Eric Soldierer

IT Security Consultant breaking and fixing mostly cloud things

[Kaido Järvemets @kaidja]

Create a fake computer account and change the UserAccountControl value to 8192. Now the AD thinks it is a domain controller.

[Eric Soldierer @EricSoldierer]

This is indeed some great work by @Thomas_Live

[sǝʌǝN sɐp pᴉʌɐD @david_das_neves]

Worth a look.
[Repo] Azure AD - Attack and Defense Playbook
https://t.co/jZNlYimdlD

#AzureAD #AAD #MicrosoftAzure #CyberSecurity

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Windows 365 is expensive and without basic security

Did #mimikatz dumped my Azure *cleartext* password here? Or my Primary Refresh Token?

It's funny how you don't apply best practices you recommend to the customer to avoid securing by default

> https://t.co/Wzb5GAfWfd

[Eric Soldierer @EricSoldierer]

This is gonna be a fun one. Come join me on this meetup about EDR :https://t.co/oj6EsX8gAU

[Florian Roth ⚡️ @cyb3rops]

An Empirical Assessment of Endpoint Detection and Response (#EDR) Systems against Advanced Persistent Threats Attack Vectors https://t.co/fTiEOMuY2T

[Vadim Khrykov @BlackMatter23]

#BloodHound is often used by threat actors and our red team brothers.
Despite it behaves like an elephant in a China shop (in some modes), many orgs can't detect it to this day😩

Use these 14 ideas & 29 rules to enhance your detection spider web🕸️
https://t.co/KZr8rvpwjr

[Florian Roth ⚡️ @cyb3rops]

The typical approach
#Ransomware

[Eric Soldierer @EricSoldierer]

On today's episode of: What could possibly go wrong?

Customer: "We don't use automatic lock screens because our CEO finds it too annoying to constantly enter their password"

also: password policy = 8 characters, no complexity

[Andy Robbins @_wald0]

I'm proud to announce the release of #BloodHound 4.0: The Azure Update!

Blog: https://t.co/pQxmjauZ5F
BloodHound 4.0 Release Poster: https://t.co/I6UuJtePhe

Get BloodHound: https://t.co/jQMzLJ9Fl4
Docs: https://t.co/QngrCQTOWb
Join the BloodHound Slack: https://t.co/oSzPG75Gei

[Eric Soldierer @EricSoldierer]

Super interesting article from @itm4n about a 0-day Windows privilege escalation. https://t.co/F06xuml9ya
One more reason to get rid of Win7...

[Eric Soldierer @EricSoldierer]

Just earned my MS-500 certification! https://t.co/3qYSoxBhwb
Lots of compliance and labeling/AIP stuff but very little Microsoft threat protection

[Jan Geisbauer @JanGeisbauer]

*** New Blog Post ***

THREAT HUNTING WITH MTP: THE SIXTH SENSE

https://t.co/TItXcw6OUL

[TrustInTechCologne @TrustInTechCGN]

We are thrilled to announce our first sponsor for the upcoming #TrustinTechCGN day event. Thank you @FEITIAN_Tech for your support! As platinum sponsor #Feitian will be talking about: #Paswordless #Authentication with Feitian and #Microsoft #Azure

🔒 https://t.co/c1HpH0VZ9z

[TrustInTechCologne @TrustInTechCGN]

We are excited to announce the next SPONSOR for our #TrustInTechCGN event on May 20 2020. Welcome @Lookout and thank you for your support!
As gold sponsor they will be showing mobile protections that safeguard both customer and corporate data.

[Jan Geisbauer @JanGeisbauer]

Cool new updates to M365 Attack Simulator - including attachment based ‚attacks’:

https://t.co/WxltFwiY12

[Alex Simons @Alex_A_Simons]

Many of you are going to love this: Public preview of #AzureAD support for Windows VM's in Azure is live. Greatly simplifies securing your IaaS deployments! https://t.co/2XsJszlBqh

[TrustInTechCologne @TrustInTechCGN]

Calling all #security #experts to submit sessions for our upcoming #TrustInTech #community event!

https://t.co/QmKPXv7wVa

[Eric Soldierer @EricSoldierer]

Great article about Conditional Access. I like to utilize #MDATP to determine the compliance status. This way, a compromised device is automatically rejected asap.

[Alex Fields @vanvfields]

Notes from the field: Windows 10 Device Compliance https://t.co/pI61OiQgEi

[Eric Soldierer @EricSoldierer]

Was about to attend a Webinar for @zscaler. Could not join in because it requires FLASH PLAYER! A webinar about a Security Product requires flash player. The irony...

[TrustInTechCologne @TrustInTechCGN]

We are happy to announce our next #TrustInTechCGN full-day event!

🖲️ - Register here: https://t.co/wve2jt6p5n
🚀 - Call for experts: https://t.co/QmKPXv7wVa

#TrustInTech #ITSecurity