Eyal Neemany

Lead Researcher at @Symantec Endpoint Division
Playing around Enterprise security, Active Directory and Windows.

[Eyal Neemany @Zwiitzer]

@robtlee
Reveal Powershell, CMD, Python History with this new PowerShell tool
https://t.co/DGrRe7r7e7
#DFIR

[SHELDON EVANS @SheldonEvans]

Let’s talk #NFTs and the market 💙

https://t.co/8Wn3LSDHbN

[Samir @SBousseaden]

added main detection artifact for EfsPotato (privesc via SeImpersonate to System with rogue named pipe) (same trick used for fake Spoolss privesc) - for #sysmon users add this to your config (Pipe Events)

<PipeName condition="contains" name="Rogue Named Pipe">\pipe\</PipeName>

[Dirk-jan @_dirkjan]

So yes, Zerologon (CVE-2020-1472) is quite easy to exploit. Unauthenticated user to Domain Admin. This is really scary. Run exploit, DCSync with DC account and empty NT hash: you have Domain Admin and a broken DC.
Awesome find by Tom Tervoort 🙂. Patch patch patch!

[Omer Yair 🟣 @yair_omer]

My talk "Exploiting Windows Exploit Mitigation for ROP Exploits" was accepted for @Defcon 2019! DC101 track on Thursday, your time will be exploited well there :)

Caspar David Friedrich, The wanderer above the sea of fog, 1818

[Dirk-jan @_dirkjan]

New blog! Abusing Exchange: One API call away from Domain Admin. From any user with a mailbox to Domain Admin. Probably affects the majority of orgs using AD and Exchange. https://t.co/rcW1RHJDuf

[Omer Yair 🟣 @yair_omer]

On the upcoming @DerbyCon I'll be talking about Invisi-Shell and Babel-Shellfish, two new tools we developed at @JavelinNetworks. Join me on Friday (first day) at 7:00 PM Track 3

https://t.co/yfZ7tzDcNO

[Eyal Neemany @Zwiitzer]

@PyroTek3 @BlackHatEvents @defcon @CyberArk @Thycotic Good luck ;)
Nice to see this topic brought up again

https://t.co/SPgWWxj7NY

[Hadar Yudovich @hadar0x]

Has anyone seen/used this file in #DFIR
"C:\Windows\System32\WDI\LogFiles\StartupInfo\<SID>_StartupInfo<NUM>.xml"
@phillmoore @MartinKorman

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Maybe one day I'll see more usage by security teams of #mimikatz or #kekeo for other functions than cleartext passwords, certificates export (or cheating at minesweeper).
Especially on Kerberos and/or SmartCards.

[Eyal Neemany @Zwiitzer]

@gentilkiwi My bad, you're right, It generates 1131f6ab-9c07-11d1-f79f-00c04fc2dcd2

[Rob T. Lee @robtlee]

And our brand new side of the "Find Evil" poster is the "Hunt Evil: Lateral Movement" which steps you through the main artifacts on windows hosts (SRC -> TARGET) for Remote Access/Execution (2/2) #DFIR

[Eyal Neemany @Zwiitzer]

Attackers techniques to bypass and steal #PSM #PAM protected domain credentials.
https://t.co/42jPGIUBAn
#pentestlab #redteam #ActiveDirectory #Kerberoast

[Hadar Yudovich @hadar0x]

If you do #DFIR and collect network connections - We found a way to extract a connection's timestamp in usermode. Check out our blog.
https://t.co/MAyNUj8EbB

[Paul Asadoorian @[email protected] @securityweekly]

Eyal Neemany, Domain Exploitation and Malware in the Olympics Hack – Enterprise Security Weekly #82 https://t.co/oldQt35nHC

[Eyal Neemany @Zwiitzer]

@ferrix Sure, PM me!
There was a missing piece of my puzzle when I looked into how your NTLM hash is changing when using 2FA accounts, I'd love to know what's behind it.

[Paul Asadoorian @[email protected] @securityweekly]

Eyal @Zwiitzer joins us to talk about bypassing two-factor authentication in Active… https://t.co/2tnQmcpIRS

[Jack Crook @jackcr]

Part of what I'm talking about I discussed a while ago https://t.co/Dl0FmxcPm8. The ability to dynamically identify behavior patterns. #DFIR

[Eyal Neemany @Zwiitzer]

@gentilkiwi Any chance to add AES keys support for lsadump::netsync instead of just ntlm hash?

[Eyal Neemany @Zwiitzer]

@PyroTek3 Detect AD Honeypots, Honey Tokens and Breadcrumbs with Invoke-HoneypotBuster using #Powershell #RedTeam
https://t.co/6T2bUTgS9b