What.

CyberSec Engineer, OffSec, Adversary Emulation, Retro PC stuff and all things IT infrastructure 😙

[What. @VoidStation_]

@Malcoreio @vxunderground Here is a comment

[What. @VoidStation_]

Bro is trynna to start a cyber warfare💀 https://t.co/ww7yqnRhXl

[Bryce @bryceabdo]

the SOC when an alert for suspicious powershell usage hits the queue

[GEC Entertainment. Inc @inc_gec]

Doom RPG at last, finally on PC as promised years ago come true today. You can play it now, download link from Doomworld : https://t.co/5mLMVPvOPi

[What. @VoidStation_]

@SwiftOnSecurity https://t.co/Yu35iJmc4d

[What. @VoidStation_]

@jasonhillva @SerpicoProject Have a look at: https://t.co/ImPfvrQlQx

[Kyle Avery @kyleavery]

Besides BloodHound from @_wald0 + @SpecterOps and PingCastle from @mysmartlogon, what other open source or free tools should every organization be running on a regular basis?

[Apogee Entertainment @Apogee_Ent]

As promised: 10k follower giveaway!

Simply retweet this post and make sure you're following us to enter.

Winner will be chosen tomorrow, January 25th.

[Sean Metcalf @PyroTek3]

Here's some recently published guidance from Trimarc on how to better protect admin credentials and mitigate ransomware impact:
https://t.co/Azsy0c1lBr

[dylan @_batsec_]

I'm releasing my tool to exploit AD CS relaying. It will automate most the steps required for both local and domain privilege escalation. The images below show how it can be used to get a beacon as system on a domain controller.

[Ryan Newington (MVP) @RyanLNewington]

My lockdown project last year was to build a toolkit to help organisations break attack chains and better defend against lateral movement. I've very proud of what we've achieved with Access Manager. LAPS and JIT for AD-joined hosts made easy, secure, and auditable.

[chad @duff22b]

Restricting SMB based lateral movement in a #Windows environment.

Lessons learned from work with the @SpecterOps team; drawing from previous posts by @mattifestation, @Haus3c, @cryps1s, @harmj0y & Mr SMB himself @NerdPyle

https://t.co/EqrHnnnBZW

#redteam #blueteam #infosec

[SwiftOnSecurity @SwiftOnSecurity]

For Windows Event Collection with no agents on the machine, LogBinder SuperCharger is the coolest software. I even got them to add all the Palantir event collection profiles by default. You could implement NSA-compliant collection in a few hours for a whole domain, load-balanced.

[Ryan Newington (MVP) @RyanLNewington]

Or you can jump on the beta of Access Manager, the next generation of laps web - Lithnet Access Manager https://t.co/2Ciilb3VGU

[The DFIR Report @TheDFIRReport]

Trickbot Still Alive and Well

➡️Discovery: AdFind, Nltest, Net, Bloodhound, PowerView
➡️Lateral Movement: SMB, WMI, PS
➡️C2: Trickbot & Cobalt Strike
➡️Credential Access: Ntdsutil & lsass dump
➡️PrivEsc: Named Pipe
➡️Defense Evasion: Trickbot->Wermgr

https://t.co/vcQiIsLDyU

[Jeff McJunkin @jeffmcjunkin]

Here's a threat on some overpowered technologies to slow down attackers that you can implement _now_.

First, re-implement LAPS (https://t.co/GvdXwpy52L) at your peril.

1/14

[FABINO @KinoFabino]

There is only one Doom pillow and two of us 👉👈

[Kotaku @Kotaku]

Morrowind completely rebooted your Xbox during some loading screens: https://t.co/F0QtP9rZ3Q

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon. We have observed attacks where public exploits have been incorporated into attacker playbooks.

[Steve Syfuhs @SteveSyfuhs]

Let's talk Azure AD join and what that means to a Windows device. What's it mean to be joined to something?