Cybersecurity and everything else!
Kerberoasting and AS-REP roasting are still bread-and-butter AD abuse. Rubeus makes both loud in a lab and educational on the wire: the LDAP search that finds targets is …
Continue reading →BloodHound / SharpHound / bloodhound-python are not subtle on LDAP if you know what “enumerate the world” looks like. Host telemetry helps. On a span or IDS sitting …
Continue reading →PetitPotam is the “please coerce that machine into authenticating over there” energy that made AD CS and NTLM relay feel fresh again for a while. Different story than …
Continue reading →Impacket is still the Swiss army knife people reach for when they want AD pain without opening Visual Studio. In the lab I care less about the binary …
Continue reading →Yeah so AD CS abuse is one of those things that looks clean in a conference talk and messy the second you try to detect it on a …
Continue reading →Citrix Bleed — CVE-2023-4966 — is one of those bugs where the CVSS number under-sold how people were actually getting ransomed. Memory disclosure on NetScaler ADC / Gateway-style …
Continue reading →Yeah so account lockouts. Most of them are boring. Phone still has the old password, Outlook on a laptop that never got the new one, some backup job …
Continue reading →Get all Login/Logoff events (113039 = Login, 113019 = Disconnect/Logoff) cat asa_logs.csv | grep -E ‘113039’\|’113019′ 2020-06-19T16:22:23,SENSOR01.asa5505.myorg.local,%ASA-6-113039: Group User IP <78.78.78.78> AnyConnect parent session started.2020-06-19T17:57:55,SENSOR01.asa5505.myorg.local,”%ASA-4-113019: Group = SSLVPN, …
Continue reading →Links open directly to the relevant pages in Office 365 Enable MFA for Administrative Accounts. 2. Configure PIM (Privileged Identity Management) for Admin Accounts.Microsoft Documentation – O365 License …
Continue reading →