhance their investigation…
Another Word on Delegation
https://posts.specterops.io/another-word-on-delegation-10bdbe3cd94a
@BlueTeamLibrary
https://posts.specterops.io/another-word-on-delegation-10bdbe3cd94a
@BlueTeamLibrary
Medium
Another Word on Delegation
Every time I think I start to understand Active Directory and Kerberos, a new topic pops up to mess with my head. A few weeks ago, @elad_shamir contacted @tifkin_ and myself with some ideas about…
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
If we win, we lose
Tim MalcomVetter at BlueHat v18
https://www.youtube.com/watch?v=ifCeaYShRSU
@SecTalks
Tim MalcomVetter at BlueHat v18
https://www.youtube.com/watch?v=ifCeaYShRSU
@SecTalks
YouTube
BlueHat v18 || "If we win, we lose"
Tim MalcomVetter, Walmart
We have this saying on my red team that we borrowed from the NSA Red Team: “if we win, we lose.” It reveals the dichotomy of excelling at both offense and defense. We want our Red Teams to try to win, right? Or was it Blue? The…
We have this saying on my red team that we borrowed from the NSA Red Team: “if we win, we lose.” It reveals the dichotomy of excelling at both offense and defense. We want our Red Teams to try to win, right? Or was it Blue? The…
Security Talks
If we win, we lose Tim MalcomVetter at BlueHat v18 https://www.youtube.com/watch?v=ifCeaYShRSU @SecTalks
Slides: "If we win, we lose" - Using healthy competition to measure and improve security programs || BlueHat v18
https://www.slideshare.net/MSbluehat/if-we-win-we-lose-using-healthy-competition-to-measure-and-improve-security-programs
@BlueTeamLibrary
https://www.slideshare.net/MSbluehat/if-we-win-we-lose-using-healthy-competition-to-measure-and-improve-security-programs
@BlueTeamLibrary
www.slideshare.net
BlueHat v18 || "If we win, we lose" (using healthy competition to mea…
Tim MalcomVetter, Walmart We have this saying on my red team that we borrowed from the NSA Red Team: “if we win, we lose.” It reveals the dichotomy of excellin…
Detect Password Spraying With Windows Event Log Correlation
https://www.ziemba.ninja/?p=66
@BlueTeamLibrary
https://www.ziemba.ninja/?p=66
@BlueTeamLibrary
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
10 Red Teaming Lessons Learned Over 20 Years
https://www.oodaloop.com/ooda-original/2015/10/22/10-red-teaming-lessons-learned-over-20-years
@WindowsHackingLibrary
https://www.oodaloop.com/ooda-original/2015/10/22/10-red-teaming-lessons-learned-over-20-years
@WindowsHackingLibrary
OODA Loop
10 Red Teaming Lessons Learned Over 20 Years
I've been a red teamer for twenty years now, perhaps even longer, but I didn't know what to call it until 1995 when I started working with the Department of Defense. I've also been fortunate
A Linux version of the ProcDump Sysinternals tool
https://github.com/microsoft/procdump-for-linux
@BlueTeamLibrary
https://github.com/microsoft/procdump-for-linux
@BlueTeamLibrary
GitHub
GitHub - microsoft/ProcDump-for-Linux: A Linux version of the ProcDump Sysinternals tool
A Linux version of the ProcDump Sysinternals tool. Contribute to microsoft/ProcDump-for-Linux development by creating an account on GitHub.
Forwarded from Security Talks (Jonhnathan Jonhnathan Jonhnathan)
The matrix has you: protecting linux using deception
Ross Bevington at BlueHat v18
https://www.youtube.com/watch?v=abamlxFHElw
@SecTalks
Ross Bevington at BlueHat v18
https://www.youtube.com/watch?v=abamlxFHElw
@SecTalks
YouTube
BlueHat v18 || The matrix has you: protecting linux using deception
Ross Bevington, Microsoft
In ‘The Matrix’ sentient machines subdue the population by developing a highly sophisticated simulation. High interaction honeypots are a lot like The Matrix, designed to convince an attacker to execute an attack so we can monitor…
In ‘The Matrix’ sentient machines subdue the population by developing a highly sophisticated simulation. High interaction honeypots are a lot like The Matrix, designed to convince an attacker to execute an attack so we can monitor…
CVE-2018-8415 | Microsoft PowerShell Tampering Vulnerability
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8415
@BlueTeamLibrary
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8415
@BlueTeamLibrary
Personal compilation of APT malware from whitepaper releases, documents and own research
https://github.com/sapphirex00/Threat-Hunting
@BlueTeamLibrary
https://github.com/sapphirex00/Threat-Hunting
@BlueTeamLibrary
GitHub
GitHub - sapphirex00/Threat-Hunting: Personal compilation of APT malware from whitepaper releases, documents and own research
Personal compilation of APT malware from whitepaper releases, documents and own research - sapphirex00/Threat-Hunting
Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign
https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
@BlueTeamLibrary
https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
@BlueTeamLibrary
Google Cloud Blog
Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign | Mandiant | Google Cloud Blog
Detecting Domain Fronting Malware
https://www.activecountermeasures.com/detecting-domain-fronting-malware
@BlueTeamLibrary
https://www.activecountermeasures.com/detecting-domain-fronting-malware
@BlueTeamLibrary
Active Countermeasures
Detecting Domain Fronting Malware - Active Countermeasures
There has been a lot of conversations lately in the offensive community about domain fronting and its imminent “demise”. There are a large […]
From hacked client to 0day discovery
https://security.infoteam.ch/en/blog/posts/from-hacked-client-to-0day-discovery.html
@BlueTeamLibrary
https://security.infoteam.ch/en/blog/posts/from-hacked-client-to-0day-discovery.html
@BlueTeamLibrary
Infoteam Digital
Infoteam Digital | The Digital Partner For SMEs
Infoteam Digital supports companies in the digitalisation of their activities, in the daily management of their IT and in the training of their employees.
Detecting Google Services Malware
https://www.activecountermeasures.com/detecting-google-services-malware
@BlueTeamLibrary
https://www.activecountermeasures.com/detecting-google-services-malware
@BlueTeamLibrary
Active Countermeasures
Detecting Google Services Malware - Active Countermeasures
In our previous blogs, we covered how malware can use Domain Fronting to bypass many of the security tools we use to detect […]
Netflix Information Security: Preventing Credential Compromise in AWS
https://medium.com/netflix-techblog/netflix-information-security-preventing-credential-compromise-in-aws-41b112c15179
@BlueTeamLibrary
https://medium.com/netflix-techblog/netflix-information-security-preventing-credential-compromise-in-aws-41b112c15179
@BlueTeamLibrary
Medium
Netflix Information Security: Preventing Credential Compromise in AWS
by Will Bengtson
Hunting in Active Directory: Unconstrained Delegation & Forests Trusts
https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
@BlueTeamLibrary
https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
@BlueTeamLibrary
Medium
Hunting in Active Directory: Unconstrained Delegation & Forests Trusts
During DerbyCon 2018 this past October, my teammates @tifkin_, @enigma0x3 and @harmj0y gave an awesome presentation titled “The Unintended…
New .NET Framework 4.8 on Windows 10 now triggers antivirus scans for assemblies loaded by Assembly.Load(byte[]) thanks to the Antimalware Scan Interface (AMSI).
https://blogs.msdn.microsoft.com/dotnet/2018/11/28/announcing-net-framework-4-8-early-access-build-3694
@BlueTeamLibrary
https://blogs.msdn.microsoft.com/dotnet/2018/11/28/announcing-net-framework-4-8-early-access-build-3694
@BlueTeamLibrary
Microsoft
Announcing .NET Framework 4.8 Early Access build 3694
A first-hand look from the .NET engineering teams