Nick Tyrer

[Nick Tyrer @NickTyrer]

Quick post on how I got set up and hands-on with docker:

https://t.co/uBKvVaYL46

[Mark @sneakymonk3y]

It's been a while since I wrote the #BLUETEAMTIPS post - exactly a year tbh 😉

While I've only worked on a few recently I still strongly standby all previous points as a starting point to help defend your network. Try hit all 21 and see! 😎

#DFIR #BLUETEAMTIPS🔵

[b33f | 🇺🇦✊ @FuzzySec]

This is basically all that AMSI reports for DotNetToJScript execution 🤔.. I guess the error messages together with the base64 are probably informative enough to write a signature (I have not investigated at scale) 🔥🔫

[Nick Tyrer @NickTyrer]

@JPG1nc In your testing did this method work when Applocker is blocking .exe files in the Temp dir?

[bohops @bohops]

[Blog] Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques

https://t.co/Hf9jZDHuQZ

[Mark @sneakymonk3y]

I've updated the #BlueTeamTips blog post.

19. Control the Power of PowerShell

-The PowerShell “version 2 problem".
-Lock PowerShell down to only talk to RFC1918 ranges. @brunogdiniz 👏
-Monitor for PowerShell .NET assembly calls with Sysmon/EDR tooling

#DFIR #PowerShell

[Nick Tyrer @NickTyrer]

Updated my Metasploit module that assists in bypassing Applocker to include WMIC.exe bypass by @subTee and Workflow.Compiler.exe by @mattifestation. Give it a try here: https://t.co/BXDKb7z1Ax.

[Nick Tyrer @NickTyrer]

@sneakymonk3y Yup the R480 can use AMD's open source AMDGPU PRO driver. So you would get OpenGL, OpenCL, Vulkan support. AMD has overtaken Nvidia on Linux.

[Nick Tyrer @NickTyrer]

Three part blog post on how I switched to Linux and created a virtual lab using QEMU/KVM, IOMMU and PCI passthrough.
Post 1 https://t.co/fSqdtv0t4w
Post 2 https://t.co/5vyNMPXCzR
Post 3 https://t.co/pPkPqvOYGF

[Nick Tyrer @NickTyrer]

@sneakymonk3y Give it a go, it's pretty simple as long as you have the right hardware.

[Mark @sneakymonk3y]

Finally got round to finishing a few #BlueTeamTips on my blog - hope they help! #DFIR https://t.co/xdVzGXaDFS

[Nick Tyrer @NickTyrer]

@bohops @subTee @Oddvarmoe @mattifestation @Hexacorn @enigma0x3 @Moriarty_Meng @n3mes1s @0rbz_ Thank you.

[Nick Tyrer @NickTyrer]

@bohops @Oddvarmoe @MITREattack Thanks for notifying.

[Rotem Reiss @rotemreiss]

Mission accomplished.
#drupalgeddon2 #cve-2018-7600 #sa-core-2018-002
@drupalsecurity

https://t.co/NUqNXiezGC

[Oddvar Moe @Oddvarmoe]

New persistence technique using GlobalFlags in Image File Execution Options
https://t.co/Xkq6mC5K2q
Does not show up in Autoruns.exe.

Enjoy! #Blogpost #FeedBackWelcome

[bohops @bohops]

Windows Script File 'tampering' with manage-bde.wsf

(...not really sure if this script is needed for "backwards compatibility" anymore)

https://t.co/D63RXSmqcy

[Nick Carr @ItsReallyNick]

Lots more phishing documents - including one sent yesterday (MIT.doc) - and a breakdown of the TTP shift*️⃣ in our #MuddyWater 🇮🇷 campaign write-up: https://t.co/3FOrkzJ7YZ
That's a lot of POWERSTATS! #DFIR

*️⃣ Feb 2018 use of .INF + .SCT files https://t.co/5eEvkMEl7U

[Nick Tyrer @NickTyrer]

@bohops @Oddvarmoe @ItsReallyNick Thanks, great resource pulling all the research together.

[bohops @bohops]

Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence [featuring InstallHinfSection, CMSTP, LaunchINFSection]

Special thanks to @Oddvarmoe and @ItsReallyNick for their insight!

https://t.co/050zbVWOfO

[bohops @bohops]

AppLocker Bypass via remote SCT code execution:

rundll32.exe advpack.dll,LaunchINFSection c:\test.inf,DefaultInstall_SingleUser,1,

INF-SCT-CMSTP method inspired by @NickTyrer @KyleHanslovan @Oddvarmoe @subtee - https://t.co/1hzdVAZRdp

INF Test File - https://t.co/pZ3BhX3XTa