Lerner Oleg

[Lerner Oleg @OlegLerner]

@cnotin @IstaPee The resources in this thread should describe the full process.
If you need further clarification, please feel free to contact us.
A special thanks to @B1t0n_ for the research writeup.

[Lerner Oleg @OlegLerner]

@cnotin @IstaPee In summary, complete remediation is possible, but it's a highly sensitive process that requires good understanding of the underlying Domain implementation of DPAPI.
Ensure rotation of "Backup Key", users "Master keys" and encrypted blobs.

[Lerner Oleg @OlegLerner]

Think you know everything about DPAPI? Think again. Delve into the shadowed world of full remediation after a DPAPI domain backup key attack. This insightful paper explores the fascinating process of recovering from the cryptography persistency of attackers.

[Sygnia @sygnia_labs]

Read our latest article where Sygnia’s Adversarial Research Team (ART), demonstrates for the first time how defenders can replace their DPAPI backup key, to fully remediate their organization in an Active Directory compromise incident.

Author: Gil Biton

https://t.co/EulnfouyEs

[Lerner Oleg @OlegLerner]

Unlock the full potential of #DROPS with our new community-driven repository!
Contribute and add your favorite tools to the cheat sheet. Check it out now at https://t.co/ufSkVtx8aV #cheatsheet #communitydriven #RedTeam

[Lerner Oleg @OlegLerner]

@Nickieyey One thing that for me was missing in cheat sheets is a dynamic option for changing params.
Give this dynamic cheat sheet a try:
https://t.co/8AANr9QwCZ

[Lerner Oleg @OlegLerner]

#SingaporeGP Finally back!

[B1t0n @B1t0n_]

We started to maintain a fork of the Pwndrop tool https://t.co/smjbKujzvm @sygnia_labs #redteam #infrastructure

[Sygnia @sygnia_labs]

Sygnia's Qemuno framework was launched to help execute #RedTeam operations and evade detection by #endpointsecurity solutions without the need for administrative permission. @Github: https://t.co/gFK494YDkV

[Sygnia @sygnia_labs]

It was a full house at #DefCon 2022 Adversary Village, where our very own @OlegLerner spoke about the architecture and capabilities of Qemuno, the offensive operations suite.

@defcon

[Lerner Oleg @OlegLerner]

Are you still using your notes as #cheatsheets?

I have news for you, we created a dynamic #cheatsheet #DROPS. Hopefully It will help you to save some time :)

give it a try - https://t.co/jDjGMH0UG6

Another creation by #ART

[Sygnia @sygnia_labs]

We are proud to introduce our newest tool #DROPS, a Dynamic Cheat Sheet, where you can generate commands and save time on crafting them.
It also correlates the relevant #Git and #MITRE information for the tasks you will execute. Give it a try - https://t.co/qWaWUSsPzz

[Lerner Oleg @OlegLerner]

Was pure pleasure speaking at @AdversaryVillag #DEFCON30 about our new #redteam framework, that helps to avoid EDR detection.
Thanks to everyone who joined, hope to see you next year.
Stay tuned for the repo release!

[Adversary Village @AdversaryVillag]

#AdversaryTool
@OlegLerner demonstrating his tool! "Qemuno – An uninvited guest
Adversary Tool"

#AdversaryVillage at @DEFCON 30
#Tooldemo

[Lerner Oleg @OlegLerner]

More than happy to share that I will be presenting a framework we developed for red team operations, #Qemuno, at @defcon 30, on Aug 14th 12:30 PDT.
Hope to see you there!

[Sygnia @sygnia_labs]

Sygnia's Red Team developed an advanced solution by leveraging CI/CD pipelines to automate the many manual tasks performed to bypass #securitycontrols in target environments, saving a lot of time and effort. https://t.co/pk2NCmTa8S?

[Lerner Oleg @OlegLerner]

I’m very excited to share the work led by a member of Sygnia’s Adversarial Research Team (ART) @B1t0n_ to create an offensive CI/CD framework.
An impressive piece of ART!
@sygnia_labs #CyberSec #RedTeam #BlueTeam #ScallOps #CICD

[Sygnia @sygnia_labs]

Red Teamer Alert! What if you could use CI/CD to weaponize Red Team tools?

The Sygnia #RedTeam leveraged CI/CD pipelines to automate the many manual tasks performed to bypass #SecurityControls in target environments, saving a lot of time and effort. https://t.co/vaB9AXcfsY

[Sygnia @sygnia_labs]

Join us Feb 17th at 19:00 for beer & insights from the trenches with Israel’s smartest #RedTeamers & #CyberDefenders. You’ll hear from @abinbev’s Roei Sherman & @ohad_mz, and Sygnia’s Ilia Rabinovitch, @OlegLerner & Nir Saias. Register here: https://t.co/RrzQKhbMrz

[Arie Zilberstein @ariezilb]

As a lot of information is being piled up about the #log4j vulnerability #Log4Shell, @sygnia_labs #incidentresponse team has put together an end-to-end #threathunting strategy to assist organizations identify whether you have been compromised. https://t.co/XE0ZZSfOCv

[Sygnia @sygnia_labs]

Join us tomorrow @HITBSecConf where @B1t0n_ will be discussing the essentials for making #redteam operations more efficient and scalable and demonstrate an offensive pipeline framework
https://t.co/oQ51mEEYEN
#HITB2021SIN #ethicalhacking #infosec

[Sygnia @sygnia_labs]

Following our talk at @defcon @AdversaryVillag, we published the ScallOps framework, where you can develop, collaborate and utilize "Recipes" in order to perform #RedTeam tasks with greater efficiency.
#defcon29
https://t.co/6QVokkGcma

[Sygnia @sygnia_labs]

If you missed our virtual talk at @defcon @AdversaryVillag, you can now catch up via @YouTube

DEF CON 29 Adversary Village - Gil Biton - Scaling Up Offensive Pipelines https://t.co/wy1fipfYYx

[Sygnia @sygnia_labs]

From all of the team at Sygnia, we wish our Singaporean friends, family, colleagues and business associates, a very happy National Day!
May you have a wonderful day of celebrations. Majulah Singapura!