anders kortsen

Senior IT Security Architect

[anders kortsen @anderskortsen]

@TeamDreier

[anders kortsen @anderskortsen]

@M4yFly @Vikingfr @Sant0rryu @SaveToNotion #ADSecurity

[mpgn @mpgn_x64]

Dumping LSASS is such a 2020 move, let me introduce a new CrackMapExec module called Masky developed by @_ZakSec 🎉

If you have admin privilege, the module will impersonate all users connected -> ask a certificate (ADCS) -> retrieve the NT hash using PKINIT 🚀

Crazy module 🪂

[vx-underground @vxunderground]

Lockbit: "We're being DDoS'd because of the Entrust hack"

vx-underground: "How do you know it's because of the Entrust breach?"

Lockbit:

[anders kortsen @anderskortsen]

Microsoft have released guidance for CVE-2022-30190 https://t.co/dqhEvBNPhW #cve202230190 #MSDT #follina

[anders kortsen @anderskortsen]

🤦🏻‍♂️🤦🏻‍♂️🤦🏻‍♂️ 1) Regeringen bør ikke sige, at de gør noget, som de ikke gør 2) Måske regeringen skulle lytte til, hvad Ukraine efterspørger af hjælp

[Mads Korsager @MadsKorsager]

Mens 🇱🇹 har sendt Stinger-missiler og 🇨🇦 maskingeværer til #Ukraine, har dk ministre i to måneder fortalt, at vi sender #CyberSecurity. Men det er endnu ikke nået frem til dem i #Kiev der kæmper mod #Putin ‘s cyberhær #UkraineInvasion #dkforsvar https://t.co/MLf2qLw6kq

[anders kortsen @anderskortsen]

@Cqmillq Aldrig har det følt så godt at være ude af januar! 🥳

[anders kortsen @anderskortsen]

@ElsaWainblum Had a blast during November and December, but the January blues seems to have put it to a halt

[Microsoft Threat Intelligence @MsftSecIntel]

We have observed a China-based ransomware operator that we’re tracking as DEV-0401 exploiting the CVE-2021-44228 vulnerability in Log4j 2 (aka #log4shell) targeting internet-facing systems running VMWare Horizon. https://t.co/6GOdRwRTjk

[anders kortsen @anderskortsen]

@Cqmillq Kim Leines Grønlands-trilogi er helt fantastisk 🙏🏻
Ringenes Herre er også et helt klassisk eventyr, som man aldrig går galt i byen af 😇

[anders kortsen @anderskortsen]

@PertoDK So this is what dodging a bullet feels like 😂

[Florian Roth ⚡️ @cyb3rops]

Who is going to tell the public that 2.15.0 isn’t enough?
https://t.co/ZRJoDJexGP

[anders kortsen @anderskortsen]

#Log4j / #Log4Shell attack vector overview by @GovCERT_CH

[Florian Roth ⚡️ @cyb3rops]

"Hey guys, did I miss anything?"
#log4shell

[anders kortsen @anderskortsen]

It's been a busy weekend trying to keep up with #Log4j / #Log4Shell vulnerability 🥴 If you lack the overview then @NCCGroupInfosec made this meta thread with a lot of useful info 👇🏼
https://t.co/yCgwrXnTJ1

[anders kortsen @anderskortsen]

@10fMan7 @_JohnHammond @tryhackme I appreciate the learnings from the Web Exploitation days, but I do enjoy begin done with it and doing some stuff related to Windows forensics! 😅 cannot wait for tomorrow!

[anders kortsen @anderskortsen]

Day 8 of @tryhackme #AdventofCyber and what a fun challenge! @_JohnHammond Special, what's not to like? 🎅🏼

Takeaways:
🎄 Learned what Shellbags are
🎄 Utilized the ShellBags Explorer tool
🎄 Used #PowerShell Transcripts to identify what the Grinch did on Santa's laptop!

[anders kortsen @anderskortsen]

@rodtrent This wouldn't have been a problem if they had MdE - Maybe this should be my Christmas wish this year

[anders kortsen @anderskortsen]

@rodtrent I need your help 🙌🏼 I want to ingest Event Logs from #Windows 10/11 into #MicrosoftSentinel - I do not have #MdE or any 3rd party #XDR who have a connector to Sentinel. How can I archive this? (My googling skills are apparently broken🥴😅)
#Threatprotection #Microsoft

[anders kortsen @anderskortsen]

@rodtrent Thanks @rodtrent ! I'll give it a look and see if it would work for my customer 🙌🏼