Michael M

[Zscaler ThreatLabz @Threatlabz]

Check out our technical analysis of #RaspberryRobin's multilayered approach to thwarting analysis and evading detection.

Read the full technical analysis here: https://t.co/Vqsqh8vHeV

[Tijme Gommers @tijme]

My @OrangeCon_nl talk is live!

Elevate your knowledge: From COM Object Fundamentals To UAC Bypasses.

A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC!

https://t.co/H1VZJdBzTZ

[7h3h4ckv157 @7h3h4ckv157]

AD Pentesting ❤️‍🔥

Source: https://t.co/GdCnSISg9b

[Traceix @usetraceix]

Allow remote use of services.msc

sc sdset SCMANAGER D:(A;;CCLCRPRC;;;AU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

[Traceix @usetraceix]

Massive collection of shellcode for studying and learning: https://t.co/s85zYQiINU

[Josh Lemon @joshlemon]

If you're interested in getting into #Linux #logging and evidence collection, this is an excellent write-up from @Kostastsale that compares #EVTX logs on Windows with #Auditd, #SysMon for Linux, and native Linux logging.

#DFIR #LinuxForensics #SIEM #CSIRT
https://t.co/uukC9K0Ct2

[Luke Rogerson @NullMode_]

My company @ogSecConsulting has partnered with @zeropointsecltd to create some essential report writing training. It will not just boost your writing skills but also the efficiency & quality of your assessments. Check out what's covered in the course here: https://t.co/I22yGgJFEd

[LetsDefend @LetsDefendIO]

What is OSI model?

[CryptoCat @_CryptoCat]

Nice to see a lot of new educational content on @GameHackingAcad 👏

They've got an interactive site (https://t.co/cayaqknVFb), but also a downloadable PDF 👇

[rootsecdev @rootsecdev]

This was extremely well written. As a red teamer if you want to bypass modern defenses like exchange online protection… just disable your phishlet for 5-8 mins after you send your email.. Then bring it back up ☠️

https://t.co/NjuYjuLHXg

[Florian Roth ⚡️ @cyb3rops]

The RULER Project by @phillmoore is a centralized repository that curates and documents the types of logs and forensic details various applications generate by default to aid in digital investigations

[Nasreddine Bencherchali @nas_bench]

A quick DFIR tip for the weekend

Now that notepad on Win 11 saves its states and can open tabs. It means history is saved somewhere :)

Well that somewhere is in %localappdata%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState

A new location to monitor and check for unsaved files that might be used temporarily to copy things.

#dfir

[X @TheMsterDoctor1]

Search Engines for Pentesters!!!

#bugbounty #bugbountytips #cybersecurity #hacking @SaveToNotion

[ᴍɪᴄʜᴀʟɪs ᴍɪᴄʜᴀʟᴏs @Cyb3rMik3]

#Microsoft #Sentinel incident responders, I have a bookmark for you ⤵️

My buddy @BertJanCyber
decided to go down the IR rabbit hole & write the best guide for endpoint incident response with some awesome #KQL queries.

Check out, further parts to follow.

https://t.co/JiS022ctcx

[DirectoryRanger @DirectoryRanger]

Azure AD - Attack and Defense Playbook, by @Thomas_Live & @samilamppu
https://t.co/7SJvp6Ms9j

[ACE Responder @ACEResponder]

How AS-REP Roasting works. 🔐

This animation demonstrates the more secure Kerberos pre-auth and contrasts it with an AS-REP roasting attack which abuses the 'Do not require Kerberos preauthentication' setting.

#ThreatHunting #DFIR

[mRr3b00t @UK_Daniel_Card]

ever wanted to revoke all guest access from Office 365?

#PowerShell

This "should" do it...

Connect-AzureAD

Get-AzureADUser -Filter "UserType eq 'Guest'" -All $True | Set-AzureADUser -AccountEnabled $false
Get-AzureADUser -Filter "UserType eq 'Guest'" -All $True | Revoke-AzureADUserAllRefreshToken

$guests = Get-AzureADUser -Filter "UserType eq 'Guest'" -All $True | select -Property *
$guests | ConvertTo-Json | out-file guests.json

[ACE Responder @ACEResponder]

#ActiveDirectory DACL Abuse

Windows Event IDs that can be used to identify malicious modification of a user object.

#ThreatHunting #DFIR

[LetsDefend @LetsDefendIO]

Important Event IDs for Investigation

[mRr3b00t @UK_Daniel_Card]

After 20 years you can no longer brute force the local administrator account out of the box! #windows #securty