Seamless Intelligence

[Matt Zorich @reprise_99]

We are often engaged with organizations that have lost complete control of their Microsoft Entra ID tenant, I wrote a comprehensive blog post on lessons learned from real world engagements to try to help reduce the risk of the same happening to you https://t.co/Z00BulYbuN

[Mike Nolan @mike_nolan__]

CVE-2023-23397 displays interesting changes when the invite goes through O365 rather than local injection into Outlook. The "ReminderFileParameter" disappears.
#Outlook #0day

[Seamless Intelligence @seamlessintel]

Part 3 of our series using the Sliver adversary emulation framework goes into a few detections using standard windows logs as well as Sysmon logs (Defender device logs can also be used and have a very similar structure to Sysmon.)

https://t.co/t4RnMfMNiV

[AISA National @AISA_National]

Congratulations to Seamless Intelligence for winning AISA's 2022 Cyber Security Small to Medium Business Employer of the Year award!
@Seamlessintelligence
#seamlessintelligence #smb #cybersecurityawards #Award #infosec #AISAawards #cybersecurityawards #Cyber #Cybersafety #winner

[Seamless Intelligence @seamlessintel]

https://t.co/dVuFwG3eke

[BSides Perth @BSidesPer]

Want to talk at BSides Perth on 18-19 Sept 2021? Here is your chance! Call for presentations open NOW! - https://t.co/dPew5J7XzE #cybersecurity #bsidesperth

[Seamless Intelligence @seamlessintel]

Some really nice new features for analysts and admins with version 7.5 of LogRhythm

https://t.co/rf9vzi8K3N

@LogRhythm

[Seamless Intelligence @seamlessintel]

https://t.co/hxqW8IUVFD

[Seamless Intelligence @seamlessintel]

Excellent write up from DIFR on some pretty basic malware, it's always nice to see alot of what it does batched up and easily accessible for testing.

https://t.co/pMB7W61W2M

[Tavis Ormandy @taviso]

I have something fun for you, I pulled the javascript interpreter out of Avast and ported it to Linux 😆

This runs unsandboxed as SYSTEM, any vulns are wormable pre-auth RCE on 400M endpoints  ¯\_(ツ)_/¯

https://t.co/vGrfke7fPd 🐧

[Seamless Intelligence @seamlessintel]

Nothing better @hackthebox_eu

[Mike Nolan @mike_nolan__]

https://t.co/rP7s2N4E71

Some big changes, including something I thought I'd never see.

- Added PowerShell

[Seamless Intelligence @seamlessintel]

https://t.co/WXZwxYJnrT

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

When I see "deployed a variant of the Mimikatz",but using:
-original file names (x64 & mimikatz.exe);
-same modules/functions names (sekurlsa::logonpasswords);
-not using mimikatz for other things than passwords;
-...
I can't understand how they can spread
https://t.co/T8MUhiNxaf

[Seamless Intelligence @seamlessintel]

https://t.co/Ti7aZfU7Oc

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

One point about @giulio_comi post on @NordVPN & #mimikatz "offline" password acquisition, with a LSASS *memory dump* to get the masterkey🤔
Machine masterkeys are protected by SYSTEM DPAPI SECRETS (in the registry)
You can have all your VPN credentials from a computer turned off

[SkelSec @SkelSec]

So, I managed to cram the LSASS and registry hive parsing capabilities of #pypykatz into webassembly via #pyodide
Parsing is fully offline and done in your browser.
Huge shoutout to @thugcrowd and @xEHLE_ who made the fancy webui for it and hosting it on their servers.

[Seamless Intelligence @seamlessintel]

Nice

[icd @wan0net]

Great explanation by Tristan on why indicators such as filenames are not that great for building monitoring rules - adversaries can change this just like that. As he says, you should build based on behavior. #bsidesperth #bsidesper

[Paresh Kerai @mamboz01]

SIEM stuff leading to Microsoft Bug bounty by @mike_nolan__ at #bsidesperth

[Kali Linux @kalilinux]

In case you missed it, Powershell was added to the Kali repo late last week.

Special thanks to @raphaelhertzog for doing the leg work necessary to make this happen.