Lets Not Leak

Senior Architect (CISSP), Incident Manager, Stubborn

[Lets Not Leak @Lets_Not_Leak]

@KKristianM Spännande!

[Lets Not Leak @Lets_Not_Leak]

@techspence Trust, and verify

[Lets Not Leak @Lets_Not_Leak]

@reprise_99 “We have the password in clear text in the description field for all users in Active Directory, it’s so much faster when they call help desk to tell the user!”

[Lets Not Leak @Lets_Not_Leak]

@KKristianM Alltså... hrrrm. :-)

[Lets Not Leak @Lets_Not_Leak]

@stokfredrik It looks and feels awesome! Great work @stokfredrik 🙌

[Lets Not Leak @Lets_Not_Leak]

My coworker and awesome digital forensic guru, @mranderssona has now published his research. Read, analyze and take precautions. Bug or feature? @Truesec https://t.co/0jVvBfBO58

[Lets Not Leak @Lets_Not_Leak]

If any of you have tried this, and it actually works, give @sans_isc a confirmation!

[SANS.edu Internet Storm Center @sans_isc]

Simplified Crowdstrike fix: Reboot system in "Safemode with Network". This may allow Crowdstrike to update to the most recent, fixed, version, without having to remove files.

[Lets Not Leak @Lets_Not_Leak]

@dlilja @MVPAward Well deserved 🙏👍🤘

[Lets Not Leak @Lets_Not_Leak]

@SecurityAura Can you elaborate on your findings? Had the TA exploited a known vulnerability to enumerate the FG local users? Then they moved on to challenge RADIUS/AD users?

[Lets Not Leak @Lets_Not_Leak]

@techspence @0gtweet We always clean the DC's to ensure that the TA gets eradicated.

[Lets Not Leak @Lets_Not_Leak]

@Marc_Laflamme @techspence Consider the Threat Actors capabilities to elevate from initial access to DA. And when TA is in possession of DA, all your domain connected systems will be at risk. If the TA is in ransomware business, then the TA will go for backup destruction, Virtualization overtake, end game.

[Lets Not Leak @Lets_Not_Leak]

@lintile OSPF

[Lets Not Leak @Lets_Not_Leak]

@MrDrunkMunki @techspence Actually no. You can create a cluster and control it with VMM, and no AD. Another solution is that you have a AD for your Hyper-V servers, but that AD has no relation with your corporate AD!

[Lets Not Leak @Lets_Not_Leak]

@techspence May I add: SSO and IT-Admins is a NO-NO!

[Lets Not Leak @Lets_Not_Leak]

@theXSSrat I guess the description field in Active Directory won’t be sufficient either if Notepad is disqualified. However, not unusual in IR cases.

[Markus Lassfolk @lassfolk]

A deep dive by Truesec into the Ransomware group Akira's way of breaking into Enterprise environments , and how to protect yourself

https://t.co/nyevCDgdB9

[Lets Not Leak @Lets_Not_Leak]

@cybersecmeg Happy birthday 🎈🎊🎁🎉

[Lets Not Leak @Lets_Not_Leak]

@stokfredrik Winter Vanlife for the win!!! 👍🙏

[Lets Not Leak @Lets_Not_Leak]

It was DNS. It's allways DNS. ping @mikael_nystrom
#incidentresponse #truesec