Adrián Lois

Cosas de Ciberseguridad.

[Adrián Lois @adrianlois_]

RedShelf Virdocs - Bypass DRM protection PDF Download.
"Bypass DRM" protection for disallowed downloading of ePub/eReader eBooks on the RedShelf (Virdocs) platform, export these documents in PDF format.
https://t.co/dCrJ3aVup4
#bypass #drm #redshelf #virdocs

[Adrián Lois @adrianlois_]

Digital Forensics Incident Response and Detection Engineering: Análisis forense de artefactos, técnicas anti-forense y técnicas de detección.

▶ https://t.co/sVUtfsTcty

#dfir #digitalforensic #threatdetection #incidentresponse #redteam #blueteam #infosec #cybersecurity

[Adam Chester 🏴‍☠️ @_xpn_]

Quick POC this evening looking at how LAPS (v2) passwords are stored and decrypted on Active Directory (tl;dr, msLAPS-EncryptedPassword attr and NCryptStreamUpdate for crypto) https://t.co/QaZdleEvNc

[Thomas Roccia 🤘 @fr0gger_]

🔍If you are looking for a comprehensive overview of the current #3CX supply chain attack, I created a diagram that shows the attack flow!💥I'll update as soon as the analysis progresses. Stay tuned for the MacOS edition! #cybersecurity #infosec #supplychainattack #3CXpocalypse

[Adrián Lois @adrianlois_]

Bypass PowerShell Execution Policy.
Varias formas de eludir la política de ejecución de PowerShell.
https://t.co/f71DzOwDK2

#powershell #windows #bypass #cybersecurity #hacking #infosec

[Adrián Lois @adrianlois_]

Análisis y detección de Hoaxshell "¿una la shell indetectable?". Identificando posibles IOC y creando una regla de detección para generar alertas en Wazuh

https://t.co/AxwVk3J9mw

#hoaxshell #windows #powershell #microsoft #threathunting #blueteam #ciberseguridad #cybersecurity

[Adrián Lois @adrianlois_]

Port knocking o golpeto de puertos: implementación en un servicio SSH y varias opciones de como conectarse usando esta mecanismo de seguridad vía Knockd, Telnet y Nmap

https://t.co/50B8wio0UM

#SSH #linux #portknocking #hardening #blueteam #ciberseguridad #cybersecurity #infosec

[Adrián Lois @adrianlois_]

Implementación de 2FA en servicios de conexión SSH y la posibilidad de añadir un tercer factor de autenticación 3FA combinando los métodos SSH Public Key + Password + TOTP

Artículo: https://t.co/M27A1x2sQp

#SSH #2FA #hardening #blueteam #ciberseguridad #cybersecurity

[Adrián Lois @adrianlois_]

KrbRelayUp PrivEsc: Escalada de privilegios local en entornos Active Directory y mitigación.

Artículo: https://t.co/jqkIsqaAwt

#KrbRelayUp #windows #vulnerability #activedirectory #privesc #hardening #ciberseguridad #cybersecurity #infosec #seguridadti

[Adrián Lois @adrianlois_]

Another way to mitigate #KrbRelayUp is to remove the "Authenticated users" group from the "Add workstations to domain" policy in the Default domain controller policy and assign a specific group to perform these operations. @dec0ne

[Adrián Lois @adrianlois_]

@wdormann @dec0ne @tiraniddo @cube0x0 @harmj0y There was indeed an implementation error, the GPO should be applied to the default domain controller policy. Although I still prefer the modification of the ms-DS-MachineAccountQuota=0 attribute directly prevents host creation in AD avoiding persistence and execution ;)

[Adrián Lois @adrianlois_]

@wdormann @dec0ne @tiraniddo @cube0x0 @harmj0y It seems that the best form of mitigation is to modify the ms-DS-MachineAccountQuota=0 attribute directly avoids host creation in AD and would also avoid persistence. I think it has less impact than requiring LDAP signature for retrocompatibility in legacy envs. @wdormann @dec0ne

[Adrián Lois @adrianlois_]

@wdormann @dec0ne @tiraniddo @cube0x0 @harmj0y The two GPOs should be established. Anyway checking the configuration the persistence and privesc is still working @wdormann @dec0ne

[Adrián Lois @adrianlois_]

Interesante artículo de @jasonfossen de @SANSInstitute sobre la seguridad cifrada y simétrica entre los formatos de compresión de ficheros 7z y zip.
"PowerShell 7-Zip" vs. "Compress-Archive" nativo de PowerShell.

https://t.co/Wflt5cyYvh

#cybersecurity #powershell #blueteam

[Adrián Lois @adrianlois_]

Instalar y configurar Microsoft LAPS para evitar movimientos laterales (Local Administrator Password Solution).

Artículo: https://t.co/kJOaPKWTI5

#laps #activedirectory #contraseñas #passwords #hardening #blueteam #ciberseguridad #cybersecurity #infosec #seguridadti

[Adrián Lois @adrianlois_]

Apache Log4j.
Resumen de vulnerabilidades asociadas a Log4Shell:
https://t.co/j5xsP9nthc

#log4j #log4shell #ciberseguridad #cybersecurity #vulnerabilities #vulnerabilidades #infosec

[Adrián Lois @adrianlois_]

Detectar, alertar y bloquear intentos de conexiones por fuerza bruta a los servicios de escritorio remoto RDP.

https://t.co/8gx6pRzROp

#threathunting #hardening #RDP #windows #infosec #ciberseguridad #seguridadti #cybersecurity

[Nicolas Krassas @Dinosn]

Pentesting Active Directory https://t.co/fuSnfQD4qF

[John Lambert @JohnLaTwC]

JET is a Microsoft storage technology.
Access uses JET Red.
Windows uses JET Blue.
Redteam uses it to copy the in-use Windows account databases via the esentutl tool.
📎https://t.co/pKnETUD9K5
📎https://t.co/1WEo3YQcDv

[Daniel López @0xDanielLopez]

Presenting "TweetFeed"

Public repo that collects IOCs posted on Twitter in order to search them in your environment.

Interesting for #BlueTeam members, contains:

- URLs
- Domains
- IPs
- MD5/SHA256 hashes

Also includes queries for MS Defender.

🔗 https://t.co/C0a7fdxCvS