Steven Dick

DFIR, video games and whiskey... Not necessarily in that order.

[Steven Dick @DickcapitalD]

@ImposeCost Impose cost, impose ALL the cost.

[Steven Dick @DickcapitalD]

@M_haggis Cause mimidogz never worked as a bypass... Lol

[Steven Dick @DickcapitalD]

@techspence Rapid7 has honey "things" as part of their config. Pots, Tokens, etc.

[Steven Dick @DickcapitalD]

@JBizzle703 - Threat hunting is a buzz word.

- Alert fatigue is an excuse for poor process.

[Steven Dick @DickcapitalD]

@UK_Daniel_Card Does psexec and especially it's various less legit clones count?

psexec.exe / psexecsvc.exe
paexec.exe / PAExec-{pid}-{source}.exe
csexec.exe
remcom.exe / remcomsvc.exe
xcmd.exe / xcmdsvc.exe

[Steven Dick @DickcapitalD]

@cristianhares @Sysinternals @foxmsft @markrussinovich Systems were confirmed to have v15 of SysmonDrv.sys as well as the Sysmon executable.

[Steven Dick @DickcapitalD]

@cristianhares @Sysinternals @foxmsft Continuing to see the same server hang issues from v14.16 on v15.0 @ $dayjob.

Is anyone else having this same experience?

@Sysinternals @foxmsft @markrussinovich
#Sysmon

[Steven Dick @DickcapitalD]

@GabrielMergulh8 @olafhartong Same here, v14.16 and v15 cause dead locks on production devices, especially domain controllers.

No blocking entries in the Sysmon config either.

[Steven Dick @DickcapitalD]

https://t.co/S2oi82YKFs

Does this mean those without E5 will finally get access to those juicy mailitemaccessed events?

Who knows

@HECFBlog @megan_roddie @joshlemon #FOR509

[Steven Dick @DickcapitalD]

@M_haggis But that sounds like work...

[Steven Dick @DickcapitalD]

@cyb3rops - Just get an EDR

[Steven Dick @DickcapitalD]

@jorgeorchilles @Jean_Maes_1994 @pwnEIP @SANSOffensive Neato, how about you ship me one for closer...ahem inspection?

[Steven Dick @DickcapitalD]

@bettersafetynet Also as much fun: Finger grime in trackball rollers/sensor?

[Steven Dick @DickcapitalD]

@DetectionLab Thanks for such an awesome resource, good luck on your next adventure(s).

Any plans to name a successor/maintainer for the project?

[Steven Dick @DickcapitalD]

@bettersafetynet Im glad? it's not just me... It's hard to complain about a hotel room being quiet... At least the HVAC is always noisy 🤣

[Steven Dick @DickcapitalD]

Might be some exploit detection opportunities in looking for files being written by Sysmon.exe (outside of the archive folder)?

[Steven Dick @DickcapitalD]

@olafhartong @SwiftOnSecurity @cyb3rops Kind of hot off the presses...

Thanks for the write-up @filip_dragovic

[Filip Dragovic @filip_dragovic]

Here is PoC for CVE-2022-41120 https://t.co/oXkBYi4bWk. I combined arb file delete and limited arb file write to get code execution as NT Authority\System.

[Steven Dick @DickcapitalD]

@Ben0xA @cantcomputer @TrustedSec @HackingDave @Ben0xA Great post very informative... Been using canary SPNs for a few years so it's nice to see that in play.

Any notional idea how much longer 0x17 tickets take to crack versus 0x12 given all other factors equal?

[Daniel Kelley @danielmakelley]

30 cybersecurity search engines for researchers:

1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
5. ZoomEye—Gather information about targets.

[Steven Dick @DickcapitalD]

If you follow me, come find me... This social media juggle sucks.

https://t.co/RRnormGNTk