Shawn Carlson

Security Ops | Threat Mgmt | Vuln Mgmt | Data center | Geek | Project Management | Data Viz | Navy veteran

[Windows Update @WindowsUpdate]

Microsoft is releasing Out-of-band (OOB) updates to address a known issue which might cause sign in failures or other Kerberos authentication issues. https://t.co/3til5aSjFR

[Steve Syfuhs @SteveSyfuhs]

OOB patch to fix affected DCs is scheduled. ETA before end of week.

Patch will fix underlying bug and disable the reg key floating around the internet.

[OrdinalExport @OrdinalExport]

Releasing a new tool: Orpheus! Bypasses most Kerberoast Detections (including my own). Blog post and video is up at @TrustedSec! Even used @HackingDave's old alias in the demo. https://t.co/qhP8r28s4K #infosec #security #kerberoast

[Matt Zorich @reprise_99]

I am very excited to have a blog published by @MicrosoftDART and @MsftSecIntel that I was one of the major contributors to. I would love for you to have a read! The use of cloud token theft is on the rise; learn how to prevent, detect and respond - https://t.co/hB0GdPOxBW

[Nathan McNulty @NathanMcNulty]

Hey all, I just published an article on using Azure AD's Access Packages to enable end user device enrollment in Microsoft Intune

https://t.co/PBTwDCWAN9

If you have Azure AD P2 licensing and haven't seen Access Packages, welcome to your new obsession :)

[cq @cq674350529]

The slide of my talk "MikroTik RouterOS Security: The Forgotten IPC Message" at #POC2022 is availble: https://t.co/lTt2QUMiyD :)

[Paul Seekamp @nullenc0de]

This is why I tell everyone to set an audit event for exporting the DPAPI backup key (event 4692).

[Radley Balko @radleybalko]

TIL that as the CO river dries up, AZ is leasing its largest underground aquifer to the Saudis, who are growing water-intensive alfalfa, which is then shipped back to S.A. to feed cattle. Market rate for the lease is $5 million/yr. Saudis pay $86K.

https://t.co/8sDDYCqNO0

[Amitai Cohen @AmitaiCo]

Here are the main ways that vulnerable #OpenSSL instances *might* manifest in-the-wild (we will update this diagram to be more precise once the CVE details have been published). Credit to @ncsc_nl for the appropriately Halloween-themed logo.

[0xor0ne @0xor0ne]

Very interesting writeup on YubiKey weaponization!
(credits @Wh1t3Rh1n0)

https://t.co/YHISer7kH1

#yubikey #informationsecurity #CyberSecurity #hacking #redteam

[mininatechsec @mininatechsec]

Job hunting

Vulnerability management
Security awareness
Compliance

People + tech + #infosec + compliance

Please retweet

[Sean Metcalf @PyroTek3]

Based on what we have seen during Active Directory security assessments, if you have Active Directory Certificate Services (ADCS) in your environment, you want to download and run Locksmith to scan for ADCS security issues.
Locksmith provides remediation as well!

[Mastering Burp Suite Pro @MasteringBurp]

Want to a integrate a lightweight (and free!) version of Burp Scanner in your CI/CD pipeline? 🎁👀https://t.co/DGecJyB2dn

[Johnny Shaw @jxy__s]

🎊 I am pleased to present VMPlex Workstation - A modern, tabbed UI for Hyper-V. The code is open source and the first release is available for download on GitHub. Kudos to @0xf005ba11 for creating this! https://t.co/eZ41d7v6Di

[Sam Erde @SamErde]

Huge thanks to @SantasaloJoosua for creating the awesome 𝗖𝗔 𝗢𝗽𝘁𝗶𝗰𝘀 for analyzing gaps in #Azure Active Directory conditional access policies. Thanks for working through my uncommon scenario with me! #MVP! #IAM #InfoSec #BlueTeam #AzureAD #GCCHIGH
https://t.co/SzUv34Nqfl

[Dino A. Dai Zovi @dinodaizovi]

🎉 I'd like to share something that I'm legit really excited about: https://t.co/kj5vhVIcS4

Pivit is our tool that we've been using for git signing using hardware-attested private keys generated in Yubikey's PIV applet (we send the CSR to a CA that verifies attestation).

PTAL!

[Jack @jack_naglieri]

One of the first things I did at Panther was configure SSO and hardware MFA.

Read about how our team has up-leveled with FIDO2 and Okta:

https://t.co/FH7hSLysEf

[Stephan Berger @malmoeb]

1/ Perhaps a lesser known "feature" of Microsoft Authenticator, but the diagnostic data can be very helpful in investigating a compromised #Azure account where MFA is enabled but the user claims not to have confirmed the MFA Consent Prompt. 🧵