biskopp3n

red team @mandiant

[biskopp3n @biskopp3n]

@Octoberfest73 File explorer does not like it so I usually spawn XYplorer from the process with injected ticket and browse from there.

[biskopp3n @biskopp3n]

@Octoberfest73 .\Rubeus.exe asktgt /user:Administrator /domain:DOMAIN /dc:https://t.co/mzJHhWO3jS.DOMAIN.local /password:XX /ptt /opsec

[biskopp3n @biskopp3n]

@Octoberfest73 Yes, they are massive. Had a few around 1GB and typically don’t exfil with CS but the option is nice for smaller environments

[biskopp3n @biskopp3n]

@Octoberfest73 Also tools like https://t.co/O1KDspN8aA for dumping files

[biskopp3n @biskopp3n]

@Octoberfest73 ADExplorer snapshot; adexplorer.exe -snapshot “” snapshot.dat

[biskopp3n @biskopp3n]

@filip_dragovic @0gtweet Thanks @filip_dragovic will look into this :)

[biskopp3n @biskopp3n]

Released a new Backup Operator to Domain Admin tool. It contains 4 different methods for escalation, more methods will be added: https://t.co/UytiiAipIO

[biskopp3n @biskopp3n]

@0gtweet Interesting, will take a look :) Btw great work on the PSBits tools 👏

[biskopp3n @biskopp3n]

@0gtweet Thanks, will look into this. I'm not sure the service attack is possible without reboot as the RCreateServiceW call updating the service db cannot be called without local admin, therefore the newly created service is not loaded on the target when only modifying registry.

[biskopp3n @biskopp3n]

@0gtweet Endless possibilities for sure, was also trying to identify some registry modification that could trigger execution immediately but that will have to wait for next update. If you know any feel free to DM :)

[biskopp3n @biskopp3n]

@_nwodtuhs @Jonas_B_K maybe you’ve researched this during your filtering attacks?

[biskopp3n @biskopp3n]

@vysecurity We mainly operate in CET business hours. Depending on the progress and the scenario we extend the working hours to evenings and weekends. If a freeze is coming up, we typically ask for extending the working hours. Restrictions in working hours is typically customer/WT request

[biskopp3n @biskopp3n]

@wdormann I don't think that's possible, since WDAC is controlling what is allowed and everything is default denied. The Deny rules in the policy is used when things overlap, let's say you allow all Windows signed but you want to specifically block some LOLBINS then you will use deny rules

[biskopp3n @biskopp3n]

@magnusstubman history repeats itself 👀

[biskopp3n @biskopp3n]

@cappercap1 @Haus3c Pretty sure it’s InTunes🤷‍♂️

[biskopp3n @biskopp3n]

@SteveSyfuhs Side-eye 👀

[biskopp3n @biskopp3n]

@PizazzJazz @st4ckh0und misses you

[biskopp3n @biskopp3n]

@DCSecuritydk @DebugPrivilege Didn’t you do this once? I remember we talked about it at some point

[biskopp3n @biskopp3n]

Tradecraft Analysis finished at #BHUSA Learned a lot, definitely expands your adversarial mindset! Thanks @jaredcatkinson @tifkin_ @mcbroom_evan @michaelbarclay_