Ray Winder

Deputy CISO @Blackhawk, Security Practitioner, Advisor, and Mentor.

All thoughts are my own and not those of my employer.

[Sounil Yu @sounilyu]

Want to deep dive on the @cyberdefmatrix and learn new use cases (creating a roadmap, mapping incidents & constraints)? Join @sawaba and me for this Lab w/our wonderful facilitators (@ryanaraine, @SolvingCyber, @iamrayw, @JuliaaMarieee, @PaulIhme, @AllanAlfordinTX, @chris_foulon

[Rhino Security Labs @RhinoSecurity]

Learn how AWS misconfigurations can be exploited (starting with just low-priv IAM access)
https://t.co/iBhNRMsKau

[Ray Winder @iamrayw]

Verifying myself: I am iamrayw on https://t.co/oNFp0c0XrJ. a8e6Tjtn3kHpO6WuMeXrAfIYKfV_QYoSB_7r / https://t.co/ml4xkj2dPH

[Ray Winder @iamrayw]

@Mark_PSW @InfoSystir @tog1337 @bettersafetynet @fir3d0g @JNitterauer @aprilwright @BadassBowden @lelandneely @79engrchelle @jaysonstreet @ihackstuff Great job @Mark_PSW and everyone that helped make this!

[k0fin @k0fin]

New blog post! 😁

Non-Admin NTLM Relaying with https://t.co/AM2jAwQwXk to launch ETERNALBLUE and achieve RCE as SYSTEM
https://t.co/ol5S1TXaS1

[Ray Winder @iamrayw]

@DerbyCon

[Paul Asadoorian @[email protected] @securityweekly]

Tonight on #SecurityWeekly, we welcome @brysonbort, CEO & Founder of @scythe_io, @k0fin delivers the #TechnicalSegment, & we wrap the show with the #SecurityNews! Watch it LIVE at 6:00 p.m. EST @ https://t.co/MOiw5rZ2ju #RT

[Sean Metcalf @PyroTek3]

Slides from my #DerbyCon talk "From Workstation to Domain Admin..." are now on https://t.co/urL5tSqbim.

Slides:
https://t.co/QP2SJVbXxF

Talk Video: https://t.co/HihsL1y6fN

[k0fin @k0fin]

#paranoid @iamrayw

[SANS Offensive Operations @SANSOffensive]

SANS | #PenTest Blog

So You Wanna Be a Pen Tester? Different Paths To Consider (Updated)
by @edskoudis

w/ Bonus: Cheat Sheets, Posters, Archived Webcasts, and more...

Blog:   https://t.co/Abn9dSwkSA

[Tyler Robinson @tyler_robinson]

An amazing tool built by an awesome operator! Silent Internal Network Segment Recon using Discovery and Broadcast Protocols... Thanks @KoryFindley https://t.co/lkkhWKmO2B

[Rob T. Lee @robtlee]

#SANSHuntEvil Poster PDF Released! Brand New SANS "Hunt Evil" Poster. New Win10 "Know Normal" Processes, Lateral Movement - WMI, PwrShell, PSExec, SchedTask, Services, Share Mapping, RDP. #DFIR #ThreatHunting #InfoSec https://t.co/P52q3GxzMV

[Sean Metcalf @PyroTek3]

New https://t.co/urL5tSHMGW post: "Attacking Read-Only Domain Controllers (RODCs) to Own Active Directory"
Provides some attack scenarios and mitigation.
If you have RODCs in your #ActiveDirectory environment, you should read this.
https://t.co/Oj8MtwTh84

[Jake Williams @MalwareJake]

FakeNet-NG has been ported to Linux and it's already in @REMnux update stream. Love the new linux support! #malware
https://t.co/P6BYUYPOsE

[strandjs - [email protected] @strandjs]

Good architectures should be resilient to 0-days. App white listing, endpoint firewalls and egress white listing are the new min

[strandjs - [email protected] @strandjs]

Said in a testers meeting... "If it is a honey account... Should it not alert someone? And not be a domain admin?"

[strandjs - [email protected] @strandjs]

Security Tip Of The Day: Without segmentation and host-based firewalls, Active Directory is a hacker super highway.