JimL

3+ decades of IT shenanigans.
Prior: Dev/Net/DB/SysAdmin, of many things.
Now: Infosec fun for last 9+ years.
Still learning. Still yells at clouds.
#HTP. #2A.

[Naomi Brockwell priv/acc @naomibrockwell]

https://t.co/dj9q5Rfv38

[sysxplore @sysxplore]

No disrespect to Linus Torvalds, but this guy is the greatest geek alive 🫡

Created UNIX in 1971 when he was 28 years old.
Created Go in 2009 when he was 66 years old.

He also developed the B programming language (which led to C), created UTF-8 encoding (making international text possible online), and designed essential tools like grep that developers still rely on daily.

He also helped with the development of Multics (that led to UNIX), Plan 9 from Bell Labs and Inferno operating systems.

That's 4 operating systems in total... Most people don't even use these many OS.

Pretty impressive resume, right?

And it's a shame that many people, even the ones in the IT and tech industry, don't know him.

Ken Thompson.... Remember the name 🙏

[spencer @techspence]

Again, most of these issues are easily identified using ADeleginator or ADeleg. Highly recommend checking these two tools out.

ADeleginator - https://t.co/FgdvN8lS1D

ADeleg - https://t.co/LCBYlpfzpD

[spencer @techspence]

Doing something is better than nothing. If you’re not sure where to start here’s a few ideas

- Keep domain admins off workstations
- Strengthen service account passwords
- Monitor privileged logins/resources
- Lock down AD CS

[Sean Metcalf @PyroTek3]

Last week we covered Active Directory Group Policy permissions (https://t.co/tq9kAiuTcY).

This week, we dig into Active Directory Kerberos delegation. I have mentioned in several presentations that Kerberos delegation is impersonation. Kerberos delegation is used when a service (ex. web server) needs to impersonate a user when connecting to a resource (ex. database).

There are a 4 types of Kerberos delegation:
* Unconstrained - impersonate authenticated user to any Kerberos service
* Constrained - impersonate authenticated user to specific Kerberos services
* Kerberos Constrained Delegation Protocol Transition - impersonate any user account to specific Kerberos services
* Resource-based Constrained Delegation - enables delegation configured on the resource instead of the account

Unconstrained delegation should be converted to constrained delegation due to security concerns. Any Kerberos delegation that is no longer required should be removed. If there's no associated Kerberos service principal name, Kerberos authentication isn't working and this should be fixed or removed.

PowerShell code using the Active Directory PowerShell module:
https://t.co/8Csc3DalVO

#ActiveDirectorySecurityTip

[spencer @techspence]

Dangerous logon scripts are still out there waiting to be found. If you haven’t checked your environment, there’s no better time than now.

https://t.co/xoR6epJhPH

[spencer @techspence]

occasionally I’ll see domain join accounts that are over privileged on internal pentest. Great to see updated docs for this 🙌 https://t.co/BclMfq8vQe

[Sean Metcalf @PyroTek3]

Recently, we looked at Active Directory built-in groups (https://t.co/Pjxg0Te4MJ)

This week, we focus on Active Directory Group Policy Objects (GPOs). GPOs should be audited regularly to identify the configured owner as well as the permissions to ensure they are appropriate. In the provided script, I added a column called default, so you can look for the non-default owners and permissions to correct.

Group Policy in Active Directory is very powerful, so it's important to understand who the owners are. The Group Policy Owner can change permissions on the GPO and get edit rights to the GPO. GPO Owner should only be set to "Domain Admins" or "Enterprise Admins".

Changing the owner can be done by opening Active Directory Users and Computers (ADUC), going to the View menu option and selecting Advanced. Then browse down to System, Policies. Right-click on the desired GPO ID and select Properties. Then go to the Security tab and click on the Advanced button. Click on the Change option next to the owner and change the owner to "Domain Admins".

Review the permissions that are flagged non-default in the script and ensure they are appropriate. No standard users should have Edit rights. Also, edit rights (& full control) on any GPOs linked to the Domain root and the Domain Controllers OU should only be configured for AD Admins (preferably "Domain Admins").

Script leveraging the Group Policy PowerShell module:
https://t.co/oufTJYcRYQ

#ActiveDirectorySecurityTip

[Philip Elder @MPECSInc]

ACTIVE DIRECTORY: RESET THE DSRM PASSWORD

Got the DSRM password for each DC documented somewhere? It's surprising how many folks we've encountered that are in a pickle and have no clue what the DSRM password is!

In an elevated CMD for a local DC:
ntdsutil
set dsrm password
reset password on server null
q
q

For a remote DC:
ntdsutil
set dsrm password
reset password on server SERVERNAME
q
q

Now that we've done that it's documented right? The Disaster Recovery Plan documentation is updated if the DSRM location isn't indicated?

Acronyms
DSRM = Directory Services Restore Mode

[Matt Zorich @reprise_99]

Privileged access workstations deployments are one of the absolute shining examples of 'don't let perfect be the enemy of good' in cybersecurity.

If you don't have the money, resources, time or organizational buy in to go with full separate hardware, fancy PAM systems and the rest of it, then don't let that stop you from starting on your journey.

You can honestly get 85% of the way there through smart use of Intune & group policy, Conditional Access and enforcing strong authentication methods on those users.

Stopping domain admins from logging onto end user workstations and using phishing resistant auth for those high privileged users is going to reduce your risk as much as new hardware would.

[Justin Kohler @JustinKohler10]

Is that attack paths in #1Password via #BloodHound?

Learn more about the future Attack Path Management and BloodHound 8.0 this Thursday:

https://t.co/wiVi18Udbp

[Chris Thompson @_Mayyhem]

I'm SO hyped to finally make MSSQLHound public! It's a new BloodHound collector that adds 37 new edges and 7 new nodes for MSSQL attack paths using the new OpenGraph feature for 8.0!. Let me know what you find with it!
- https://t.co/Hh089SaVOS
- https://t.co/geO0HXTykf

[Bad Sector Labs @badsectorlabs]

Ludushound shows the power of community driven innovation in cybersecurity. @bagelByt3s created an awesome tool to convert bloodhound data into a working lab in 🏟️ Ludus. Replicate complex live environments with automation - and get back to the fun stuff!

https://t.co/19qfjRwaOA

[Bad Sector Labs @badsectorlabs]

Tons of great content released over the past few weeks. Get caught up with Last Week in Security!

https://t.co/13j2Z1Wgje

[Steven Lim @0x534c]

🔍 https://t.co/Ab7EYI2HKz is a growing hub for community-driven detection rules—KQL, Sigma, YARA, Splunk & more. I've migrated across my 300+ KQL rules @SlimKQL and will continue sharing new ones. Catch them all here 👉 @KQLWizard 😉🔥  

Invitation Code: Slim2025

[0xdf @0xdf_]

If you are doing any kind of ADCS enumeration / exploitation, I cannot understate how good and useful the Certipy wiki it. Huge shoutout to @ly4k_ and the other contributors for this resource.

https://t.co/bmPXGgNbQO

[SpecterOps @SpecterOps]

Introducing the BloodHound Query Library! 📚

@martinsohndk & @joeydreijer explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem. https://t.co/Ssnp0wE4kW

[Last Week in Security (LWiS) @lastweekinfosec]

Stealth syscalls (@darkrelaylabs), VM introspection (@memn0ps), Marebackup LPE (@itm4n), Azure Arc C2 (@ZephrFish), and more! https://t.co/Kf9K8JHC7N

[Last Week in Security (LWiS) @lastweekinfosec]

BadSuccessor (@YuG0rd), o3 finds SMB 0day (@seanhn), crashing defender (@InfoGuard_Labs), and more! https://t.co/dT2VDit8ne