RootAccess

[RootAccess @binary_raider]

@zyn3rgy Great post @zyn3rgy - What was running on .50 and .51? DP and Site Server?

[RootAccess @binary_raider]

@Cyb3rMonk @caliskanfurkan_ I used the ldap part of this to detect sharphound/domain enumeration and it worked quite well.
Most provides were too noisy to consider using

[RootAccess @binary_raider]

@theluemmel @DrAzureAD @kfosaaen I think azure ad sso must be configured (normally done via GPOs / single setting) to get this working from a compromised domain joined machine. You need silver tickets for 2 endpoints and 8/10 it won’t work on first attempt - eventually does though

[RootAccess @binary_raider]

@DebugPrivilege Dare to share? I am guessing you're looking at the MFA claims in the token or?

[RootAccess @binary_raider]

@rucam365 Depends on size/complexity of environment. WDAC is better, AppLocker tends to beeasier to implement (policy is easy to bypass in case of business interruption).
^This for workstations, definitely wdac on servers.

[RootAccess @binary_raider]

@mubix @rucam365 WDAC is basically Applocker but blocks the system user/admins too (clearly not the same technology) . Also, wdac bypass is considered a security issue so microsoft keeps a list of known bypasses and advices to block them.
Put in simple, wdac policy cannot be bypassed

[RootAccess @binary_raider]

@DebugPrivilege Any ideas for a query using ‘Advanced Hunting’ in the security center?

[RootAccess @binary_raider]

@vysecurity I saw this one, which is quite mind blowing;

https://t.co/O76UMik9QD

[Ivan Kwiatkowski @JusticeRage]

Step 1: open a binary in IDA and press F5
Step 2: paste the decompiled code into OpenAI's chatbot

Someone's job just got way easier.

[RootAccess @binary_raider]

@_dirkjan @cnotin What privileges do you think should the app be assigned to not be suspicious but still good/escalated backdoor?

[RootAccess @binary_raider]

@cappercap1 @SecurePeacock Internet exposed [email protected] with TooColdInDenmark2022 is 1 step faster to compromise than capcap\administrator in Vanilla AD (after all, there is a Cisco firewall to protect the network for a compromise!)

[RootAccess @binary_raider]

@cappercap1 @st4ckh0und @biskopp3n Get that white man a black hoodie :)

[RootAccess @binary_raider]

@grumpy4n6 By the time you wrote this tweet, you could've driven there with your maniac driving skills and have it already now ;)

[RootAccess @binary_raider]

@_wald0 @cappercap1

[RootAccess @binary_raider]

@AndrewOliveau This is only possible if GA is domain synced user, correct? Or does it also work on cloud-only accounts? Not sure if Microsoft fixed what @DrAzureAD reported to them

[RootAccess @binary_raider]

@DrAzureAD Jey :) I think these two highlighted commands should be different? Same command, different outputs.

[RootAccess @binary_raider]

@DrAzureAD Oh, so the 'bypassing CA' is more of a future thing that you can register a device now and if they ever implement CA requiring device compliance, you'll still have a way in?

[RootAccess @binary_raider]

Hey @DrAzureAD .. Great 'new phishing technique' blog! I wonder, if we change the values to be for O365, will you get tokens that will allow login with a browser (by changing cookies) or is it all bound to device auth via an API - non GUI interactive?

[RootAccess @binary_raider]

@DrAzureAD Follow up .. do you know if any CA changes requireing Device Compliance breaks the method you described to make a device compliant? I am trying with AAD but not able to get tokens even - getting error when trying to sign in

[RootAccess @binary_raider]

@DebugPrivilege That's a good one! How did you find that the alert was based on that?