dmnk

IT-Security, Pentesting, Cryptography. Maybe the occasional metal tweet.

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Glad to see you can now have Credential Guard running on legacy systems, even *without* Secure Boot

Surely not new, but it was not the case on first Windows 10 versions!

(Here on a Thinkpad X220 - 2011 ; the one on which most of #mimikatz 🥝was developed - ho irony 😂)

[syndrowm @syndrowm]

Catching up with my watch list. Good stuff from @n1v4d0 and @BalthasarMartin at #Troopers24

https://t.co/AHqfX4NQvM

> Effective honeypots are easily encountered and suggest a worthwhile attack path

Honeypots should:
- Be easy to find
- Appear valuable
- Blend in
- NOT be exploitable
- Minimize false positives

[Splendor of SQL 🇬🇧🇩🇪💖 @iam_Uchenna]

Microsoft is Offering FREE Certification Courses!No Fee, No Subscription, Just Start Learning.

Microsoft Security Operations Analyst
Course SC-200T00
96-Hour Course
Course Link: https://t.co/U7DelC0Y0Q

Microsoft Security, Compliance, and Identity Fundamentals
Course SC-900T00
24-Hour Course
Course Link: https://t.co/izcpY2d5WX

Microsoft Cybersecurity Architect
Course SC-100T00
96-Hour Course
Course Link: https://t.co/Cn3aY0RkXt

Designing and Implementing Microsoft Azure Networking Solutions
Course AZ-700T00
72-Hour Course
Course Link:https://t.co/NJ74l2uybj

Microsoft Azure Fundamentals
Course AZ-900T00
24-Hour Course
Course Link:https://t.co/1TNH0NF18h

Developing Solutions for Microsoft Azure
Course AZ-204T00
120-Hour Course
Course Link:https://t.co/ohNazvUU22

Microsoft Azure Administrator
Course AZ-104T00
96-Hour Course
Course Link:https://t.co/3Cpy33eNn3

Configuring and Operating Microsoft Azure Virtual Desktop
Course AZ-140
96-Hour Course
Course Link:https://t.co/1BtRamwWtT

Designing Microsoft Azure Infrastructure Solutions
Course AZ-305T00
96-Hour Course
Course Link:https://t.co/IhX6NN288h

Microsoft Azure Data Fundamentals
Course DP-900T00
24-Hour Course
Course Link:https://t.co/dsMvtaEm1V

Microsoft Azure AI Fundamentals
Course AI-900T00
24-Hour Course
Course Link: https://t.co/GajxfZfFtn

Develop Generative AI Solutions with Azure OpenAI Service
Course AI-050T00
24-Hour Course
Course Link:
https://t.co/YFe01jVyAt

Microsoft Power BI Data Analyst
Course PL-300T00
72-Hour Course
Course Link: https://t.co/XdU4Cbw7kl

Happy Learning!!

[rootsecdev @rootsecdev]

Found this gem from @_dirkjan github repository. More options for hybrid. I love using roadtx in the cloud.

https://t.co/x3yuGHRYMV

[Enno Rey @Enno_Insinuator]

Oh No, My RAN! Breaking Into an O-RAN 5G Indoor Base Station
https://t.co/bYtiWwdqhw [PDF]

[OtterHacker @OtterHacker]

I've published my #defcon32 workshop !
If you want to develop your own "Perfect DLL Loader", you will have all you need in it
From the classic minimal loader to a fully featured one, this workshop in 6 steps is a journey inside the Windows internals !

https://t.co/7xC33J4lat

[Dirk-jan @_dirkjan]

Time for @defcon! Super excited to drop some new Windows Hello research and abuse with @_EthicalChaos_ this afternoon! We are up 15:00 at track 2 today, don't miss it 😀

[Tim McGuffin @NotMedic]

Check this thread for NetNTLMv1 rainbow tables. The more folks who participate the quicker the torrent will be ready!

[Michael Bargury @mbrg0]

tool drop time. enjoy!
*powerpwn* v3 is out and its feature packed abusing m365 copilot

collect full dumps of sensitive data across email, teams, sharepoint, calendar

automated spear phishing

scour the internet for copilot studio bots leaking sensitive data

#DEFCON #BHUSA

[Mark Simos @MarkSimos]

Updated "golden configuration" guidance for Microsoft 365 security just went live from @BuckeyeGuyJFlo

This is an awesome reference for configuring Conditional Access and Intune policies

Share and enjoy!

https://t.co/3doqWBwCr1

[Orange Tsai 🍊 @orange_8361]

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd

Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996

[Eric Woodruff | MVP | CIDPRO @ericonidentity]

For those that came to the talk on UnOAuthorized, but had issues with the blog not being available… it’s up now 😅

#Entra #EntraID #M365 #infosec #azure

https://t.co/RR7sUl37hm

[rootsecdev @rootsecdev]

If you haven’t moved away from seamless SSO in Entra ID connect, this blog is gold to automating secrets rotation on the Kerberos decryption key. This account should be handled like the krbtgt account. Not rotating them in your environment is gross 🤢

https://t.co/ucfwx6KkEn

[The Haag™ @M_haggis]

🚨LOLRMM Update 🚂
You thought we were done? Nope.

🔥 Deduplication efforts are in the works
🔥 Experts (@_josehelps) are reviewing the site code to ensure we deliver the most epic LOLRMM experience.
🔥 More and more RMMs are being completed (@Kostastsale @nas_bench )
🔥 Who wants more Sigma rules? Because, we got them. Autogenerated + easily found on individual RMM pages.

Hoping the efforts are final soon and we can get this out the door! Be warned, it's a lot of data and we'll need lots of community ❤️ to make this 100%.

Teaser:

[CrowdStrike @CrowdStrike]

This morning, we published the Root Cause Analysis (RCA) detailing the findings, mitigations and technical details of the July 19, 2024, Channel File 291 incident. We apologize unreservedly and will use the lessons learned from this incident to become more resilient and better serve our customers. To any customer still affected, please know we will not rest until all systems are restored.

For the executive summary and full RCA, please visit https://t.co/VxZdW6gKmt

[sergey bratus @sergeybratus]

It's great to see Multiplier by @trailofbits being open-sourced! https://t.co/9r1WfebMIv I believe it exemplifies the kind of foundational, next-generation tools we need for proper software understanding, maintenance, and sustainment.

[rootsecdev @rootsecdev]

Ran across this little gem of an article this morning when I was researching ways of detecting PAW's in hybrid internal PT's.

How to enforce usage of Privileged Access Workstations for Admins

https://t.co/oklEXLO9E9

[The Haag™ @M_haggis]

🚨 LOLRMM Day 1 and 2 update 🚨

🔥 Spec created. Everything validates against it.
🔥 328~ RMM YAML's. Filled with artifacts.
We're still working to clean a few things up - dupes, incorrect items added. We're going to need the most ❤️ here from the community.
🔥CSV, JSON API Routes
🔥 @streamlit App is now complete - matching spec, built in validation, create new, review current, update and ship. We will publish when things are final.
🔥 Site is now generating. 😱 Find your favorite RMM, click through fancy pages.

Massive thanks to @_josehelps , @nas_bench , @Kostastsale for jumping in this weekend to push a fresh project out. Also much much Thank You to all those who reached out with RMM lists and artifacts. We will ship a blog when things are done and reference you all!

Teasers:

[SpecterOps @SpecterOps]

Even mature security orgs are vulnerable to NTLM relay attacks. In our latest blog post from @zyn3rgy explores a "lower-touch" method to control inbound 445/tcp traffic and leverage NTLM relay primitives more effectively.

Read for more ⤵️ https://t.co/Xsrdv01IMY

[ALI TAJRAN @alitajran]

Microsoft 365 Backup is now FINALLY available!

𝐒𝐮𝐦𝐦𝐚𝐫𝐲:

Microsoft 365 Backup is being rolled out in all commercial cloud environments.

Cybersecurity threats and ransomware attacks are on a high worldwide. Microsoft 365 Backup helps limit the operational and financial impact these attacks cause by providing a way to restore Microsoft OneDrive accounts, Microsoft SharePoint sites, and Microsoft Exchange Online mailboxes to a healthy pre-attack point in time in just hours.

𝐇𝐨𝐰 𝐭𝐨 𝐬𝐢𝐠𝐧 𝐮𝐩 𝐟𝐨𝐫 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭 𝟑𝟔𝟓 𝐁𝐚𝐜𝐤𝐮𝐩:

You can sign up for the product by following the below steps:

1. Sign in to Microsoft 365 admin center (https://t.co/WDyZATJY8D)
2. Expand Settings
3. Click on Microsoft 365 Backup

𝐖𝐡𝐞𝐧 𝐭𝐡𝐢𝐬 𝐰𝐢𝐥𝐥 𝐡𝐚𝐩𝐩𝐞𝐧:

General Availability (Worldwide): Microsoft will begin rolling out on July 31st, 2024, and expects to complete by mid-August 2024.

𝐇𝐨𝐰 𝐭𝐡𝐢𝐬 𝐰𝐢𝐥𝐥 𝐚𝐟𝐟𝐞𝐜𝐭 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧:

- Speed: Microsoft 365 Backup provides quick restore, enabling users to recover a healthy state of their data in hours instead of weeks or months.

- Security and privacy: Because Microsoft 365 Backup data is stored in the Microsoft 365 trust boundary and because the underlying Microsoft 365 Backup storage API platform limits its scope to just the backup and restore operations, you do not have to grant an application for overly permissive access to all of your private data. You also get the benefit of reducing your security breach surface and maintaining a more simplified security and privacy domain.

𝐖𝐡𝐚𝐭 𝐲𝐨𝐮 𝐧𝐞𝐞𝐝 𝐭𝐨 𝐝𝐨 𝐭𝐨 𝐩𝐫𝐞𝐩𝐚𝐫𝐞:

This rollout will happen automatically with no admin action required. You may want to notify your users about this change and update any relevant documentation as appropriate.

#Microsoft365 #Microsoft #Backup #ExchangeOnline #OneDrive #SharePoint #TechNews