cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:
- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata
this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.
the in depth Azure coverage was provided by @s1zzzz
This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)
cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:
- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata
this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.
the in depth Azure coverage was provided by @s1zzzz
This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)
cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:
- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata
this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.
the in depth Azure coverage was provided by @s1zzzz
This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)
cloud_metadata_check - BOF to probe cloud-local metadata services (IMDS, App Service, Arc HIMDS, WireServer) that can:
- fingerprint AWS, Azure, and GCP from the current process
- report IAM and managed-identity credential snippets
- probe Azure App Service, Arc HIMDS, and WireServer extension metadata
this is very useful for SA and pivoting, by mining cred material we can see what access this instance has and use that or try to pivot further; more info commented below.
the in depth Azure coverage was provided by @s1zzzz
This is the windows BOF version, soon I will be releasing a repo similar to Adrenaline, but for Linux and macOS environments ;)
@weezerOSINT denied all of my cyber-adjacent requests so far. no model is as tight as this one, it is unusable - even to edit markdown files in a repo that has some tooling
Splunk can be daunting to new detection developers, but when used right its an exceptional tool for detecting adversaries.
@sou_predictable's guide covers how to write queries that are fast and efficient to find what you're looking for.
Check it out! ⤵️ https://t.co/7saK1d5Pq4