Rich Hem

By day, Consulting Director for UnIt 42, Palo Alto Networks. By night, Multiverse Strategies for side projects. Opinions are my own.

[spencer @techspence]

If you’re an IT admin and you’ve never had your internal environment pentested and can’t afford one right now, do this instead:

1. Run Locksmith - fix anything that’s a High risk
2. Run ADeleginator - make sure everyone, authenticated users, domain users and domain computers doesn’t have any unsafe permissions
3. Run ScriptSentry - check for credentials in logon scripts
4. Run PingCastle - check the control paths section. It’s like bloodhound. Look for non-admins that have control paths

If you do this, your environment will be much better when you’re done fixing everything.

[Rich Hem @MultiverseStrat]

(Day job related) Every year, the Unit 42 IR team provides support to 100s of orgs responding to/recovering from major cyber attacks. Part of our mission is to share our learnings with you, so you can take proactive steps to better defend yourself. https://t.co/CuGEjIsNRq

[Rich Hem @MultiverseStrat]

This has been confirmed by research teams I trust to be dropping files and backdooring .

https://t.co/PBUoL2xZ7X

[Rich Hem @MultiverseStrat]

If anyone is dealing with Hive v5 ransomware ⬇️

[reecDeep @reecdeep]

Hi folks, I've just released my #Hive #ransomware v5 keystream decryption tool publicly available.

👇
https://t.co/2L87S46v63

#infosec #malware #reverseengineering #CyberSecurity