D Laplante

CyberSecurity / Specialist Infrastructure - Networking - Storage - VmWare - Servers Virtualization

[D Laplante @laplanted24]

@cyb3rops Add decoy entries to the robots.txt file as a honeypot mechanism.

[D Laplante @laplanted24]

@techspence How would you do it if a company does not have any app control applications in place right now? List all Hashes of RMM ? But will need to do it every time a new version is available? By name..too easy to rename the tool name ?

[D Laplante @laplanted24]

@_SaxX_ Qu'est ce que tu penses du référentiel de cyber France ? Le ReCyF

[D Laplante @laplanted24]

@DFIRTraining @cybertriage And add to that PowerShell Script Block Logging (Event ID 4104) 👌

[D Laplante @laplanted24]

I was playing around with the #hayabusa tool @SecurityYamato and spotted you name in it, @cyb3rops ! Awesome tool to provide a fast and thorough investigation option using #Sigma rules, and the option to update the rules is a really nice touch 👌

[D Laplante @laplanted24]

@_SaxX_ C'est le temps que NIS-2 arrive !!!
#mfa #requirement #Compliance

[D Laplante @laplanted24]

@_SaxX_ NIS-2 les attendent dans le détour?!? Pour ce qui est des Infrastructures critiques.

[D Laplante @laplanted24]

@techspence Ok Thx,

[D Laplante @laplanted24]

@watchtowrcyber @cyb3rops Exploiting through a management interface directly connected on the Internet? Who the hell is leaving a MGMT console on Internet!!

[D Laplante @laplanted24]

Use the same mitigation approach for .hta files as well.

[Stephan Berger @malmoeb]

PingCastle now highlights when no policy is in place to prevent scripting files (such as .js) from being executed via double-click.

A simple but effective mitigation is to configure these files to open in Notepad instead. This disrupts many common first-stage infection chains. Red Canary has published a short blog post that walks through setting this up with a small Group Policy Object: https://t.co/WpUIBnXchQ

[D Laplante @laplanted24]

@techspence Sysmon

[D Laplante @laplanted24]

@cyb3rops Given that initial access often occurs on workstations (e.g., phishing, drive-by), Which asset types should we prioritized for enabling Event ID 4688 with command-line logging, in order of importance (e.g., Tiers,Tiers,Workstation)

[D Laplante @laplanted24]

@cyb3rops Be sure to enable the setting "Include command line in process creation events" by setting it to "Enabled" to capture full command-line arguments in Event ID 4688

What about 4104 - Powershell ScriptBlockText ?

[D Laplante @laplanted24]

@UK_Daniel_Card They are using SharePoint as a C2..?!?

[D Laplante @laplanted24]

@JohnHultquist Oh I just red this "These actors rely on social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access."

[D Laplante @laplanted24]

@JohnHultquist Have you seen a consistent pattern in initial attack vector?

[D Laplante @laplanted24]

@elonmusk during this time... A moratorium has been voted on wind and solar energy in France.
This means that the French government will temporarily freeze:
New applications to install solar panels or wind turbines;
Authorizations already pending for new projects.

[D Laplante @laplanted24]

@JackRhysider Whoop baby !!

[D Laplante @laplanted24]

@sysadafterdark Hardly a week passes without the discovery of a vulnerability