Dor

AI Security

[Dor @EdryDor]

@shakedko Thanks for the share! We recently also published a blog on similar issue in Claude Code gh action:
https://t.co/8NllUgYTe1

[Microsoft Threat Intelligence @MsftSecIntel]

Multifactor authentication (MFA) manipulation in compromised tenants can be hard to detect, as some changes can be dismissed as part of standard helpdesk processes. Microsoft shares guidance for hunting for MFA anomalies using Kusto Query Language (KQL): https://t.co/FVZ1ZKhPFZ

[Dor @EdryDor]

It's rare, but CSRF in oauth auth flow sometimes has real life exploitable scenarios! Use 'state' param :)

[Aviad Carmel @AviadCarmel]

We (@SaltSecurity ) could access *private* GitHub repos of *other* users, using....... ChatGPT!
Open the comments below to understand exactly how👇

[LiveOverflow 🔴 @LiveOverflow]

Web Security vs. Binary Exploitation

[Microsoft Threat Intelligence @MsftSecIntel]

Our analysis of an attempt to steal the cloud identity in a SQL Server instance for lateral movement highlights the importance of securing cloud identities and implementing least privilege practices when deploying cloud-based and on-premises solutions: https://t.co/RUyDVeyfP5

[Scott Piper @0xdabbad00]

Microsoft cloud is hiring a PM to manage nuclear reactors. https://t.co/O1P44xSMPN

[Adam Chester 🏴‍☠️ @_xpn_]

My Okta for Red Teamers post is up! We look at how Kerberos SSO works, how to intercept credentials via a fake AD Agent, decrypting AD Agent tokens, adding skeleton key's, and even how to deploy a janky SAML IdP server to auth as any user for good measure. https://t.co/Hs0wN5397s

[Microsoft Threat Intelligence @MsftSecIntel]

Adversary-in-the-middle (AiTM) phishing techniques continue to proliferate through the phishing-as-a-service (PhaaS) cybercrime model, as seen in the increasing number of-AiTM capable PhaaS platforms throughout 2023.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified highly targeted social engineering attacks by the threat actor Midnight Blizzard (previously NOBELIUM) using credential theft phishing lures sent as Microsoft Teams chats. Get detailed analysis, IOCs, and recommendations: https://t.co/1Ywtrlnme6

[Dor @EdryDor]

Must read for defenders by @ElroyMcThomas 💥 These kind of attacks can cause huge money loss for victims and can be easily prevented.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft security researchers have surfaced tell-tale patterns to help defenders identify and mitigate cloud cryptojacking, a form of cloud compute resource abuse that involves threat actors compromising cloud tenants to mine cryptocurrency: https://t.co/r2dbvYiC7j

[Orca Security @orcasec]

The Orca Research Pod has discovered a critical design flaw in the #GoogleCloud Build service that enables attackers to escalate privileges and gain unauthorized access to code repositories and images in Artifact Registry. Learn more: https://t.co/d7P1gveSyP

[Microsoft Threat Intelligence @MsftSecIntel]

We’re sharing more details from our investigation of the Storm-0558 campaign that targeted customer email, including our analysis of the threat actor’s techniques, tools, and infrastructure, and the steps we took to harden systems involved: https://t.co/XsgJNPMKKo

[Junion @Jun1on]

Full documentary on the $200,000,000 @eulerfinance hack!

[Dor @EdryDor]

Great write-up! worth reading 👀

[Orca Security @orcasec]

The Orca Research Pod discovered two vulnerabilities in #Azure that allowed Cross-Site Scripting (#XSS) attacks. Both vulnerabilities have now been fixed.☁️ Learn about the intricacies of these #vulnerabilities and how to prevent #XSSvulnerabilities: https://t.co/hNiThWwJfe

[Dor @EdryDor]

@BertJanCyber https://t.co/wT1m3W8Va3

[Dor @EdryDor]

Another day another AiTM campaign

[Microsoft Threat Intelligence @MsftSecIntel]

A multi-stage AiTM phishing and BEC activity spanning multiple banking & financial services orgs uncovered by Microsoft Defender Experts shows the complexity of these threats that abuse trusted relationships between orgs with the intent of financial fraud: https://t.co/VHIg2tWXbF

[Dor @EdryDor]

@RealJohnnyTime >0 😁

[Dor @EdryDor]

🚩Monitor for any interactive login from AAD on-prem account (MSOL_). Can be done by setting Honey Token activity in Defender for Identity.
🚩 Make sure your AAD Connect sync account is not global admin.

Hope you found it interesting, happy hunting!
11/11

[Dor @EdryDor]

Happy to share a new blog about super interesting incident I had a chance to investigate!
Read the thread to learn how threat actors are using AAD connect machines to pivot from on-prem -> cloud + executing multiple destruction and collection operations in the cloud ☁️
🧵1/n

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft detected a unique operation in which threat actors, tracked as MERCURY and DEV-1084, carried out destructive actions in both on-premises and cloud environments. Learn more about the observed activity and tools and get TTPs and protection info: https://t.co/5cxf0Kp1WS

[Dor @EdryDor]

Key takeaways from the incident:
🚩 Monitor for any low/medium/high risk sign-in of AAD sync account.
🚩Make sure your AAD sync account is not used for anything else besides what is supposed to.
🚩Treat your AAD Connect machine as Tier0!

10/n