Tobi

OSCP | CRTO | Pen Tester | AWS Cloud Security Dude

[Tobi @Tobi4530482]

@_0b1d1 Pdf

[Cyber Ghost @CyberGhost13337]

A new clickfix technique, FileFix, developed by @mrd0x, is being used in the wild—poorly.

Website tersmoles[.]com delivers a "Legitimate Chrome Installer" using FileFix.

The attacker didn’t even change the path and filename—just copy-pasted code directly from demo website

[Tobi @Tobi4530482]

@BHinfoSecurity Hi 👋

https://t.co/0TxUN4R3y8

[Tobi @Tobi4530482]

AWS Penetration Testing Framework is now publicly available!

https://t.co/KjiVCZ85WK

[Tobi @Tobi4530482]

https://t.co/Fu85WEfPkq

[Nicolas Krassas @Dinosn]

A step by step EDR learning path https://t.co/l0MbGSCTij

[Nicolas Krassas @Dinosn]

Bypassing MFA on Microsoft Azure Entra ID https://t.co/AIfjsRloPU

[Nicolas Krassas @Dinosn]

Creating Payloads with ScareCrow to Mimic Reputable Sources and Bypass Anti-Virus https://t.co/cWoJl2N7rI

[ACE Responder @ACEResponder]

How attackers steal Primary Refresh Tokens and access cloud resources.

#ThreatHunting #DFIR #EntraID #AzureAD

[Keanu Nys @RedByte1337]

🚀I'm finally releasing GraphSpy to the public!🕵️
A powerful offensive security tool focused on making initial access and post-compromise enumeration in Microsoft Entra and M365 much more convenient during penetration tests and red team assessments!

https://t.co/OfI2TanQ61

[fortunato lodari @flodari]

AD Privesc
Kerberos TGS and SeTcbPrivilege

If you have SeTcbPrivilege, you can ask TGS on behalf of ALL logged users on your machine WITHOUT Password

...and if there is a Domain Admin logged?

Zero detection by EDR/AV

https://t.co/FpVmxPiDP3

#redteam #SeTcbPrivilege

[pfiatde @pfiatde]

Did you know, that a simple msi repair with a low privileged user can disable Cortex XDR if the tamper protection is turned off? 👇

[Tom Wechsler - Microsoft Azure & CDM MVP @tomvideo2brain]

Active Directory Advanced Threat Hunting - Using PowerShell to track down the source of account lockouts and bad passwords!
@Microsoft @msftsecurity @Windows #Microsoft #ActiveDirectory #mvpbuzz #coolstuff #Hunting #ADDS #Windows #WindowsServer
👇👇👇👇
https://t.co/QFHIXTJFbA

[rootsecdev @rootsecdev]

Another log on the fire why I really can’t recommend on premises exchange environments.

https://t.co/pyjyEg62DV

[Nicolas Krassas @Dinosn]

FullBypass: bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) https://t.co/sK0vKE3bs8

[Nicolas Krassas @Dinosn]

AzSubEnum - Azure Service Subdomain Enumeration https://t.co/hai96UnMgo

[Nicolas Krassas @Dinosn]

PoC Exploit Released for Microsoft Outlook RCE Flaw – CVE-2024-21413 https://t.co/VRVSMp0vLH

[rootsecdev @rootsecdev]

Something I still reference a lot. To this day.

The Attackers Guide to Azure AD Conditional Access – Daniel Chronlund Cloud Security Blog https://t.co/BqNKCwukZ4

[CloudBreach @Cloud_Breach]

Just launched the #CloudBreach Blog 🚀: Dive into the essentials of AWS Enumeration! Uncover the tactics for unauthenticated #AWSEnumeration, leveraging OSINT, Google & GitHub Dorks, and more. A must-read for #CloudSecurity readers. https://t.co/N03pdOsqhE